Originally posted by: SystemAdmin

Every 14 seconds, some process on my NIM server tries to mount /export/home/ashish from my NFS server. I have no user by that username, and never have. I have no idea what process is doing this. Really quite annoying. Any idea how I might track down the offender?

NIM and the NFS server are running 7100-01-04.

Verbose automountd output:

t515 MOUNT REQUEST: Wed Aug 1 16:01:04 2012
t515 name=ashish[] map=auto_home opts=ignore path=/home direct=0
t515 autofs_prog: Request procedure 1
t515 autofs_prog: Request procedure 1
t515 autofs_prog: Request procedure 1
t515 MOUNT REQUEST: Wed Aug 1 16:01:18 2012
t515 name=ashish[] map=auto_home opts=ignore path=/home direct=0
t515 autofs_prog: Request procedure 1
t515 autofs_prog: Request procedure 1
t515 autofs_prog: Request procedure 1
t515 MOUNT REQUEST: Wed Aug 1 16:01:32 2012
t515 name=ashish[] map=auto_home opts=ignore path=/home direct=0
t515 autofs_prog: Request procedure 1
t515 autofs_prog: Request procedure 1
t515 autofs_prog: Request procedure 1

From syslog:

Aug 1 16:05:43 kgnnim01 daemon:err|error automountd5046444: mount of /export/home/ashish from kgnnfs01 failed
Aug 1 16:05:43 kgnnim01 daemon:err|error automountd5046444: mount of /home/ashish failed
#AIX-Forum

Originally posted by: orphy

If you see complaints from automountd, that's a probably good place to start looking.

http://pic.dhe.ibm.com/infocenter/aix/v7r1/index.jsp?topic=%2Fcom.ibm.aix.cmds%2Fdoc%2Faixcmds1%2Fautomount.htm
Orphy
#AIX-Forum

Originally posted by: SystemAdmin

Thanks Orphy. I've already done what troubleshooting I can. I can see no logical reason why my NIM server would be trying to mount /export/home/ashish from my NFS server. There never was a directory /export/home/ashish on my NFS server, and certainly there has never been a user account by that name either.

The automount maps on my NIM server are pretty simple, and identical to all my other NFS clients:

auto_master:

/net    -hosts -nosuid /home   auto_home

auto_home:

*       kgnnfs01:/export/home/&

#AIX-Forum

Originally posted by: orphy

When did it start happening? Did anyone add anything in cron recently on the NIM server? Did anyone kick off a script/while loop/etc and left it running in the background? See if you can identify the start date/time and cross check that with the process start date/time on the NIM server. Do you see anyone/anything trying to login as that user even though it doesn't exist? You can also try to do some tcpdump to see if you can identify what is going on but if this is taking too much of your time, you might want to consider opening a PMR with Support. They can probably help you narrow things down.
Orphy
#AIX-Forum

Originally posted by: jeffschaller42

I don't have a direct answer, but the problem has me curious! I found a reference to "procedure 1" being related to the NFS getattr function. Perhaps something is scanning /home or /export/home? The best suggestion I have is to turn process accounting on long enough to capture the 14-second window, then try to correlate timestamps. This page: Link: https://www.ibm.com/developerworks/aix/tutorials/au-aixaccounting/section3.html might be useful in that regard. Best of luck in hunting it down!
#AIX-Forum

Originally posted by: SystemAdmin

Thanks Jeff. I'll give that a shot and post results, if any!

• Mark

#AIX-Forum

Originally posted by: SystemAdmin

Found the answer to the riddle:

http://www-01.ibm.com/support/docview.wss?crawler=1&uid=isg1IV24354
#AIX-Forum

Originally posted by: SystemAdmin

And now that link no longer works.
#AIX-Forum