Subject:Re: [vserver] vxW: [»crond«,6405:#40041|40041|4004 1] messing with the procfs.
From: Ramkumar Cherukuri <ramkumar.ch03@gmail.com>
Date: Mon, 26 Oct 2009 21:28:11 -0500
Mon, 26 Oct 2009 21:28:11 -0500
Thank you Herbert for your warm welcome and detailed explanation.
---Ram

On Mon, Oct 26, 2009 at 7:27 AM, Herbert Poetzl <herbert@13thfloor.at>wrote:

> On Sun, Oct 25, 2009 at 11:01:29PM -0500, Ramkumar Cherukuri wrote:
> > Hi,
>
> > I am new to Linux vserver.
>
> welcome to Linux-VServer then :)
>
> > I am getting this messages in my syslog after running
> > testfs.sh to report a bug with vserver kernel.
>
> kernel/patch and util-vserver version would be
> helpful, but I think testfs.sh is not really
> related to the warnings (vxW means Linux-VServer
> Warning) you are seeing
>
> > What is it?
>
> the 'messing with the procfs' warning tells you,
> that a process (in your case 'crond') tried to
> access a part of the procfs in a way which is
> not allowed inside a guest (usually writes to
> entries which are blocked/read-only)
>
> > Is it hamful to myserver.
>
> no, the warning itself means that it was prevented,
> so no harm was done, nevertheless, a good admin
> wants to find out  what  caused it, and how it
> can be stopped from happening ...
>
> > Can any one help me?
>
> check what crond (inside guest 40041) does (for
> example via strace -fF) and see if there are writes
> to proc entries which are protected ... then remove
> them (most likely from one of the proc scripts)
>
> > vxW: [»crond«,6405:#40041|40041|40041] messing with the procfs.
> > vxW: [»crond«,6433:#40041|40041|40041] messing with the procfs.
> > vxW: [»crond«,6435:#40041|40041|40041] messing with the procfs.
> > vxW: [»crond«,6464:#40041|40041|40041] messing with the procfs.
> > vxW: [»crond«,6490:#40041|40041|40041] messing with the procfs.
> > vxW: [»crond«,6516:#40041|40041|40041] messing with the procfs.
> > vxW: [»crond«,6544:#40041|40041|40041] messing with the procfs.
>
> > PM: Adding info for No Bus:vcs1
> > PM: Adding info for No Bus:vcsa1
> > PM: Removing info for No Bus:vcs1
> > PM: Removing info for No Bus:vcsa1
>
> [zapped because not Linux-VServer related]
>
> > vxW: [»bash«,4196:#40041|40041|40041] did lookup hidden f1c07420[#0,3]
> > »/dev/pts/1«.
>
> the message above (also a warning) tells you that
> a process (bash, pid=4196) did lookup a pts (terminal)
> which is hidden inside a guest. this usually happens
> when you enter a guest (no when you ssh into it :)
> and bring a pts from the host into the guest and then
> run something like pstree or 'ps auxwww'
>
> > vxW: [»crond«,6298:#40041|40041|40041] messing with the procfs.
> > vxW: [»crond«,6325:#40041|40041|40041] messing with the procfs.
>
> > Is there any thing wrong with this syslog?
>
> not much wrong there, the PM (power management)
> events look a little strange to me for a server,
> but they are not Linux-VServer related ...
>
> > Can you let me know what i need to do?
>
> for the Linux-VServer warnings, see above, or simply
> ignore them if you do not want to find the cause and
> remove the offending access ...
>
> best,
> Herbert
>
> > Thank you,
> > ---Ram
>



-- 
---Ram


Thank you Herbert for your warm welcome and detailed explanation.
---Ram

On Mon, Oct 26, 2009 at 7:27 AM, Herbert Poetzl <herbert@13thfloor.at> wrote:
On Sun, Oct 25, 2009 at 11:01:29PM -0500, Ramkumar Cherukuri wrote:
> Hi,

> I am new to Linux vserver.

welcome to Linux-VServer then :)

> I am getting this messages in my syslog after running
> testfs.sh to report a bug with vserver kernel.

kernel/patch and util-vserver version would be
helpful, but I think testfs.sh is not really
related to the warnings (vxW means Linux-VServer
Warning) you are seeing

> What is it?

the 'messing with the procfs' warning tells you,
that a process (in your case 'crond') tried to
access a part of the procfs in a way which is
not allowed inside a guest (usually writes to
entries which are blocked/read-only)

> Is it hamful to myserver.

no, the warning itself means that it was prevented,
so no harm was done, nevertheless, a good admin
wants to find out what caused it, and how it
can be stopped from happening ...

> Can any one help me?

check what crond (inside guest 40041) does (for
example via strace -fF) and see if there are writes
to proc entries which are protected ... then remove
them (most likely from one of the proc scripts)

> vxW: [»crond«,6405:#40041|40041|40041] messing with the procfs.
> vxW: [»crond«,6433:#40041|40041|40041] messing with the procfs.
> vxW: [»crond«,6435:#40041|40041|40041] messing with the procfs.
> vxW: [»crond«,6464:#40041|40041|40041] messing with the procfs.
> vxW: [»crond«,6490:#40041|40041|40041] messing with the procfs.
> vxW: [»crond«,6516:#40041|40041|40041] messing with the procfs.
> vxW: [»crond«,6544:#40041|40041|40041] messing with the procfs.

> PM: Adding info for No Bus:vcs1
> PM: Adding info for No Bus:vcsa1
> PM: Removing info for No Bus:vcs1
> PM: Removing info for No Bus:vcsa1

[zapped because not Linux-VServer related]

> vxW: [»bash«,4196:#40041|40041|40041] did lookup hidden f1c07420[#0,3]
> »/dev/pts/1«.

the message above (also a warning) tells you that
a process (bash, pid=4196) did lookup a pts (terminal)
which is hidden inside a guest. this usually happens
when you enter a guest (no when you ssh into it :)
and bring a pts from the host into the guest and then
run something like pstree or 'ps auxwww'

> vxW: [»crond«,6298:#40041|40041|40041] messing with the procfs.
> vxW: [»crond«,6325:#40041|40041|40041] messing with the procfs.

> Is there any thing wrong with this syslog?

not much wrong there, the PM (power management)
events look a little strange to me for a server,
but they are not Linux-VServer related ...

> Can you let me know what i need to do?

for the Linux-VServer warnings, see above, or simply
ignore them if you do not want to find the cause and
remove the offending access ...

best,
Herbert

> Thank you,
> ---Ram



--
---Ram