BEA WebLogic Server

Consider making the following changes:

• JVM GC Parameter

• Heap Size

• Execute Queue Thread Count

• Connection Backlog Buffering

JVM GC Parameter

For BEA WebLogic Server 8.1 SP4, to avoid the java.lang.OutofMemoryError reported by the WebLogic JVM 1.4.2_05, add the following JVM GC (garbage collection) parameter in the startWebLogic.sh JAVA_OPTIONS:

-XX:-CMSParallelRemarkEnabled

Set this parameter in addition to the other heap size and GC parameters that have been added for JVM 1.4.2 for Application Server 8.1 and Web Server 6.1.

For example, if Access Manager is installed in the default user_projects location (/usr/local/bea/user_projects/domains/mydomain/startWebLogic.sh):

JAVA_OPTIONS="-XX:+DisableExplicitGC -XX:+UseParNewGC
-XX:+UseConcMarkSweepGC -XX:+CMSPermGenSweepingEnabled
-XX:+UseCMSCompactAtFullCollection -XX:CMSFullGCsBeforeCompaction=0
-XX:+CMSClassUnloadingEnabled -XX:-CMSParallelRemarkEnabled
-XX:SoftRefLRUPolicyMSPerMB=0 -XX:+PrintClassHistogram
-XX:+PrintGCTimeStamps
-Xloggc:/usr/local/bea/user_projects/domains/mydomain/myserver/gc.log"

If you use WebLogic 9.x with Sun JVM 1.5 or later, then some of the GC algorithms can be safely removed. The following is a list of JVM options that can be used with Sun JVM 1.5 or later.

-XX:NewSize=336M -XX:MaxNewSize=336M
-XX:+DisableExplicitGC
-XX:+UseParNewGC
-XX:+UseConcMarkSweepGC
-XX:+PrintClassHistogram
-XX:+PrintGCTimeStamps
-Xloggc:/opt/WebSphere/AppServer/logs/server1/gc.log
-XX:-CMSParallelRemarkEnabled 

Heap Size

Modify the commonEnv.sh script in the /usr/local/bea/weblogic81/common/bin directory for heap size increases in the section where $PRODUCTION_MODE" = "true" (which should be set to true, before running Access Manager in /usr/local/bea/user_projects/domains/mydomain/startWebLogic.sh):

# Set up JVM options base on value of JAVA_VENDOR
if [ "$PRODUCTION_MODE" = "true" ]; then
  case $JAVA_VENDOR in
  BEA)
    JAVA_VM=-jrockit
    MEM_ARGS="-Xms128m -Xmx256m"
  ;;
  HP)
    JAVA_VM=-server
    MEM_ARGS="-Xms32m -Xmx200m -XX:MaxPermSize=128m"
  ;;
  IBM)
    JAVA_VM=
    MEM_ARGS="-Xms32m -Xmx200m"
  ;;
  Sun)
    JAVA_VM=-server
    MEM_ARGS="-Xms2688M -Xmx2688M -XX:NewSize=336M -XX:MaxNewSize=336M"
   # MEM_ARGS="-Xms32m -Xmx200m -XX:MaxPermSize=128m"

Execute Queue Thread Count

Set the Execute Queue Thread count to be more than the number of CPUs. For example, consider using a value that is twice the number of CPUs. Set this value in either the console or in the /usr/local/bea/user_projects/domains/mydomain/config.xml file:

<ExecuteQueueName="MyExecute Queue" ThreadCount="8" ThreadsIncrease="4"/>

For more information, see “Modifying the Default Thread Count” in “WebLogic Server Performance and Tuning” at:

http://e-docs.bea.com/wls/docs81/perform/WLSTuning.html#1142218

Connection Backlog Buffering

A guideline for setting Connection Backlog Buffering is 8192 for a server with 4 Gbytes of physical memory (which is equivalent to the ConnectionQueue size tuning set in the Sun Java System Web Server 6.1 magnus.conf file).

