Patch Name: PHSS_22883 Patch Description: s700_800 10.20 OV ITO6.0X NT Agent Patch A.06.03 Creation Date: 01/03/13 Post Date: 01/03/16 Hardware Platforms - OS Releases: s700: 10.20 s800: 10.20 Products: OpenView IT/Operations 6.0 Filesets: OVOPC-CLT.OVOPC-NT-CLT,A.06.00 Automatic Reboot?: No Status: General Release Critical: No Path Name: /hp-ux_patches/s700_800/10.X/PHSS_22883 Symptoms: PHSS_22883: - Automatic Actions can't start applications that display a user interface. - The Event Interceptor might get into a looping state when running on an NNM system and the ovtrapd is stopped. - Multiple issues with the agent on MS Terminal Server systems running on NT 4.0. - Perl script might show strange behavior when called as monitor. - Logfile encapsulator might report an access violation when reading EventLog message. - Agent has to run as 'HP ITO account' user. - Agent installation might fail with 'Error from InformManager' when the Management Server is a multi homed host. - Agent installation adds the agent path to the system environment without checking if it's already there. Agent deinstallation doesn't remove this path at all. - Japanese messages might have wrong characters. PHSS_22008: - ITO requires the setting of all IP addresses in opc.hosts for NT multi homed hosts. - The control agent aborts when the /usr/OV/tmp/OpC/bin directory does not exist. - The installation aborts with the NetGetDCName API failing: network path not found. - The event correlation agent might abort. - In some situations the the source IP address of an incoming trap has the wrong byte ordering. - When there are many quickly incoming traps, the Event Interceptor does not handle them but instead buffers until there are new traps arriving. - Event Interceptor aborts when running on an NNM system and an invalid trap is received. - After distributing of templates to NT system, sometimes there is a message in the errorlog about failures while suspending threads. - Several changes for firewall environments. For detailed information refer to the VPO Firewall Configuration White Paper version 3.0 - The 'Processes' application on Windows 2000 produces a Dr.Watson window. - Event Interceptor aborts after receiving trap with unresolvable IP address. - If buffer file size limitation is enabled, the agent may discard low-severity messages even if there is still space in the buffer file. - The execution of monitors or applications might try to execute a directory. Defect Description: PHSS_22883: - The ITO agent can now run as non 'HP ITO account' user. This also includes the 'SYSTEM' account. Installation instruction: Use the manual installation. Before calling the 'opc_inst.bat' script, an additional entry can be added to the 'opcsetup.inf' file to specify the run user for the agent: [Agent User] SYSTEM Instead of 'SYSTEM', any other name could be specified. In this case the user account is created. If 'SYSTEM' is given, no user account is created (no 'opc_op' either). NOTE: User names may not contain space characters. If a user name is specified in 'opcsetup.inf', the agent will be installed using this account name, no matter if there was already an agent installed using another account. If a different user is specified in 'opcsetup.inf', the account created by the existing agent is not removed but left on the system. It has to be removed manually. If no user name is specified in 