Routing

Hi 

We found some log to execute unknown command by root. But I can't execute by root manually.

Could anyone tell me how to execute ? or is it Juniper's process to execute automatically ?

Jan  5 11:43:49.932  xxxx_RE0 mgd[72690]: UI_CMDLINE_READ_LINE: User 'root', command 'set alarm yellow alarm-id 0small-msg '

Jan  7 13:16:17.605  xxxx_RE0 mgd[84333]: UI_CMDLINE_READ_LINE: User 'root', command 'clear alarm 0 '

Thanks

Cloud

And I don't saw any source IP, just loing into with root.

Is this by console  ? Like below 

Jan 8 18:14:56.534 xxxxx_RE1 mgd[61867]: UI_CMDLINE_READ_LINE: User 'root', command 'show system uptime no-forwarding '
Jan 8 18:14:56.826 xxxxx_RE1 mgd[61867]: UI_CMDLINE_READ_LINE: User 'root', command 'show version detail no-forwarding '
Jan 8 18:14:58.242 xxxxx_RE1 mgd[61867]: UI_CMDLINE_READ_LINE: User 'root', command 'show system core-dumps no-forwarding '
Jan 8 18:14:58.256 xxxxx_RE1 mgd[61867]: UI_CMDLINE_READ_LINE: User 'root', command 'show chassis alarms no-forwarding '

........

---

@Cloud wrote:

And I don't saw any source IP, just loing into with root.

Is this by console  ? Like below 

 

Jan 8 18:14:56.534 xxxxx_RE1 mgd[61867]: UI_CMDLINE_READ_LINE: User 'root', command 'show system uptime no-forwarding '
Jan 8 18:14:56.826 xxxxx_RE1 mgd[61867]: UI_CMDLINE_READ_LINE: User 'root', command 'show version detail no-forwarding '
Jan 8 18:14:58.242 xxxxx_RE1 mgd[61867]: UI_CMDLINE_READ_LINE: User 'root', command 'show system core-dumps no-forwarding '
Jan 8 18:14:58.256 xxxxx_RE1 mgd[61867]: UI_CMDLINE_READ_LINE: User 'root', command 'show chassis alarms no-forwarding '

........

---

You generally see them when you collect RSI

Did anyone ran "request support information | no-more"

If you do, you would see them as follows (either in cli-commands or interavtive-commands)

Jan  9 12:09:32.440  re0 mgd[52695]: UI_CMDLINE_READ_LINE: User 'root', command 'show system uptime no-forwarding '
Jan  9 12:09:32.464  re0 mgd[52695]: UI_CMDLINE_READ_LINE: User 'root', command 'show version detail no-forwarding '
Jan  9 12:09:33.301  re0 mgd[52695]: UI_CMDLINE_READ_LINE: User 'root', command 'show system core-dumps no-forwarding '
Jan  9 12:09:33.308  re0 mgd[52695]: UI_CMDLINE_READ_LINE: User 'root', command 'show chassis alarms no-forwarding '
Jan  9 12:09:33.309  re0 mgd[52695]: UI_CMDLINE_READ_LINE: User 'root', command 'show chassis hardware detail no-forwarding '
Jan  9 12:09:34.227  re0 mgd[52695]: UI_CMDLINE_READ_LINE: User 'root', command 'show system processes extensive no-forwarding '
Jan  9 12:09:34.239  re0 mgd[52695]: UI_CMDLINE_READ_LINE: User 'root', command 'show pfe statistics error '
Jan  9 12:09:34.589  re0 mgd[52695]: UI_CMDLINE_READ_LINE: User 'root', command 'show pfe statistics traffic '
Jan  9 12:09:34.593  re0 mgd[52695]: UI_CMDLINE_READ_LINE: User 'root', command 'show chassis routing-engine no-forwarding '
Jan  9 12:09:34.594  re0 mgd[52695]: UI_CMDLINE_READ_LINE: User 'root', command 'show chassis environment no-forwarding '

This log message of alram is an expected behavior when mgd encounters a process issue i.e it spawns a root login to generate this log message. This set alarm message in logs by root can encountered in various conditions. You can run this command if you wish to manually from CLI. The "alarm" keyword/command is hidden:

{master}
lab@jtac-mx> set alarm ?
Possible completions:
  alarm-id             Alarm identification number (1..2147483647)
  alarm-life           Alarm life in seconds (1..2147483647)
  long-msg             Message to write to system log
  red                  Highest level alarm
  short-msg            Message to display on front panel
  yellow               Minor alarm

Or the clearm alarm:

lab@jtac-mx> clear alarm ?  
Possible completions:
  <id-number>          Alarm identification number
{master}

I would suggest NOT to modify "set alarm" knob unless you have specfic use case.

