10 Replies · Latest reply on Dec 6, 2017 12:21 PM by Jim Freeman

    Solaris 11 active process discovery without /usr/ucb

      The Solaris probe "Solaris - Active Processes" requires /usr/ucb/ps.  But our server architect is against installing /usr/ucb and polluting the beauty of the Solaris installation with outside packages.

       

      Has anyone successfully modified active process discovery to support Solaris 11 without /usr/ucb installed?    Discovery documentation says its required for Solaris 10 and below, and /usr/bin/ps for Solaris 11, but the probes definitely do not work on Solaris 11 if /usr/ucb is not installed.

       

      I'm thinking we're going to need to write a custom probe assuming that the output from /usr/bin/ps can be output in a compatible digestible format.

        • Re: Solaris 11 active process discovery without /usr/ucb
          Kar Meng Chook

          Hi Paul,

           

          /usr/ucb is needed for Solaris 11 as Discovery need to use this command for output.

           

          Documentation

          UNIX and Linux commands requiring root privileges for Discovery and Orchestration

           

          KB:

          ServiceNow Customer Service System

           

          I hope this sufficient to convince the server architect

           

          Thank you.

           

          Regards,

          Kar Meng

          • Re: Solaris 11 active process discovery without /usr/ucb
            Paul Ciarfella

            So the answer is that Solaris 11 provides a backwards compatibility option for /usr/bin/ps to generate output that matches the ucb version of ps.

             

            For example, the "Solaris - Active Processes" probe runs "/usr/ucb/ps -awwx" to get process information.

             

            The equivalent Solaris 11 ps command is "/usr/bin/ps awwx".  Eliminating the leading '-' in the command arg tells ps to go retro and run like the ucb ps.

             

            I modified the bash script in the probe to check the OS version and run the ucb ps or the Solaris 11 ps depending on OS (11 or 5.11 for example).

            2 of 2 people found this helpful
              • Re: Solaris 11 active process discovery without /usr/ucb
                Kar Meng Chook

                Hi Paul,

                 

                Thanks for your update. Sounds that you found the workaround for the issue by modified the bash script. Glad you update the result and I believe it will benefit community members who have similar requirement .

                Appreciate if you can mark this thread as answered with the comment that you provide earlier.

                 

                Regards,

                Kar Meng

                • Re: Solaris 11 active process discovery without /usr/ucb
                  Jim Freeman

                  Paul,

                  Do you know of any documentation of this "no dash" mode for /usr/bin/ps, and if it is supported in all versions of Solaris 11?  Below is all I could find, none of it "official" such as an Oracle man page:

                   

                  - Solaris 11 man page for /usr/bin/ps Synopsis - man pages section 1: User Commands  doesn't show a "no dash" syntax.

                   

                  - Oracle blog SRU 5.6: updates in ps(1) and /proc/<pid>/{cmdline,environ,execname} | Oracle Casper Dik's Blog talks about /usr/bin/ps removing the 80 column limit starting with Solaris 11.3, but no mention about "no dash" mode.

                   

                  - unix - PS Command in Solaris - Super User  says "On Solaris 11, if you use options without a dash (like /usr/bin/ps auxwww) they will be treated as UCB style options, and the output will show extra long lines, even when you are NOT running as root."  but does he mean all versions of Solaris 11?  His comment contains 3 more links, but they didn't help much.

                   

                  thanks, Jim

                  • Re: Solaris 11 active process discovery without /usr/ucb
                    Abhishek Tomar

                    Paul, I am facing the same issue here wherein the "Active Processes" are not being picked by the solaris probe for V11.