'opcsetup.inf', the installation will check if there is already an agent installed. If it finds one, the same user will be used. If a user is specified or found to be used by an old agent, and the password specified was not correct for this account, the user is removed and re-created. It has the same name afterwards but a different internal user ID. Applications: ------------- - All applications configured to run as 'opc_op' or 'HP ITO account' have to be changed to specify a user that exists on the system. - All monitoring executables will be run as the specified account. This might restrict some of the access rights to monitored applications. - The 'SYSTEM' account does not have any network access capabilities. Remote installation: -------------------- - On Domain Controllers there is the Installation Server service that executes the installation on remote systems in this domain. If this service is modified to run as 'SYSTEM', the remote installation is not possible at all (the 'SYSTEM' account does not have any access rights for remote systems). - If remote execution is wanted, the Installation Server service can be configured to run as a domain user that has Domain Admin user rights. PHSS_22008: check the list of the symptoms SR: R555003313 B555009712 B555009553 B555009412 B555009388 B555009360 B555009201 B555009153 B555009099 B555008912 B555008754 B555008729 B555008663 B555008526 B555008314 B555008309 B555008180 B555007966 B555007883 B555007847 B555007840 B555007752 B555007619 B555007602 B555007549 B555007478 B555007056 B555005125 8606161695 8606140211 Patch Files: /var/opt/OV/share/databases/OpC/mgd_node/vendor/ms/intel/nt/ A.06.03/RPC_DCE_TCP/opc_pkg.Z /var/opt/OV/share/databases/OpC/mgd_node/vendor/ms/intel/nt/ A.06.03/RPC_DCE_TCP/unzip.exe /var/opt/OV/share/databases/OpC/mgd_node/vendor/ms/intel/nt/ A.06.03/RPC_DCE_TCP/unzip.txt /var/opt/OV/share/databases/OpC/mgd_node/vendor/ms/intel/nt/ A.06.03/RPC_DCE_TCP/opc_inst.bat /var/opt/OV/share/databases/OpC/mgd_node/vendor/ms/intel/nt/ A.06.03/RPC_DCE_TCP/opc_pre.bat /var/opt/OV/share/databases/OpC/mgd_node/vendor/ms/intel/nt/ A.06.03/RPC_DCE_TCP/opcsetup.inf /var/opt/OV/share/databases/OpC/mgd_node/vendor/ms/intel/nt/ A.06.03/RPC_DCE_TCP/monitor/itoprocs.exe.Z /var/opt/OV/share/databases/OpC/mgd_node/vendor/ms/intel/nt/ A.06.03/RPC_DCE_TCP/monitor/sms_chk.bat.Z /var/opt/OV/share/databases/OpC/mgd_node/vendor/ms/intel/nt/ A.06.03/RPC_DCE_TCP/monitor/mf_service.bat.Z /var/opt/OV/share/databases/OpC/mgd_node/vendor/ms/intel/nt/ A.06.03/RPC_DCE_TCP/cmds/mfluse.exe.Z /var/opt/OV/share/databases/OpC/mgd_node/vendor/ms/intel/nt/ A.06.03/RPC_DCE_TCP/cmds/itomserv.exe.Z /var/opt/OV/share/databases/OpC/mgd_node/vendor/ms/intel/nt/ A.06.03/RPC_DCE_TCP/cmds/itoreg.cfg.Z /var/opt/OV/share/databases/OpC/mgd_node/vendor/ms/intel/nt/ A.06.03/RPC_DCE_TCP/cmds/opcdf.bat.Z /var/opt/OV/share/databases/OpC/mgd_node/vendor/ms/intel/nt/ A.06.03/RPC_DCE_TCP/cmds/opcps.bat.Z /var/opt/OV/share/databases/OpC/mgd_node/vendor/ms/intel/nt/ A.06.03/RPC_DCE_TCP/cmds/itodiag.exe.Z /var/opt/OV/share/databases/OpC/mgd_node/vendor/ms/intel/nt/ A.06.03/RPC_DCE_TCP/cmds/itokill.exe.Z /var/opt/OV/share/databases/OpC/mgd_node/vendor/ms/intel/nt/ A.06.03/RPC_DCE_TCP/cmds/itoreg.exe.Z /var/opt/OV/share/databases/OpC/mgd_node/vendor/ms/intel/nt/ A.06.03/RPC_DCE_TCP/cmds/itosdown.exe.Z /var/opt/OV/share/databases/OpC/mgd_node/vendor/ms/intel/nt/ A.06.03/RPC_DCE_TCP/cmds/itouser.exe.Z /var/opt/OV/share/databases/OpC/mgd_node/vendor/ms/intel/nt/ A.06.03/RPC_DCE_TCP/cmds/opcprfls.exe.Z /var/opt/OV/share/databases/OpC/mgd_node/vendor/ms/intel/nt/ A.06.03/RPC_DCE_TCP/cmds/mf_app.bat.Z /var/opt/OV/share/databases/OpC/mgd_node/vendor/ms/intel/nt/ AgentPlatform what(1) Output: /var/opt/OV/share/databases/OpC/mgd_node/vendor/ms/intel/nt/ A.06.03/RPC_DCE_TCP/opc_pkg.Z: None /var/opt/OV/share/databases/OpC/mgd_node/vendor/ms/intel/nt/ A.06.03/RPC_DCE_TCP/unzip.exe: None /var/opt/OV/share/databases/OpC/mgd_node/vendor/ms/intel/nt/ A.06.03/RPC_DCE_TCP/unzip.txt: None /var/opt/OV/share/databases/OpC/mgd_node/vendor/ms/intel/nt/ A.06.03/RPC_DCE_TCP/opc_inst.bat: None /var/opt/OV/share/databases/OpC/mgd_node/vendor/ms/intel/nt/ A.06.03/RPC_DCE_TCP/opc_pre.bat: None /var/opt/OV/share/databases/OpC/mgd_node/vendor/ms/intel/nt/ A.06.03/RPC_DCE_TCP/opcsetup.inf: None /var/opt/OV/share/databases/OpC/mgd_node/vendor/ms/intel/nt/ A.06.03/RPC_DCE_TCP/monitor/itoprocs.exe.Z: None /var/opt/OV/share/databases/OpC/mgd_node/vendor/ms/intel/nt/ A.06.03/RPC_DCE_TCP/monitor/sms_chk.bat.Z: None /var/opt/OV/share/databases/OpC/mgd_node/vendor/ms/intel/nt/ A.06.03/RPC_DCE_TCP/monitor/mf_service.bat.Z: None /var/opt/OV/share/databases/OpC/mgd_node/vendor/ms/intel/nt/ A.06.03/RPC_DCE_TCP/cmds/mfluse.exe.Z: None /var/opt/OV/share/databases/OpC/mgd_node/vendor/ms/intel/nt/ A.06.03/RPC_DCE_TCP/cmds/itomserv.exe.Z: None /var/opt/OV/share/databases/OpC/mgd_node/vendor/ms/intel/nt/ A.06.03/RPC_DCE_TCP/cmds/itoreg.cfg.Z: None /var/opt/OV/share/databases/OpC/mgd_node/vendor/ms/intel/nt/ A.06.03/RPC_DCE_TCP/cmds/opcdf.bat.Z: None /var/opt/OV/share/databases/OpC/mgd_node/vendor/ms/intel/nt/ A.06.03/RPC_DCE_TCP/cmds/opcps.bat.Z: None /var/opt/OV/share/databases/OpC/mgd_node/vendor/ms/intel/nt/ A.06.03/RPC_DCE_TCP/cmds/itodiag.exe.Z: None /var/opt/OV/share/databases/OpC/mgd_node/vendor/ms/intel/nt/ A.06.03/RPC_DCE_TCP/cmds/itokill.exe.Z: None /var/opt/OV/share/databases/OpC/mgd_node/vendor/ms/intel/nt/ A.06.03/RPC_DCE_TCP/cmds/itoreg.exe.Z: None /var/opt/OV/share/databases/OpC/mgd_node/vendor/ms/intel/nt/ A.06.03/RPC_DCE_TCP/cmds/itosdown.exe.Z: None /var/opt/OV/share/databases/OpC/mgd_node/vendor/ms/intel/nt/ A.06.03/RPC_DCE_TCP/cmds/itouser.exe.Z: None /var/opt/OV/share/databases/OpC/mgd_node/vendor/ms/intel/nt/ A.06.03/RPC_DCE_TCP/cmds/opcprfls.exe.Z: None /var/opt/OV/share/databases/OpC/mgd_node/vendor/ms/intel/nt/ A.06.03/RPC_DCE_TCP/cmds/mf_app.bat.Z: None /var/opt/OV/share/databases/OpC/mgd_node/vendor/ms/intel/nt/ AgentPlatform: None cksum(1) Output: 807165917 7433650 /var/opt/OV/share/databases/OpC/mgd_node/ vendor/ms/intel/nt/A.06.03/RPC_DCE_TCP/opc_pkg.Z 3162183940 113152 /var/opt/OV/share/databases/OpC/mgd_node/ vendor/ms/intel/nt/A.06.03/RPC_DCE_TCP/unzip.exe 1939298735 508 /var/opt/OV/share/databases/OpC/mgd_node/ vendor/ms/intel/nt/A.06.03/RPC_DCE_TCP/unzip.txt 4115030442 1664 /var/opt/OV/share/databases/OpC/mgd_node/ vendor/ms/intel/nt/A.06.03/RPC_DCE_TCP/opc_inst.bat 2405569119 1715 /var/opt/OV/share/databases/OpC/mgd_node/ vendor/ms/intel/nt/A.06.03/RPC_DCE_TCP/opc_pre.bat 388202266 133 /var/opt/OV/share/databases/OpC/mgd_node/ vendor/ms/intel/nt/A.06.03/RPC_DCE_TCP/opcsetup.inf 2464947784 61347 /var/opt/OV/share/databases/OpC/mgd_node/ vendor/ms/intel/nt/A.06.03/RPC_DCE_TCP/monitor/ itoprocs.exe.Z 2939951577 