Hi Karand 

As you said, that means mgd encounters someting and then triggered to execute these two commands by root.

Thus, we should see this actions as normal. Am I correct ?

Thanks

Cloud

Hi Cloud,

Yes, that's correct!

Hi Karand

Is it possible to trigger executing " request support information" by juniper process ?

As below message, root executed it after I commited.

Jan  8 18:14:50.217  xxxxxx_RE1 mgd[23203]: UI_CMDLINE_READ_LINE: User 'cloud', command 'commit '

Jan  8 18:14:50.218  xxxxxx_RE1 mgd[23203]: UI_COMMIT: User 'cloud' requested 'commit' operation (comment: none)

Jan  8 18:14:50.327  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: Obtaining lock for commit

Jan  8 18:14:50.328  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: updating commit revision

Jan  8 18:14:50.533  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: obtaining db lock on  re0

Jan  8 18:14:50.835  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: re-revision: re1-1546942383-6199, other-re-revision: re1-1546942383-6199(0)

Jan  8 18:14:50.835  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: UI extensions feature is not configured

Jan  8 18:14:50.835  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: Started running translation script

Jan  8 18:14:50.835  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: Finished running translation script

Jan  8 18:14:50.835  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: start loading commit script changes

Jan  8 18:14:50.836  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: no commit script changes

Jan  8 18:14:50.836  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: no transient commit script changes

Jan  8 18:14:50.836  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: finished loading commit script changes

Jan  8 18:14:50.836  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: No translation output from the scripts

Jan  8 18:14:50.836  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: Preparing Fast-diff post translation load

Jan  8 18:14:50.856  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: copying juniper.db to juniper.data+

Jan  8 18:14:50.905  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: finished copying juniper.db to juniper.data+

Jan  8 18:14:50.906  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: exporting juniper.conf

Jan  8 18:14:51.152  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: expanding interface-ranges

Jan  8 18:14:51.152  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: finished expanding interface-ranges

Jan  8 18:14:51.152  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: expanding groups

Jan  8 18:14:51.176  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: finished expanding groups

Jan  8 18:14:51.177  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: setup foreign files

Jan  8 18:14:51.185  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: update license counters

Jan  8 18:14:51.187  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: finish license counters

Jan  8 18:14:51.187  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: propagating foreign files

Jan  8 18:14:51.189  xxxxxx_RE1 mgd[23203]: UI_CHILD_START: Starting child '/usr/sbin/mustd'

Jan  8 18:14:51.383  xxxxxx_RE1 mgd[23203]: UI_CHILD_STATUS: Cleanup child '/usr/sbin/mustd', PID 61820, status 0x700

Jan  8 18:14:51.384  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: cdg returns = 7(persist groups is not configured (needed for cdg))

Jan  8 18:14:51.536  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: complete foreign files

Jan  8 18:14:51.583  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: dropping unchanged foreign files

Jan  8 18:14:51.583  xxxxxx_RE1 mgd[23203]: UI_CHILD_START: Starting child '/usr/sbin/ffp'

Jan  8 18:14:51.828  xxxxxx_RE1 mgd[23203]: UI_CHILD_STATUS: Cleanup child '/usr/sbin/ffp', PID 61821, status 0

Jan  8 18:14:51.828  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: daemons checking new configuration

Jan  8 18:14:51.828  xxxxxx_RE1 mgd[23203]: UI_CHILD_START: Starting child '/usr/sbin/ffp'

Jan  8 18:14:52.156  xxxxxx_RE1 mgd[23203]: UI_CHILD_STATUS: Cleanup child '/usr/sbin/ffp', PID 61822, status 0

