Red Hat Bugzilla – Bug 707427
netstat cannot show program name correctly with "netstat -antuvp" command
Last modified: 2012-02-21 00:41:05 EST
Description of problem: Netstat reads the program name from the /proc/pid#/cmdline by reading the strings after the line slash "/". But sometimes this does not work. e.g. in my case, I used ssh to connect the linux machine. The cmdline for ssh connection process is "sshd: root@pts/4". Then use the "netstat -antuvp" command, it will get this result- sshd: root@pts/4[root@cts-srv 15238]# netstat -antuvp |grep 15238 tcp 0 0 ::ffff:135.252.141.92:22 ::ffff:135.1.51.1:1019 ESTABLISHED 15238/4 "4" should be "sshd". Version-Release number of selected component (if applicable): How reproducible: See above description. Steps to Reproduce: 1. 2. 3. Actual results: Expected results: Additional info:
Created attachment 500855 [details] This patch fixes the problem for me.
> ./netstat -antuvp |grep ssh tcp 0 0 10.213.195.0:22000 0.0.0.0:* LISTEN 12512/sshd tcp 0 0 10.213.64.16:22000 0.0.0.0:* LISTEN 6069/sshd tcp 0 0 10.213.0.16:22000 0.0.0.0:* LISTEN 6069/sshd tcp 0 0 135.1.48.201:22 0.0.0.0:* LISTEN 12438/sshd tcp 0 0 10.213.64.16:22 0.0.0.0:* LISTEN 6035/sshd tcp 0 0 10.213.0.16:22 0.0.0.0:* LISTEN 6035/sshd tcp 0 0 10.245.13.1:22 0.0.0.0:* LISTEN 5992/sshd tcp 0 0 10.213.131.0:32920 10.213.131.0:389 ESTABLISHED3882/sshd: root@pts tcp 0 0 10.213.0.16:22 10.254.51.1:999 ESTABLISHED3882/sshd: root@pts From the above, there is still problems - 1) in the last 2 lines, there is no space in the last 2 columns. in our application we need spaces to get the pid#/progname. 2) can it show "sshd" only, instead of "sshd: root@pts"? I am thinking if netstat can read the link /proc/pid#/exe (in this case /proc/3882/exe -> /opt/LU3P/sbin/sshd) to read the program name.
Is there any update for this issue?
Created attachment 503245 [details] Remove the part starting with colon (In reply to comment #2) > tcp 0 0 10.213.0.16:22 10.254.51.1:999 > ESTABLISHED3882/sshd: root@pts > > From the above, there is still problems - > 1) in the last 2 lines, there is no space in the last 2 columns. > in our application we need spaces to get the pid#/progname. I was testing this in several ways and haven't been able to reproduce what you are seeing, i.e. there's always space between the ESTABLISHED and PID in my case. > 2) can it show "sshd" only, instead of "sshd: root@pts"? > I am thinking if netstat can read the link /proc/pid#/exe > (in this case /proc/3882/exe -> /opt/LU3P/sbin/sshd) > to read the program name. See my improved patch.
Created attachment 503358 [details] netstat output example in which there is no space btw the last 2 columns Please refer to the attachment example. The first one is the result I run the private netstat which includes your new patch. This new patch fixed the problem in last column. The second part is what I run from the official netstat in our Linux distribution.
Ok, I think I know what's going on here. You are probably applying the patch either on the original source code of net-tools or you don't have all the patches we have. Can you try to rebuild and install this source rpm ? http://jpopelka.fedorapeople.org/net-tools-1.60-81.el5.1.src.rpm 1) install rpmdevtools. You will probably find it in EPEL (http://fedoraproject.org/wiki/EPEL). 2) rpmdev-setuptree 3) rpmbuild --rebuild net-tools-1.60-81.el5.1.src.rpm 4) install rpms from ~/rpmbuild/RPMS
Created attachment 503624 [details] failure message when run 'rpmbuild' Could you just attach the latest source of net-tools-1.6 package. Then I can run a build?
Ok, then download http://jpopelka.fedorapeople.org/net-tools-1.60.tar.bz2 unpack it and run make inside the unpacked directory.
The fix now works. Could you let me know when/how this fix will be delivered? In our product, we don't build netstat. Instead we just install the net-tools*.rpm package. Thanks, Jerry
(In reply to comment #9) > The fix now works. Could you let me know when/how this fix will be delivered? When Red Hat Product Management evaluates this for inclusion in the next release of Red Hat Enterprise Linux. You can ask your support representative to escalate this request.
Technical note added. If any revisions are required, please edit the "Technical Notes" field accordingly. All revisions will be proofread by the Engineering Content Services team. New Contents: Prior to this update, the "netstat -p" command incorrectly displayed a number instead of the program name in the PID/Program name column. With this update, the code is modified and the command now correctly displays the program name.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2012-0188.html