For more information, see “Tuning Connection Backlog Buffering” in the “WebLogic Server Performance and Tuning” document at:

http://e-docs.bea.com/wls/docs81/perform/WLSTuning.html#1136287

WebLogic Tuning Guide on Linux

OS limit Setting

OS Kernel Tuning

WebLogic Setting

<2007. 3. 30. 오후 4시 24분 20초 KST> <Warning> <J2EE> <BEA-160082> <There was an error while making the initial 
connection to the JMS resource named weblogic.jws.jms.QueueConnectionFactory from the EJB "StatelessContainer" 
inside application "beflyt". The server will attempt the connection again later. The error was 
javax.jms.JMSException: [J2EE:160048]JNDI lookup of the JMS connection factory 
weblogic.jws.jms.QueueConnectionFactory failed: javax.naming.NameNotFoundException: While trying to 
lookup 'weblogic.jws.jms.QueueConnectionFactory' didn't find subcontext 'jws' Resolved weblogic; remaining 
name 'jws/jms/QueueConnectionFactory'>

Memory Tuning

Servers/JDBC Tuning

WebLogic + Apache2 Tuning

WebLogic Debug

[IBM Dump Analyzer] javacore 분석툴 jca 사용하기

jca 툴은 javacore 를 분석할 수 있는 툴입니다. 
덤프파일의 생성은 JVM이 죽을경우 코어 파일을 만들어지게 됩니다.
또는 사용자가 직접 kill -3 PID 명령어를 이용해 덤프 파일을 생성하시면 되겠죠.
이 툴은 ibm 에서 제공하구요. 참고로 heapdump 를 분석하는 툴로 HeapAnalyzer 가 있다고하네요.
이글은 툴 다운로드 부터 실행까지 입니다. 자세한건 사용하시면서 알아가시면 될듯합니다. ^^
코어 분석에 도움 참고 사이트로 J2EE 어플리케이션에서 Bottleneck의 발생과 대처 방법 가 있습니다.




jca 툴 다운로드 : http://www.alphaworks.ibm.com/tech/jca/download

 asterisk (*)  체크된 부분만 입력하시고   I confirm 버튼 누르시면 됩니다.
참고로 View license 읽어보시구요. 한글도 지원하네요.

The fields indicated with an asterisk (*) are required to complete this transaction; other fields are optional. If you do not want to provide us with the required information, please use the "Back" button on your browser to return to the previous page, or close the window or browser session that is displaying this page.

경로 이동후 jar 파일을 실행 해주세요

java –Xmx300m –jar jca31.jar

경로 이동후 jar 파일을 실행 해주세요. 실행 때  -Xmx 옵션을 적용해서 메모리를 여유있게 주는것이 좋다고 하네요.

툴은 스윙으로 만들어져 있었습니다.

 Compre Threads 메뉴 이용해서 여러개의 javacore 파일을 비교 분석할 수도 있고

메모리상황 그리고 Thread의 Detail 한 정보까지 볼 수 있습니다.


참고로 readme31.zip 파일이 있습니다.

압축을 풀어보시면 readme.htm 파일이 있구요. 그걸 실행시키면

사용방법이 있습니다. 참고하시면 될듯합니다.   참고 : http://starplaying.tistory.com/81

How to run IBM Thread and Monitor Dump Analyzer for Java

You need to use the Java 2 Platform, Standard Edition version 5.0 or higher Java Runtime Environment (JRE) to run IBM Thread and Monitor Dump Analyzer for Java.

Usage <Java path>java –Xmx[heapsize] –jar jca<Thread and Monitor Dump Analyzer for Java version>.jar [javacore files separated by path delimiter] [analysis output HTML file]

For example,

C:\java\bin\java –Xmx200m –jar jca13.jar

=> Starts IBM Thread and Monitor Dump Analyzer for Java version 1.3 and open javacore files from menu.

/usr/java/bin/java –Xmx200m –jar /usr/jca/jca13.jar /usr/javacore.20060228.171037.2084.txt;/usr/javacore.20060228.171048.2084.txt

=> Starts IBM Thread and Monitor Dump Analyzer for Java version 1.3 with /usr/javacore.20060228.171037.2084.txt and /usr/javacore.20060228.171048.2084.txt

java –Xmx500m –jar jca13.jar  /usr/javacore.20060228.171037.2084.txt;/usr/javacore.20060228.171048.2084.txt output.html (On Windows system)

=> Starts IBM Thread and Monitor Dump Analyzer for Java with /usr/javacore.20060228.171037.2084.txt and /usr/javacore.20060228.171048.2084.txt and generates analysis output in output.html without invoking graphical user interface

WARNING: If the analysis output HTML file exists, the tool will overwrite the file.

