All Apps and Add-ons

Splunk_TA_nix on HP-UX: ps: illegal option -- o

mikelanghorst
Motivator

Recently started installing the *Nix TA on our HP-UX hosts, and noticed that uptime.sh fails, even though the if statement within is looking for HP-UX.

From uptime.sh:
# This should work for any POSIX-compliant system, but in case it doesn't
# we have left the individual OS names here to be broken out later on.
if [ "x$KERNEL" = "xLinux" -o "x$KERNEL" = "xSunOS" -o "x$KERNEL" = "xAIX" -o "x$KERNEL" = "xHP-UX" -o "x$KERNEL" = "xDarwin" -o "x$KERNEL" = "xFreeBSD" ] ; then
assertHaveCommand date
assertHaveCommand ps
CMD='eval date; LC_ALL=POSIX ps -o etime= -p 1'
....

When I attempt to run:
root@blah#./uptime.sh
ps: illegal option -- o
usage: ps [-edaxzflP] [-u ulist] [-g glist] [-p plist] [-t tlist] [-R prmgroup] [-Z psetidlist]
Fri Nov 1 11:42:41 PDT 2013 SystemUpTime=

1 Solution

mikelanghorst
Motivator

Finally circled back to this and found the issue. HP-UX needs "UNIX95=1" set to use the -o switch for ps. It's using ps in this script, to get the SystemUpTime field.

I've just updated my copy of the script with the following snippet.
- #Setting UNIX95 for HP-UX
- if [ "x$KERNEL" = "xHP-UX" ]; then
- export UNIX95=1
- fi

View solution in original post

mikelanghorst
Motivator

Finally circled back to this and found the issue. HP-UX needs "UNIX95=1" set to use the -o switch for ps. It's using ps in this script, to get the SystemUpTime field.

I've just updated my copy of the script with the following snippet.
- #Setting UNIX95 for HP-UX
- if [ "x$KERNEL" = "xHP-UX" ]; then
- export UNIX95=1
- fi

mikelanghorst
Motivator

it was already set in the ps.sh script, which is how I stumbled across it. I tried to copy/paste the CMD from ps.sh and got that same error.

0 Karma

araitz
Splunk Employee
Splunk Employee

Thanks Mike! The UNIX95 variable is certainly one of the most interesting things I've discovered through authoring some of this add-on: http://jreypo.wordpress.com/2010/02/01/unix95-and-ps-command/

0 Karma

araitz
Splunk Employee
Splunk Employee

Thanks Mike, I filed NIX-596 for this issue.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...