Jan  8 18:14:52.156  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: sending pull-configuration rpc to re0

Jan  8 18:14:52.156  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: filename /var/run/db/juniper.db-patch.sync, size 0

Jan  8 18:14:52.256  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: pull-configuration success. URL: /var/tmp/juniper.db-patch.sync

Jan  8 18:14:52.257  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: sending load-patch rpc to re0

Jan  8 18:14:52.358  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: remote load-configuration success on re0

Jan  8 18:14:52.358  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: sending file-delete rpc to re0

Jan  8 18:14:52.458  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: syncing commit db revision to  re0

Jan  8 18:14:52.458  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: asking re0 to commit

Jan  8 18:14:54.065  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: commit wrapup...

Jan  8 18:14:54.065  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: start ffp activate

Jan  8 18:14:54.065  xxxxxx_RE1 mgd[23203]: UI_CHILD_START: Starting child '/usr/sbin/ffp'

Jan  8 18:14:54.408  xxxxxx_RE1 mgd[23203]: UI_CHILD_STATUS: Cleanup child '/usr/sbin/ffp', PID 61830, status 0

Jan  8 18:14:54.408  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: activating '/var/etc/cosd.conf'

Jan  8 18:14:54.409  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: activating '/var/etc/pam.conf'

Jan  8 18:14:54.409  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: activating '/var/etc/pam_radius.conf'

Jan  8 18:14:54.409  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: activating '/var/etc/pam_tacplus.conf'

Jan  8 18:14:54.409  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: activating '/var/etc/issue'

Jan  8 18:14:54.410  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: activating '/var/etc/certs'

Jan  8 18:14:54.417  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: activating '/var/etc/motd'

Jan  8 18:14:54.418  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: activating '/var/etc/max-db-size-cfg'

Jan  8 18:14:54.418  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: activating '/var/etc/subs-mgmt-cfg'

Jan  8 18:14:54.419  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: activating '/var/etc/ephinst.conf'

Jan  8 18:14:54.419  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: executing foreign_commands

Jan  8 18:14:54.446  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: not executing ui_commit in rc.ui

Jan  8 18:14:54.469  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: finish ffp activate

Jan  8 18:14:54.470  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: copying configuration to juniper.save

Jan  8 18:14:54.539  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: db_check_constraint_ids_clear start

Jan  8 18:14:54.546  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: db_check_constraint_ids_clear done

Jan  8 18:14:54.572  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: db_groups_info_clear start

Jan  8 18:14:54.579  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: db_groups_info_clear done

Jan  8 18:14:54.579  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: activating '/var/run/db/juniper.data'

Jan  8 18:14:54.600  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: Rotate backup configs

Jan  8 18:14:54.911  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: signaling 'Simple Network Management Protocol process', pid 5330, signal 31, status 0 with notification errors enabled

Jan  8 18:14:54.911  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: ssync begins

Jan  8 18:14:54.921  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: ssync ends

Jan  8 18:14:54.922  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: ssync begins

Jan  8 18:14:55.023  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: ssync ends

Jan  8 18:14:55.024  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: notifying daemons of new configuration

Jan  8 18:14:55.026  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: ssync begins

Jan  8 18:14:55.053  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: ssync ends

Jan  8 18:14:55.153  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: commit complete

Jan  8 18:14:55.154  xxxxxx_RE1 mgd[23203]: UI_COMMIT_COMPLETED: commit complete

Jan  8 18:14:55.161  xxxxxx_RE1 mgd[23203]: UI_COMMIT_PROGRESS: Commit operation in progress: signaling 'Alarm control process', pid 5328, signal 30, status 0 with notification errors enabled

Jan  8 18:14:56.389  xxxxxx_RE1 mgd[61861]: UI_AUTH_EVENT: Authenticated user 'root' at permission level 'super-user'

Jan  8 18:14:56.390  xxxxxx_RE1 mgd[61861]: UI_LOGIN_EVENT: User 'root' login, class 'super-user' [61861], ssh-connection '', client-mode 'cli'

Jan  8 18:14:56.392  xxxxxx_RE1 mgd[61861]: UI_CMDLINE_READ_LINE: User 'root', command 'request support information '

The command was initiated from a different session ( mgd[61861]) . This may be due to the script enabled on your device or from external device (NMS?). Please check if any script is enabled or check logged in users for external session:

show configuration script

show configuration event-options

show system users

Hi Nellikka

Even I've changed root password, but still saw this event. And as I checked, it will be presented while "Core dumped" happended.