If there’s java.lang.OutOfMemoryError while you are processing Javacore files, please try increasing the maximum heap size (-Xmx) value to give the JVM more memory.

Maximum heap size should not be larger than the size of available physical memory size for this tool due to performance issue.

1. Start IBM Thread and Monitor Dump Analyzer for Java

The following screen is a snapshot of the initial screen.

2. Select File-> Open Thread Dumps to open Javacore files if you didn’t specify Javacore files in the command line during the startup.

3. You can select multiple Javacore files

4. Loaded Javacore files are listed in the Thread Dump List table.

Thread Dump List provides the following information:

• Name: The file name of Javacore
• Runnable/Total Threads : Number of runnable and total threads
• Free/Allocated Heap : Amount of free and allocated Java heap
• AF/GC Counter: Allocation Failure and Garbage Collector counter
• Monitor : Number of Monitors locked. Deadlock is displayed if there’s any deadlock in Monitor

5. Click on a Javacore to display summary of the Javacore.

The following information is displayed for IBM Javacore:

• File name
• Cause of thread dump
• Date
• Process ID
• Java version
• Java Heap Information
  • Maximum Java heap size
  • Initial Java heap size
  • Garbage Collector Counter
  • Allocation Failure Counter
  • Free Java heap size
  • Allocated Java heap size
• Current Thread Name
• Number of loaded classes in Java heap
• Recommended size of kCluster (Only applicable to IBM SDK 1.4.2 and 1.3.1 SR7 or later)
• Java Command line

Non-IBM Javacore ( or thread dump ) provides limited information.

6. Click on Right Button of your mouse to bring up a menu.Or click on Analysis menu to display sub menu

7. The following is Thread Detail View of a Javacore:

Threads are sorted by thread name. Thread Detail View provides the following information:

• Thread Name : The name of a thread
• Thread State : The state of a thread for example, Runnable, Waiting or Suspended
• Method Name : The latest method invoked or predefined status or stack trace pattern for example, IDLE, LISTEN and KEEP-ALIVE
• Java Stack Trace : Java Stack Trace is shown when a thread is selected.
• Native Stack Trace : Native Stack Trace is shown below Java Stack Trace if it’s available

NOTE:

• An IDLE thread is a thread that is ready to receive work but does not have a connection established.
• A KEEP-ALIVE thread is an idle thread that is ready to receive work and does have a connection established.
• A LISTEN thread listens on a port
  
  

8.If  a thread owns monitors, thread name is marked with a special icon and threads that are waiting for monitor lock are displayed.

In the following example, the thread,Plato priority9, has monitor ownership icon. In waiting threads list, Aristotle and Socrates threads are displayed.

If a thread is waiting for monitor lock, thread name is marked with a special icon and thread that owns monitor lock is displayed.

In the following example, the thread,Aristotle priority5, has waiting for monitor lock icon in name column.

In Blocked by list, Plato priority9 which owns the monitor is displayed:

9. You can sort any column by clicking on table header. The following is Thread Detail View sorted by thread state

10. The following is Thread Detail View sorted by method.

11.Deadlock threads are shown in gray by default as follows:

12. Select multiple Javacore by holding Ctrl key and click on right button of your mouse and select Compare Threads

 Or select Analysis -> Compare Threads to display Compre Threads View

13.  The following is Compre Threads View of two Javacore.

Summary is displayed in the right pane. Thread name and method name are displayed from each Javacore on the table.

• Process ID
• First Dump : Timestamp of the first Javacore
• Last Dump : Timestamp of the last  Javacore
• Garbage Collections per Minute :  Number of Garbage Collections per minute
• Allocation Failures per Minute : Number of Allocation Failures per minute
• Elapsed Time : Time between the first Javacore and the last Javacore
• Number of hang suspects
• List of hang suspects

Red background indicates there’s possible hang in the thread. Green border indicates runnable thread. Blue border indicates waiting on monitor. Yellow border indicates waiting on condition.

14. Thread summary is displayed when a thread is selected.

15. Select Monitor Detail to display Monitor Detail View

16.    Monitor lock information is displayed in tree format

Total Size is total number of threads directly and indirectly related with a specific monitor.

Size is number of threads directly related with a specific monitor.

Click on one of the threads.