                    Since, i am not familiar with solaris commands, can you help me out in modifying the existing probe. Following is the code:

                    #!/bin/sh

                    #

                    # Only get our processes, not our child zone processes

                    #

                    ZONENAME=$1

                    IFS="

                    "

                    ZONECMD=/usr/bin/zonename

                    PSCMD="/usr/bin/ps"

                    UCBPSCMD="/usr/ucb/ps"

                    PSARGS="-o pid,ppid"

                    AWKCMD="awk"

                     

                     

                    # First output just the heading for ps's output, tacking on a COMMAND column

                    echo PID PPID COMMAND

                     

                     

                    # Check for existence of zonename command

                    if [ ! -z "$ZONENAME" ]; then

                            ZONEPARAM="-z ${ZONENAME}"

                    elif [ -f $ZONECMD ]; then

                    # exists: limit ps to display processes for this zone

                            ZONEPARAM="-z `$ZONECMD`"

                    else

                    # doesn't exist: ps to display all processes

                            ZONEPARAM="-e"

                    fi

                     

                     

                    # Replace awk command with nawk if it is available

                    # awk has a byte limit of 2559 bytes on older solaris machines

                    if hash nawk 2>/dev/null; then

                      AWKCMD="nawk"

                    fi

                     

                     

                    # Iterate through each line of ps output...

                    for LINE in `$PSCMD $ZONEPARAM $PSARGS`; do

                    PID=`echo $LINE | $AWKCMD '{print $1}'`

                    # Check that this line isn't the header, and it's valid in /proc

                    if [ "$PID" != "PID" -a -f "/proc/$PID/status" ]; then

                    # use ucb/ps to get full, non-truncated command+args

                    CMD=`$UCBPSCMD -awwx $PID | tail +2 | $AWKCMD '{$1="";$2="";$3="";$4="";print $0}'`

                    # tack on the command+args to the output

                    echo $LINE $CMD

                            fi

                    done

                     

                     

                    ------------------

                    Also, would this command work: ps -aux

                    What changes do i need to make to the sensor script?

                     

                    Thanks

                      • Re: Solaris 11 active process discovery without /usr/ucb
                        Paul Ciarfella

                        Abhishek,

                         

                        Here's the revised ps.sh script:

                         

                        Paul

                         

                         

                        #!/bin/sh -x

                        #

                        # Only get our processes, not our child zone processes

                        #

                        ZONENAME=$1

                        IFS="

                        "

                        ZONECMD=/usr/bin/zonename

                        PSCMD="/usr/bin/ps"

                         

                        UCBPSCMD="/usr/ucb/ps -awwx"

                        PSARGS="-o pid,ppid"

                        AWKCMD="awk"

                         

                        #

                        # PWC Solaris 10 and older have ucb/ps installed.  Solaris 11 does not.

                        #     But Solaris 11 generates /usr/bin/ps compatible output for  when -

                        #     is not at the front of the first command argument.

                        #

                        SOLVERSION=`uname -r`

                         

                        # First output just the heading for ps's output, tacking on a COMMAND column

                        echo PID PPID COMMAND

                         

                        # Check for existence of zonename command

                        if [ ! -z "$ZONENAME" ]; then

                                ZONEPARAM="-z ${ZONENAME}"

                        elif [ -f $ZONECMD ]; then

                        # exists: limit ps to display processes for this zone

                                ZONEPARAM="-z `$ZONECMD`"

                        else

                        # doesn't exist: ps to display all processes

                                ZONEPARAM="-e"

                        fi

                         

                        # Replace awk command with nawk if it is available

                        # awk has a byte limit of 2559 bytes on older solaris machines

                        if hash nawk 2>/dev/null; then

                          AWKCMD="nawk"

                        fi

                         

                        # Iterate through each line of ps output...

                        for LINE in `$PSCMD $ZONEPARAM $PSARGS`; do

                             PID=`echo $LINE | $AWKCMD '{print $1}'`

                             # Check that this line isn't the header, and it's valid in /proc

                             if [ "$PID" != "PID" -a -f "/proc/$PID/status" ]; then

                                  # use ucb/ps to get full, non-truncated command+args

                                  #

                                 if [[ "$SOLVERSION" == *"11"* ]]; then

                                      CMD=`/usr/bin/ps awwx $PID | tail +2 | $AWKCMD '{$1="";$2="";$3="";$4="";print $0}'`

                                else

                                      CMD=`/usr/ucb/ps -awwx $PID | tail +2 | $AWKCMD '{$1="";$2="";$3="";$4="";print $0}'`

                                fi

                               # tack on the command+args to the output

                               echo $LINE $CMD

                        fi

                        done