Is it possible to trigger RSI while any process ran "Core dumped" ?

==========================

Jan 8 18:14:55.888 xxxx_RE1 kernel: pid 45608 (srrd), uid 0: exited on signal 11 (core dumped)
Jan 8 18:14:56.223 xxxx_RE1 jlaunchd: sampling-route-record (PID 45608) terminated by signal number 11. Core dumped!
Jan 8 18:16:05.086 xxxx_RE1 dumpd: Core and context for srrd saved in /var/tmp/srrd.core-tarball.4.tgz

Jan  8 18:14:56.392  xxxxx_RE1 mgd[61861]: UI_CMDLINE_READ_LINE: User 'root', command 'request support information '

Jan 9 23:46:02.859 xxxx_RE1 kernel: pid 18485 (srrd), uid 0: exited on signal 11 (core dumped)
Jan 9 23:46:03.217 xxxx_RE1 jlaunchd: sampling-route-record (PID 18485) terminated by signal number 11. Core dumped!
Jan 9 23:47:05.834 xxxx_RE1 dumpd: Core and context for srrd saved in /var/tmp/srrd.core-tarball.4.tgz

Jan 9 23:46:02.859 HKG02_KATRINA_RE1 kernel: pid 18485 (srrd), uid 0: exited on signal 11 (core dumped)
Jan 9 23:46:03.217 HKG02_KATRINA_RE1 jlaunchd: sampling-route-record (PID 18485) terminated by signal number 11. Core dumped!
Jan 9 23:47:05.834 HKG02_KATRINA_RE1 dumpd: Core and context for srrd saved in /var/tmp/srrd.core-tarball.4.tgz

Please check if any script is enabled on your device. A script can take RSI automatically based on some events. By default system will not trigger RSI.

show configuration script | display inheritance

show configuration event-options | display inheritance

Hi Nellike 

As checked by your command, don't run any script on this router. So that's why I confuse.

Even have, the script will be interrupted after I changed password.

Thanks

Cloud

Script can work even if you change password. Please check for any group level configuration and for AIS script.

Hi Nellikka

As I figured out, our router got some scripts at this folder. But I am not sure what function it is.

Do you have any idea on this ?

:/var/db/scripts/op # ls -lh
total 0
lrwxr-xr-x 1 root wheel 67B Feb 14 2018 sdg-inservice.slax -> /packages/mnt/junos-runtime-mx/var/db/scripts/op/sdg-inservice.slax
lrwxr-xr-x 1 root wheel 61B Feb 14 2018 sdg-oos.slax -> /packages/mnt/junos-runtime-mx/var/db/scripts/op/sdg-oos.slax
lrwxr-xr-x 1 root wheel 67B Feb 14 2018 services-oids.slax -> /packages/mnt/junos-runtime-mx/var/db/scripts/op/services-oids.slax
lrwxr-xr-x 1 root wheel 64B Feb 14 2018 srd-status.slax -> /packages/mnt/junos-runtime-mx/var/db/scripts/op/srd-status.slax

If you think some script is causing rsi to run using root user, they generally use ssh to login and run script.

You can disable it by configuring "set system services ssh root-login deny". this will not allow "root" to login via ssh or in other words, it will allow root login via console and not ssh.

Hi Cloud,

This is expected by root. Here i've manually triggered a core dump by issuing "request system core-dump <process-name> command via user called labroot. Once the core dump file is dumped, the root will collect the RSI:

 run show log interactive-commands| match request
Jan 10 13:00:13  jtac-mx960 mgd[55911]: UI_CMDLINE_READ_LINE: User 'labroot', command 'request system core-dump smg-service '
Jan 10 13:00:20  jtac-mx960 mgd[56205]: UI_CMDLINE_READ_LINE: User 'root', command 'request support information brief '