There are 47 threads waiting for the monitor which is locked by Servlet Engine Transports : 3049

Deadlock threads are displayed with the icon,

17. You can click on any thread to display detailed information about monitor and thread information

18. You can also compare Monitor in Compare Monitor View. Select Compare Monitors Menu

19. Red line indicates there’s possible hang in a specific thread in Compare Monitors View.

If you click on a thread, list of threads waiting for the locks that the thread owns is displayed in the middle pane. If you click on any thread in the middle pane, thread information is displayed on the right pane.

20. Select View-> Option to configure IBM Thread and Monitor Dump Analyzer for Java.

21. You can change default directory, color and other options.

22-1. Select a state in Color and click on Change button to change color.

22-2. Select a color and click on OK

23.In Advanced pane of option , you can customize stack trace pattern recognition engine:

·        ID List : ID list of customized stack trace pattern

·        ID : Identifier of stack trace pattern. No spaces allowed.

·        Stack Name : Stack trace pattern name that is seen from Thread Detail View

·        Stack Trace : Stack trace pattern. Syntax : “at package.class.method”.   No parenthesis allowed.

·        Description : description of a stack trace pattern

·        The tool will search for stack trace pattern and display Stack Name in Thread Detail View if any matching is found

·        WARNING : Please reopen thread dumps if new stack trace patterns are added if thread dumps are already loaded.

24. You can delete message in console by selecting Clear Console Menu

25. Select Close Thread Dumps to unload Javacore files.

26. Help menu displays help screen.

27. Select Help->About to display version information of IBM Thread and Monitor Dump Analyzer for Java

Copyrights and Notices

(C) Copyright IBM Corporation 2005-2008. All Rights Reserved. Note to U.S. Government Users Restricted Rights -- Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

AIX, Cloudscape, DB2, IBM, iSeries, OS/390, WebSphere, and z/OS are trademarks or registered trademarks of IBM Corporation in the United States and/or other countries.

Java and all Java-based trademarks and logos are trademarks of Sun Microsystems, Inc. in the United States and/or other countries.

Microsoft, Windows, and Windows NT are trademarks of Microsoft Corporation in the United States and/or other countries.

UNIX is a registered trademark of The Open Group.

Other company, product, and service names may be trademarks or service marks of others.

The following paragraph does not apply to the United Kingdom or any other country where such provisions are inconsistent with local law:

INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS TOOLS "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OR CONDITIONS OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Some states do not allow disclaimer of express or implied warranties in certain transactions, therefore, this statement may not apply to you. This information could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein; these changes will be incorporated in new editions of the tool. IBM may make improvements and/or changes in the product(s) and/or the program(s) described in this tools at any time without notices.


참고페이지 : http://starplaying.tistory.com/82

Memory Leak

출처 : http://theeye.pe.kr/entry/Flex-BlazeDS-with-Spring-Annotation?category=11

Flex 개발을 하다보면 서버와의 통신을 통해 다양한 방법을 사용할수 있다는 장점을 쉽게 알 수 있습니다.

하지만 안타까운게 Remote Object를 사용하기 위해서는 얼마인지 산출하기도 힘든 비싼 FDS (LCDS)를 구매해야 한다는 장벽이 있었죠.

이 장벽에 막혀 안정성이 확보되지 못한 일부 오픈 소스제품군을 사용하거나 다른 방식의 통신을 사용하여야 했습니다.

하지만 LCDS의 빠른 속도를 보장받을수는 없었죠. 현재 LCDS의 Remote Object 통신 프로토콜은 AMF3 (Action Message Format 3)까지 나왔습니다.

하지만 Adobe에서 BlazeDS라는 이름의 LCDS 무료버젼을 내놓았습니다. 또한 오픈소스로 개발 진행중입니다.

또한 Jeff Vroom 이라는 멋진 분이 Spring ↔ BlazeDS 간 통신할 수 있는 Factory를 개발하였습니다.

관련 정보는 다음을 참고하세요

[ 어도비 기술문서 ]
[ Sewon님 블로그 ]
[ 머드초보님 블로그 ]

하지만 위의 기술 내용들은 Spring Framework를 이용하여 어노테이션 기반으로 개발중이라면 여간 성가시게 만드는 부분이 많지 않은가 싶습니다.

위의 내용도 매우 간단해 지고 쉬워졌지만 BlazeDS도 어노테이션을 이용해 연동할 수 있으면 얼마나 좋을까 생각하게 만들었습니다.

