"Program(/opt/VRTSvcs/bin/Mount/clean) was abnormally terminated with the exit code(0x9)" appears when the Mount resource is stuck in w_online state
Article ID: 100042573
Updated On:
Description
Error Message
Program(/opt/VRTSvcs/bin/Mount/clean) was abnormally terminated with the exit code(0x9).
Cause
System audit rules create an issue with the Mount agent if the audit rules are using an execve() system call with a large number of arguments passed to it. execve() is system call and is also used by VCS (Veritas Cluster Server) agents to call VCS agent entry point scripts. When we set the audit rule, it truncates the arguments and kills the script executed by execve(). If the number of arguments is large, you may encounter the issue with the Mount agent.
Resolution
Reduce the number of arguments passed to execve() or delete the audit rules that are using the command.
# auditctl -l
-a never,exit -S all -F dir=/var/log/audit -F key=TaniumRecorder
-w // -p wa -k TaniumRecorder
-a always,exit -F arch=b64 -S accept,bind,clone,execve,init_module,delete_module,finit_module,execveat -F key=TaniumRecorder
-a always,exit -F arch=b64 -S connect -F a2!=0x6E -F key=TaniumRecorder
-a always,exit -F arch=b32 -S exit,execve,clone,init_module,delete_module,finit_module,execveat -F key=TaniumRecorder
-a always,exit -F arch=b32 -S socketcall -F a0=0x2 -F key=TaniumRecorder
-a always,exit -F arch=b32 -S socketcall -F a0=0x5 -F key=TaniumRecorder
-a always,exit -F arch=b32 -S socketcall -F a0=0x12 -F key=TaniumRecorder
-a always,exit -F arch=b32 -S socketcall -F a0=0x3 -F key=TaniumRecorder
#auditctl -D
After deleting the audit rules from the cluster, you should be able to bring the Mount resource online on the cluster nodes
Issue/Introduction
