[Info-vax] Some part of VMS attempting to execute SYSUAF.DAT

[GerMarsh]

On Tuesday, January 19, 2016 at 9:08:36 AM UTC, GerMarsh wrote:
> On Monday, January 18, 2016 at 11:29:55 PM UTC, Jan-Erik Soderholm wrote:
> > Den 2016-01-18 kl. 18:11, skrev GerMarsh:
> > > I have seen an intermittent problem when a program using Websphere MQ
> > > routines attempts to execute the UAF data file. Bit like this...
> > >
> > > Terminal name:            FTA98: Image name:
> > > DSA6:[OFFICEMAN.][DECSUPP.MQ_DEV]MQPUT.EXE;2 Object class name:
> > > FILE Object owner:             [SYSTEM] Object protection:
> > > SYSTEM:RWED, OWNER:RWED, GROUP:, WORLD: File name:
> > > _DSA300:[VMS$COMMON.SYSEXE]SYSUAF.DAT;1 File ID:
> > > (20,1,0) Access requested:         EXECUTE
> > >
> > > I am pretty sure that I have seen such alarms with some VMS programs
> > > too.
> > >
> > > I apologise profusely if I have missed some newsgroup article or even HP
> > > patch list which covers this but damned if I can find it!
> > >
> > > Anyone any idea why any program routine would try to execute a data
> > > file?
> > >
> > 
> > What version of MQ? The full server kit or the client one?
> > Is MQPUT an in house application?
> 
> 
> It is the full server version:
> Name:        WebSphere MQ
> Version:     6.0.2.12
> CMVC level:  p600-212-121204
> BuildType:   IKAP - (Production)
> 
> I modified the IBM example program to only connect to the qmgr then disconnect. That produced about 6 audit entries!

On attempting an MQ trace, I have discovered that starting and ending the trace also produces an execute attempt on the UAF. I shall pass that on to IBM as those programs are nothing to do with me.