그러던중에 좋은 자료를 발견하였습니다.

1. Spring에서 @RemotingDestination 어노테이션을 사용하기 위해 다음의 라이브러리를 다운받습니다. 여기에는 Jeff Vroom씨가 만든 Spring Factory도 포함하고 있습니다.

[ 다운받으러 가기 ]

2. remotingdestination-annotation.zip 파일을 개발중인 프로젝트의 WEB-INF/lib 디렉토리에 넣어줍니다.

3. BlazeDS의 설정파일인 services-config.xml 에 SpringAutowiringBootStrapService를 등록해 줍니다.

<?xml version="1.0" encoding="UTF-8"?>


<services-config>


    <services>


        <service-include file-path="remoting-config.xml" />


        <service-include file-path="proxy-config.xml" />


        <service-include file-path="messaging-config.xml" />


            <service id="spring-autowiring-bootstrap-service"


                class="flex.contrib.services.SpringAutowiringBootstrapService"/>


        <default-channels>


            <channel ref="my-amf"/>


        </default-channels>


    </services>



....




    <factories>


        <factory id="spring" class="flex.contrib.factories.flex.SpringFactory" /> 


    </factories>


</services-config>

package flex.contrib.samples.mortgage;



import org.springframework.beans.factory.annotation.Autowired;


import flex.contrib.stereotypes.RemotingDestination;



@RemotingDestination(destination="mortgageService")


public class Mortgage {


    @Autowired RateFinder rateFinder;


    public void setRateFinder(RateFinder rateFinder) {


        this.rateFinder = rateFinder;


    }



    public double calculate(double amount) {


        int term = 360; // 30 years


        double rate = rateFinder.findRate();


        return (amount*(rate/12)) / (1 - 1 /Math.pow((1 + rate/12), term));


    }


}

<?xml version="1.0" encoding="UTF-8"?>


<beans xmlns="http://www.springframework.org/schema/beans"


       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"


       xmlns:context="http://www.springframework.org/schema/context"


       xsi:schemaLocation="http://www.springframework.org/schema/beans


            http://www.springframework.org/schema/beans/spring-beans-2.5.xsd


            http://www.springframework.org/schema/context


            http://www.springframework.org/schema/context/spring-context-2.5.xsd">



    <context:annotation-config/>


    <context:component-scan base-package="flex.contrib.samples"/>


</beans>

var amfChannel:AMFChannel = new AMFChannel("my-amf", "http://localhost/messagebroker/amf");


var channelSet:ChannelSet = new ChannelSet();


channelSet.addChannel(amfChannel);


    


var remoteObject:RemoteObject = new RemoteObject();


remoteObject.channelSet = channelSet;


remoteObject.destination = "mortgageService";


remoteObject.addEventListener(ResultEvent.RESULT, resultHandler);


remoteObject.addEventListener(FaultEvent.FAULT, faultHandler);


remoteObject.calculate(5);

2001. 6.30

공재순/ kong@certcc.or.kr

1. 소개

LSOF는 'List Open File'의 약자로, 해당 System에서 구동되고 있는 프로세스들에 의해서 열려진 파일들을 확인 할 수 있는 툴이다. 시스템의 의심스러운 프로세스에 대한 확인이 용이하고, 설치가 비교적 쉬워 많이 이용되고 있다.

Top

2. LSOF 다운로드 받기

최신 버전은 ftp://vic.cc.purdue.edu/pub/tools/unix/lsof 에서 확인 할 수 있으며, 여러 개의 Mirror site 가 존재해 쉽게 다운로드 받을 수 있다.

Mirror site URL :

* ftp://ftp.cerias.purdue.edu/pub/tools/unix/sysutiles/lsof
* ftp://ftp.cert.dfu.du/pub/tools/admin/lsof
* ftp://ftp.cetis.hvu.nl/pub/lsof
* ftp://ftp.crc.doc.ca/packages/

Version 4 LSOF 는 gzip으로 압축되어 있으며, 파일명에 revision number를 포함하고 있다.

ftp://vic.cc.purdue.edu/pub/tools/unix/lsof_<rev>_W.tar.gz
또는 ftp://vic.cc.purdue.edu/pub/tools/unix/lsof_<rev>_W.tar.Z

※ 리눅스 시스템의 경우에는, 대부분 기본적으로 LSOF가 설치되어 있다. (만약 설치가 안되어 있는 상태라면 rpm 패키지로 배포하고 있으므로 linux 배포사이트를 이용하면 될 것이다.)