134 /var/opt/OV/share/databases/OpC/mgd_node/ vendor/ms/intel/nt/A.06.03/RPC_DCE_TCP/monitor/ sms_chk.bat.Z 3318698057 132 /var/opt/OV/share/databases/OpC/mgd_node/ vendor/ms/intel/nt/A.06.03/RPC_DCE_TCP/monitor/ mf_service.bat.Z 3048156552 3925 /var/opt/OV/share/databases/OpC/mgd_node/ vendor/ms/intel/nt/A.06.03/RPC_DCE_TCP/cmds/ mfluse.exe.Z 516284605 49768 /var/opt/OV/share/databases/OpC/mgd_node/ vendor/ms/intel/nt/A.06.03/RPC_DCE_TCP/cmds/ itomserv.exe.Z 1586237090 188 /var/opt/OV/share/databases/OpC/mgd_node/ vendor/ms/intel/nt/A.06.03/RPC_DCE_TCP/cmds/ itoreg.cfg.Z 2003580432 38 /var/opt/OV/share/databases/OpC/mgd_node/ vendor/ms/intel/nt/A.06.03/RPC_DCE_TCP/cmds/ opcdf.bat.Z 849569434 41 /var/opt/OV/share/databases/OpC/mgd_node/ vendor/ms/intel/nt/A.06.03/RPC_DCE_TCP/cmds/ opcps.bat.Z 1639814180 36073 /var/opt/OV/share/databases/OpC/mgd_node/ vendor/ms/intel/nt/A.06.03/RPC_DCE_TCP/cmds/ itodiag.exe.Z 2950571021 6858 /var/opt/OV/share/databases/OpC/mgd_node/ vendor/ms/intel/nt/A.06.03/RPC_DCE_TCP/cmds/ itokill.exe.Z 3887122869 13779 /var/opt/OV/share/databases/OpC/mgd_node/ vendor/ms/intel/nt/A.06.03/RPC_DCE_TCP/cmds/ itoreg.exe.Z 2696124353 46646 /var/opt/OV/share/databases/OpC/mgd_node/ vendor/ms/intel/nt/A.06.03/RPC_DCE_TCP/cmds/ itosdown.exe.Z 1048399349 51463 /var/opt/OV/share/databases/OpC/mgd_node/ vendor/ms/intel/nt/A.06.03/RPC_DCE_TCP/cmds/ itouser.exe.Z 1024478161 10104 /var/opt/OV/share/databases/OpC/mgd_node/ vendor/ms/intel/nt/A.06.03/RPC_DCE_TCP/cmds/ opcprfls.exe.Z 3746185156 778 /var/opt/OV/share/databases/OpC/mgd_node/ vendor/ms/intel/nt/A.06.03/RPC_DCE_TCP/cmds/ mf_app.bat.Z 3507093227 6469 /var/opt/OV/share/databases/OpC/mgd_node/ vendor/ms/intel/nt/AgentPlatform Patch Conflicts: None Patch Dependencies: None Hardware Dependencies: None Other Dependencies: None Supersedes: PHSS_22008 Equivalent Patches: ITOSOL_00067: sparcSOL: 2.6 2.7 2.8 PHSS_22884: s700: 11.00 s800: 11.00 Patch Package Size: 7760 KBytes Installation Instructions: Please review all instructions and the Hewlett-Packard SupportLine User Guide or your Hewlett-Packard support terms and conditions for precautions, scope of license, restrictions, and, limitation of liability and warranties, before installing this patch. ------------------------------------------------------------ 1. Back up your system before installing a patch. 2. Login as root. 3. Copy the patch to the /tmp directory. 4. Move to the /tmp directory and unshar the patch: cd /tmp sh PHSS_22883 5a. For a standalone system, run swinstall to install the patch: swinstall -x autoreboot=true -x match_target=true \ -s /tmp/PHSS_22883.depot By default swinstall will archive the original software in /var/adm/sw/patch/PHSS_22883. If you do not wish to retain a copy of the original software, you can create an empty file named /var/adm/sw/patch/PATCH_NOSAVE. WARNING: If this file exists when a patch is installed, the patch cannot be deinstalled. Please be careful when using this feature. It is recommended that you move the PHSS_22883.text file to /var/adm/sw/patch for future reference. To put this patch on a magnetic tape and install from the tape drive, use the command: dd if=/tmp/PHSS_22883.depot of=/dev/rmt/0m bs=2k Special Installation Instructions: BEFORE LOADING THIS PATCH... o It provides bug fixes and enhancements for the VPO A.06.00 Management Server system. o DO NOT use this patch with older