Patch Name: PHCO_22449

Patch Description: s700_800 10.20 sar(1M) cumulative patch

Creation Date: 00/11/09

Post Date:  00/11/10

Repost: 00/12/13
	The patch documentation was modified to classify the patch
	as Critical, since it fixes a problem whereby sar(1M) can
	kill unrelated processes.  The Symptoms information was also
	modified to clarify a potential effect of the problem on a
	MC/ServiceGuard cluster node.

Hardware Platforms - OS Releases:
	s700: 10.20
	s800: 10.20

Products: N/A

Filesets:
	OS-Core.SYS-ADMIN

Automatic Reboot?: No

Status: General Release

Critical:
	Yes
	PHCO_22449: OTHER
		If sar(1M) cannot fork its child processes, it can
		kill unrelated processes.

Path Name: /hp-ux_patches/s700_800/10.X/PHCO_22449

Symptoms:
	PHCO_22449:

	1. sar(1M) does not handle fork() failure and can kill
	   some unintended proceses.  On an MC/ServiceGuard
	   node, this can result in an immediate reboot of the
	   cluster node causing downtime of the cluster node and
	   the applications executing on the node.

	2. sar(1M) signal handling kills some other processes of
	   the same process group, which are not related to sar.

	PHCO_14967:
	1. y2k changes which were incorporated in PHCO_8820 had
	   been backed out in the previous patch.

	2. sar(1M) gives negative values in the average fields.

	PHCO_14228:
	sar -f<file> -A output is unreadable due to bad
	formatting of the output.

	PHCO_10576:
	sar prints wrong results after reboot.

	PHCO_8820:
	The date field may display year as more than 2 digits.

Defect Description:
	PHCO_22449:

	1. When there is a fork() error, sar(1M) calls
	   kill(-1,SIGINT) because of which it kills
	   some unintended, unrelated processes also.

	Resolution:
	   Now sar(1M) is changed to exit(1) when there is a
	   fork() error, without killing unrelated processes.

	2. sar(1M) is using kill((pid_t)0, sig).Because of
	   which, sar(1M) used to send the signal to all the
	   members of its process group, which kills some
	   unintended processes also.

	Resolution:
	   sar(1M) is modified to get its pid and then sends
	   the signal to itself only.

	PHCO_14967:

	1. y2k changes were absent in PHCO_14228.

	Resolution:
	   y2k changes which were incorporated in PHCO_8820
	   had been backed out in the previous patch.

	2. "sar -d" reports negative numbers in average columns.

	Resolution:
	   The problem  occurred  due to overflow on the type
	   long fields of a structure.

	PHCO_14228:

	   sar -f<file> -A output is unreadable due to bad
	   formatting of the output.

	Resolution:
	   The output was correctly formatted on 9.x but
	   from 10.x onwards, this output format was not adhered to.

	PHCO_10576:

	   sar was using the previously saved record, which
	   is invalid after a reboot record.

	Resolution:
	   The problem was caused by using a previous data
	   record which is invalid after receiving a reboot
	   record.

	PHCO_8820:

	   Date field may display year as more than 2 digits

	Resolution:
	   The year should have calculated as year mod 100.

SR:
	8606155322 8606160569 8606151981 5003408567 5003386409
	5003395624 4701334763 1653204941

Patch Files:
	/usr/lib/nls/msg/C/sar.cat
	/usr/lbin/sa/sadc
	/usr/sbin/sar

what(1) Output:
	/usr/lib/nls/msg/C/sar.cat:
		None
	/usr/lbin/sa/sadc:
		sadc.c $Revision: 72.7.1.1 $
		PATCH_10_20: sadc.o 00/11/09
	/usr/sbin/sar:
		$Revision: 76.3.1.8 $
		PATCH_10_20: sar.o 00/11/09

cksum(1) Output:
	2203042947 556 /usr/lib/nls/msg/C/sar.cat
	1532922062 16384 /usr/lbin/sa/sadc
	1850086517 36864 /usr/sbin/sar

Patch Conflicts: None

Patch Dependencies: None

Hardware Dependencies: None

Other Dependencies: None

Supersedes:
	PHCO_8820 PHCO_10576 PHCO_14228 PHCO_14967

Equivalent Patches: None

Patch Package Size: 110 KBytes

Installation Instructions:
	Please review all instructions and the Hewlett-Packard
	SupportLine User Guide or your Hewlett-Packard support terms
	and conditions for precautions, scope of license,
	restrictions, and, limitation of liability and warranties,
	before installing this patch.
	------------------------------------------------------------
	1. Back up your system before installing a patch.

	2. Login as root.

	3. Copy the patch to the /tmp directory.

	4. Move to the /tmp directory and unshar the patch:

		cd /tmp
		sh PHCO_22449

	5a. For a standalone system, run swinstall to install the
	    patch:

		swinstall -x autoreboot=true -x match_target=true \
			-s /tmp/PHCO_22449.depot

	By default swinstall will archive the original software in
	/var/adm/sw/patch/PHCO_22449.  If you do not wish to retain a
	copy of the original software, you can create an empty file
	named /var/adm/sw/patch/PATCH_NOSAVE.

	WARNING: If this file exists when a patch is installed, the
	         patch cannot be deinstalled.  Please be careful
		 when using this feature.

	It is recommended that you move the PHCO_22449.text file to
	/var/adm/sw/patch for future reference.

	To put this patch on a magnetic tape and install from the
	tape drive, use the command:

		dd if=/tmp/PHCO_22449.depot of=/dev/rmt/0m bs=2k

Special Installation Instructions: None