Top

3. 압축해제

이 문서에서는 ver.4(revision 4.56) LSOF를 Solaris OS에서 설치하는 과정을 보이도록 한다.

gzip -d lsof_4.56_W.tar.gz
tar -xvf lsof_4.56_W.tar

※ 참고로 4.56 버전의 lsof.tar 파일의 md5 checksum 값은 다음과 같으며, MD5 (lsof_4.56.tar) = 92155bb6430d14d044f8ca96858e63b8

md5 checksum tool은 아래 사이트에서 구할 수 있다.
ftp://ftp.cerias.purdue.edu/pub/tools/unix/crypto/md5

Top

4. 설치하기

LSOF 설치과정은 크게 압축해제 -> Inventory -> Configure -> Install 4단계로 볼 수 있다.

① 압축 풀기

우선 초기 Wrapper에 쌓인 파일 압축을 풀면 해당 디렉토리 내에 다음과 같은 5개 의 파일이 생성되고, 이와 함께 lsof_4.56 디렉토리가 생성된다.

[cert:root]:/user/kong> tar -xvf lsof_4.56_W.tar
x RELEASE.SUMMARY_4.56, 12803 bytes, 26 tape blocks
x README.lsof_4.56, 4129 bytes, 9 tape blocks
x 00.README.FIRST_4.56, 700 bytes, 2 tape blocks
x lsof_4.56.tar, 3317760 bytes, 6480 tape blocks
x lsof_4.56.tar.asc, 284 bytes, 1 tape blocks

Top

※ 생성된 lsof_4.56 디렉토리에 생성되는 주요 파일들

[sparc5:root]:/user/kong/lsof_4.56> ls
./ 00DIST 00README arg.c lsof_fields.h proto.h
../ 00FAQ 00XCONFIG dialects/ main.c regex.h
00.README.FIRST 00LSOF-L AFSConfig* lib/ misc.c scripts/
00CREDITS 00MANIFEST Configure* lsof.8 node.c store.c
00DCACHE 00PORTING Customize* lsof.h print.c usage.c
00DIALECTS 00QUICKSTART Inventory* lsof.man proc.c version

② Inventory

LSOF를 설치 할때 절대적으로 필요한 과정은 아니다. 그러나 subdirectory들을 체크하고, 각 스크립트들과 파일 헤더들, 소스파일들이 실제로 존재하는지 등 패키지 상태를 체크 해 볼 필요가 있다. 다음과 같이 Inventory 스크립트를 실행하게 되면, inventory 작업에 대한 소개 가 나오고 실행할 것인지 여부를 물어오는데 'y' 로 답하면서 진행하게 되면 디렉토리들의 list 를 확인할 수 있다.

[cert:root]:/user/kong/lsof_4.56> ./Inventory
Conducting an inventory of the lsof distribution; this will take a while.
Examining /user/kong/lsof_4.56: OK
Examining dialects: OK
....
....
Examining lib: OK
Examining scripts: OK
This lsof distribution seems to be complete.

Top

③ Configure

환경설정에 필요한 여러 단계의 작업을 하게 되는데, 아래와 같이 해당 OS에 맞 게 선택하고 Configure 스크립트를 구동하면 된다.

※Configure 스크립트 구동방법

Configure <options> <target-dialect>
<options>: -clean : clean up previous configuration
-d|-dialects : display a list of supported dialect versions
-h|-help : display help information
-n : avoid AFS, customization, and inventory checks

Top

[sparc5:root]:/user/kong/lsof_4.56> ./Configure solaris
Testing prdata.h for PR_GWINDOWS, using gcc
Testing prdata.h for PR_LDT, using gcc
Testing vnode.h for VSOCK, using gcc
.....

각 헤더파일 testing이 끝나면, 다시 inventory 해 볼 것인지를 물어보는데 file tree들을 변화시킬 것이 없다면 inventory과정을 re-run할 필요없다.