releases of ITO, for example versions A.05.00, A.05.11 or A.05.30 (A) Patch Installation Instructions ------------------------------- (A1) Install the patch, following the standard installation instructions. For backing up the system before installing a patch, you may use opc_backup(1m) NOTE: MAKE SURE THAT NO AGENT OF THE PLATFORM ADDRESSED BY THIS PATCH IS DISTRIBUTED (either from the VPO Administrator's GUI or from command line using inst.sh) WHILE RUNNING SWINSTALL. Don't be afraid of the '-x autoreboot=true' option above. There won't be a reboot due to this VPO patch. You can skip this option if you like. NOTE: This patch must be installed on the VPO Management Server system, NOT on an VPO Managed Node directly. Changes will take effect on managed nodes by means of VPO Software Distribution (using 'Force Update' if there is already an agent installed on the managed node). See chapter 2 of the VPO Administrator's Reference manual for more information. - The ITO agent can now run as non 'HP ITO account' user. This also includes the 'SYSTEM' account. Installation instruction: Use the manual installation. Before calling the 'opc_inst.bat' script, an additional entry can be added to the 'opcsetup.inf' file to specify the run user for the agent: [Agent User] SYSTEM Instead of 'SYSTEM', any other name could be specified. In this case the user account is created. If 'SYSTEM' is given, no user account is created (no 'opc_op' either). NOTE: User names may not contain space characters. If a user name is specified in 'opcsetup.inf', the agent will be installed using this account name, no matter if there was already an agent installed using another account. If a different user is specified in 'opcsetup.inf', the account created by the existing agent is not removed but left on the system. It has to be removed manually. If no user name is specified in 'opcsetup.inf', the installation will check if there is already an agent installed. If it finds one, the same user will be used. If a user is specified or found to be used by an old agent, and the password specified was not correct for this account, the user is removed and re-created. It has the same name afterwards but a different internal user ID. Applications: ------------- - All applications configured to run as 'opc_op' or 'HP ITO account' have to be changed to specify a user that exists on the system. - All monitoring executables will be run as the specified account. This might restrict some of the access rights to monitored applications. - The 'SYSTEM' account does not have any network access capabilities. Remote installation: -------------------- - On Domain Controllers there is the Installation Server service that executes the installation on remote systems in this domain. If this service is modified to run as 'SYSTEM', the remote installation is not possible at all (the 'SYSTEM' account does not have any access rights for remote systems). - If remote execution is wanted, the Installation Server service can be configured to run as a domain user that has Domain Admin user rights. (B) Patch Deinstallation Instructions --------------------------------- (B1) To deinstall the patch PHSS_22883 run swremove: NOTE: MAKE SURE THAT NO AGENT OF THE PLATFORM ADDRESSED BY THIS PATCH IS DISTRIBUTED (either from the ITO Administrator's GUI or from command line using inst.sh) WHILE RUNNING SWREMOVE. # swremove PHSS_22883