....
....
Do you want to take inventory (y|n) [y]? n
rm -f ddev.c dfile.c dlsof.h dmnt.c dnode*.c dproc.c dproto.h dsock.c dstore.c kernelbase.h machine.h machine.h.old new_machine.h __lseek.s Makefile
ln -s dialects/sun/ddev.c ddev.c
ln -s dialects/sun/dfile.c dfile.c
ln -s dialects/sun/dlsof.h dlsof.h
.....
ln -s dialects/sun/machine.h machine.h
kernelbase.h assembled.
Makefile and lib/Makefile created.

Top

위 과정에서 Make 파일이 생성됨을 볼 수 있으며, 이어 LSOF를 customize 할 것인지를 물어오는데 [yes/no] question을 따라 다음의 각 옵션을 사용자가 선택할 수 있다.

Top

위의 각 항목들 및 설정값들은 LSOF가 기본적으로 제공하는 것으로 변경을 원할 경우에는 machine.h 파일을 직접 수정하거나 Customize 스크립트를 직접 구동하여 변경할 수도 있다.

④ build & install

Configure 과정을 마치고 나면, 시스템에 인스톨 할 수 있다. 기본적인 install 과 정은 아래와 같다.

■ build LSOF system

[cert:root]:/user/kong/lsof_4.56> make
(cd lib; make DEBUG="-O" CFGF="-Dsolaris=20600 -DHASPR_GWINDOWS -DHAS_VSOCK -DLSOF_VSTR=\"5.6\"")
gcc -Dsolaris=20600 -DHASPR_GWINDOWS -DHAS_VSOCK -DLSOF_VSTR="5.6" -O -c ckkv.c
.....
.....
gcc -o lsof -Dsolaris=20600 -DHASPR_GWINDOWS -DHAS_VSOCK -DLSOF_VSTR=\"5.6\" -O ddev.o dfile.o dmnt.o dnode.o dnode1.o dnode2.o dproc.o dsock.o dstore.o arg.o main.o misc.o node.o print.o proc.o store.o usage.o -L./lib -llsof -lkvm -lelf -lsocket -lnsl

Top

■ Install LSOF system

[cert:root]:/user/kong/lsof_4.56> make install
(cd lib; make DEBUG="-O" CFGF="-Dsolaris=20600 -DHASPR_GWINDOWS -DHAS_VSOCK -DLSOF_VSTR=\"5.6\"")
Constructing version.h
gcc -Dsolaris=20600 -DHASPR_GWINDOWS -DHAS_VSOCK -DLSOF_VSTR=\"5.6\" -O -c usage.c
gcc -o lsof -Dsolaris=20600 -DHASPR_GWINDOWS -DHAS_VSOCK -DLSOF_VSTR=\"5.6\" -O ddev.o dfile.o dmnt.o dnode.o dnode1.o dnode2.o dproc.o dsock.o dstore.o arg.o main.o misc.o node.o print.o proc.o store.o usage.o -L./lib -llsof -lkvm -lelf -lsocket -lnsl

여기까지 과정을 마치면 일반적인 설치는 모두 끝나고 lsof 실행파일이 생성된다.

※ 별도로 install ruleset 지정하고자 할 경우

가상메모리의 커널 image를 담고있는 파일인 /dev/kmem(또는 /dev/mem)를 read 할 수 있도록 LSOF는 setgid 로 설치되어야 하는데, 일반적으로 다음과 같은 ruleset 형태로 지정한다.

SunOS install rule actions :
install <options> -m 2755 -g kmem lsof <bin_dest>
install <options> -m 444 lsof.8 <man_dest>
Solaris install rule actions :

install -[cf] <bin_dest> <options> -m 2755 -g sys lsof
install -[cf] <man_dest> <options> -m 444 lsof.8

Top

5. LSOF 사용하기

■ LSOF 옵션

Top

■ 실행결과 보기

실행결과에 해당되는 각 column 들을 간단하게 살펴보면 다음 [표5] 와 같다.

Top

■ LSOF 주요 옵션 사용 예

* 특정 파일을 억세스하고 있는 프로세스 확인 : lsof <path/file-name>

[cert:root]:/> lsof /etc/passwd
COMMAND PID USER FD TYPE DEVICE SIZE/OFF INODE NAME
ns-httpd 244 root 9r VREG 32,0 3044 99217 /etc/passwd
....

* internet socket 확인 : lsof -i

Internet address 출력형식 : [protocol][@hostname|hostaddr][:service|port]

Top

- 특정 호스트(또는 ip)에 대한 접속 확인

[cert:root]:/> lsof -i@172.16.2.146
COMMAND PID USER FD TYPE DEVICE SIZE/OFF INODE NAME
in.telnet 10124 root 0u inet 0x61d4b788 0t71 TCP cert:telnet->172.16.2.146:1109 (ESTABLISHED)
in.telnet 10124 root 1u inet 0x61d4b788 0t71 TCP cert:telnet->172.16.2.146:1109 (ESTABLISHED)
in.telnet 10124 root 2u inet 0x61d4b788 0t71 TCP cert:telnet->172.16.2.146:1109 (ESTABLISHED)
.....

- 특정 포트로 접속한 리스트 확인

[cert:root]:/usr/sbin> lsof -i @certcc.or.kr:23
COMMAND PID USER FD TYPE DEVICE SIZE/OFF INODE NAME
in.telnet 104 root 2u inet 0x612df850 0t152 TCP cert:telnet->172.16.2.159:1176 (ESTABLISHED)
in.telnet 28462 root 0u inet 0x61aee578 0t71 TCP cert:telnet->172.16.2.146:4250 (ESTABLISHED)
.....

Top

* 특정 user가 오픈한 프로세스를 확인 : lsof -u <loginname> 혹은 lsof -u <UID>

[cert:root]:/> lsof -u kong
COMMAND PID USER FD TYPE DEVICE SIZE/OFF INODE NAME
csh 21309 kong cwd VDIR 32,4 1536 223602 /user/kong/lsof_4.56
csh 21309 kong txt VREG 32,6 158608 298136 /usr/bin/csh
.......

- 특정사용자 제외시 "^" 심볼을 사용하고, 여러명을 동시에 지정하려면 ","를 이용한다.

[cert:root]:/dev/pts> lsof -u ^root,kong,yjkim
COMMAND PID USER FD TYPE DEVICE SIZE/OFF INODE NAME
csh 8992 yjkim cwd VDIR 32,0 1024 2 /
csh 8992 yjkim txt VREG 32,6 158608 298136 /usr/bin/csh
csh 8992 yjkim txt VREG 32,6 70996 136979 /usr/lib/locale/ko/ko.so.1
csh 8992 yjkim txt VREG 32,6 1024888 6749 /usr/lib/libc.so.1
.....
csh 21309 kong cwd VDIR 32,4 1536 223602 /user/kong/lsof_4.56
csh 21309 kong txt VREG 32,6 158608 298136 /usr/bin/csh
....

Top

* 특정 프로세스가 오픈한 파일 리스트 확인 : lsof -p <PID>

- PID 112를 가진 프로세스가 사용하는 파일들 확인

[cert:root]:/usr/sbin> lsof -p 143
COMMAND PID USER FD TYPE DEVICE SIZE/OFF INODE NAME
inetd 143 root cwd VDIR 32,0 1024 2 /
inetd 143 root txt VREG 32,6 33492 310933 /usr/sbin/inetd
inetd 143 root txt VREG 32,6 10696 6352 /usr (/dev/dsk/c0t0d0s6)
....
....
inetd 143 root 4u inet 0x603cab38 0t0 TCP *:ftp (LISTEN)
inetd 143 root 5u inet 0x610b13c0 0t0 TCP *:telnet (LISTEN)
inetd 143 root 6u inet 0x610b1240 0t0 TCP *:pop3 (LISTEN)
......

Top

* ps 명령이 변조된 시스템에서는 의심스러운 포트 확인하기 예

[root@linux /root]# netstat -a
Active Internet connections (including servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 *:auth *:* LISTEN
tcp 0 0 *:ftp *:* LISTEN
tcp 0 0 *:telnet *:* LISTEN
tcp 0 0 *:login *:* LISTEN
tcp 0 0 *:2626 *:* LISTEN
.......
[root@linux /dev]# fuser -n tcp 2626
2626/tcp: 607
[root@linux /dev]# lsof -p 607
PID TTY STAT TIME COMMAND
607 ? S 0:00 /usr/sbin/mingetty

※ 참고자료

1. lsof 4.56 README file and man page

2. Installing, configuring and using lsof 4.50 to list open files on systems running Solaris 2.x
http://www.cert.org/security-improvement/implementations/i042.05.html