Managing SMF Services

This section includes information on managing SMF services.

Managing SMF Services (Task Map)

The following task map describes the procedures that are needed to manage SMF services.

Using RBAC Rights Profiles With SMF

You can use RBAC rights profiles to allow users to manage some of the SMF services, without having to give the user root access. The rights profiles define what commands the user can run. For SMF, the following profiles have been created:

• Service Management: User can add, delete or modify services.

• Service Operator: User can request state changes of any service instance, such as restart and refresh.

For specific information about the authorizations, see the smf_security(5) man page. For instructions to assign a rights profile, see How to Change the Security Attributes of a User in Oracle Solaris 11.1 Administration: Security Services.

How to Create an SMF Service

Administrators often write scripts to do work when the system is booting. This procedure shows how to use the advantages of SMF to support a script.

Before You Begin

Determine which service model the script needs. If the script does some work and then exits without starting any long running processes, it is most likely a transient service. If the script starts up a long running daemon and then exits, then it is a contract service. See the Duration section in the svc.startd(1M) man page for more information about service models.

1. Become an administrator or assume a role that includes the Service Management rights profile.

   For more information, see How to Use Your Assigned Administrative Rights in Oracle Solaris 11.1 Administration: Security Services.

2. Copy the start method script to /lib/svc/method/ex_svc.
3. Create a temporary manifest.

   In this example, the service name is site/ex_svc and it is a transient service so it doesn't need a stop method.

   # svcbundle -o /tmp/ex_svc.xml -s service-name=site/ex_svc \
         -s start-method=/lib/svc/method/ex_svc -s model=transient

4. Make any additional changes to the manifest.

   Verify that the contents of manifest in /tmp/ex_svc.xml is what you need.

5. Copy the manifest to the correct directory.

   # cp /tmp/ex_svc.xml /lib/svc/manifest/site/ex_svc.xml

6. Import the manifest and start the service.

   # svcadm restart svc:/system/manifest-import

Example 2-12 Automatically Installing a Generated Manifest

To automatically install the manifest in /lib/svc/manifest/site, use the -i option with the svcbundle command as show below. This command can be run in place of the command in step 3, and you will not need to do any other steps.

# svcbundle -i -s service-name=site/ex_svc \
        -s start-method=/lib/svc/method/ex_svc -s model=transient

How to Disable a Service Instance

Use the following procedure to disable a service. The service status change is recorded in the service configuration repository. Once the service is disabled, the disabled state will persist across reboots. The only way to get the service running again is to enable it.

1. Become an administrator or assume a role that includes the Service Management rights profile.

   For more information, see How to Use Your Assigned Administrative Rights in Oracle Solaris 11.1 Administration: Security Services.

2. Check the dependents of the service you want to disable.

   If this service has dependents that you need, then you cannot disable this service.

   # svcs -D FMRI

3. Disable the service.

   # svcadm disable FMRI

How to Enable a Service Instance

Use the following procedure to enable a service. The service status change is recorded in the service configuration repository. After the service is enabled, the enabled state will persist across system reboots, however the service will start only if all dependencies are met.

1. Become an administrator or assume a role that includes the Service Management rights profile.

   For more information, see How to Use Your Assigned Administrative Rights in Oracle Solaris 11.1 Administration: Security Services.

2. Enable a service.

   # svcadm enable FMRI

3. Verify that the service has been enabled.

   # svcs -x FMRI

4. Enable service dependencies.

   If required dependencies are disabled, enable them with the following command:

   # svcadm enable -r FMRI

Example 2-13 Enabling a Service in Single-user Mode

The following command enables rpcbind. The -t option starts the service in temporary mode which does not change the service repository, so this change will not persist across a reboot. The -r option recursively starts all the dependencies of the named service.

# svcadm enable -rt rpc/bind

How to Restart a Service

If a service is currently running but needs to be restarted due to a configuration change or some other reason, the service can be restarted without you having to type separate commands to stop and start the service. The only reason to specifically disable and then enable a service is if changes need to be made before the service is enabled, and after the service is disabled.

1. Become an administrator or assume a role that includes the Service Management rights profile.

   For more information, see How to Use Your Assigned Administrative Rights in Oracle Solaris 11.1 Administration: Security Services.

2. Restart a service.

   # svcadm restart FMRI

How to Restore a Service That Is in the Maintenance State

1. Become an administrator or assume a role that includes the Service Management rights profile.

   For more information, see How to Use Your Assigned Administrative Rights in Oracle Solaris 11.1 Administration: Security Services.

2. Determine why the service is in maintenance.

   # svcs -x FMRI

   Consult the log file or man page mentioned to determine what the error is.

3. Determine if any process that are dependent to the service have not stopped.

   Normally, when a service instance is in a maintenance state, all processes associated with that instance have stopped. However, you should make sure before you proceed. The following command lists the contract ID for the selected FMRI.

   # svcs -o CTID FMRI

4. (Optional) Kill any remaining processes.

   Repeat this step for all processes that are displayed by the svcs command.

   # pkill -9 -c CTID

5. Restore the service.

   # svcadm clear FMRI

How to Create an SMF Profile

A profile is an XML file which lists SMF services and whether each should be enabled or disabled. Profiles are used to enable or disable many services at once. Profiles are also used to set property values, add property values, and even create a service and instances of a service. Not all services need to be listed in a profile. Each profile only needs to include those services that need to be enabled or disabled to make the profile useful.

The svc:/system/rmtmpfiles service is responsible for cleaning up the /tmp directory on boot. By default the rmtmpfiles service does not cleanup /var/tmp. If you wish to clean up /var/tmp during the boot process, you can change the behavior by setting the options/clean_vartmp property to true. If you want to do this on multiple systems, the easiest thing to do is to create a profile and place it in /etc/svc/profile/site on those systems.

1. Become an administrator or assume a role that includes the Service Management rights profile.

   For more information, see How to Use Your Assigned Administrative Rights in Oracle Solaris 11.1 Administration: Security Services.

2. Create the profile.

   This command creates a new profile in /tmp/rmtmpfiles.xml, which can then be copied to /etc/svc/profiles/site as needed.

   # svcbundle -o /tmp/rmtmpfiles.xml -s service-name=system/rmtmpfiles \
           -s bundle-type=profile -s service-property=options:clean_vartmp:boolean:true

3. Copy the profile to the correct directory.

   # cp /tmp/rmtmpfiles.xml /etc/svc/profile/site/rmtmpfiles.xml

4. Restart the manifest-import service to apply the profile to the system.

   # svcadm restart svc:/system/manifest-import

Example 2-14 Automatically Installing an SMF Profile While Creating the Profile

The -i option is used to install the generated profile. The command will write the profile to /etc/svc/profile/site/rmtmpfiles.xml. Also, the command will restart the manifest-import service to apply the profile.

# svcbundle -i -s service-name=system/rmtmpfiles \
        -s bundle-type=profile -s service-property=options:clean_vartmp:boolean:true

How to Manually Create an SMF Profile

A profile is an XML file which lists SMF services and whether each should be enabled or disabled. Profiles are used to enable or disable many services at once. Profiles are also used to set property values, add property values, and even create a service and instances of a service. Not all services need to be listed in a profile. Each profile only needs to include those services that need to be enabled or disabled to make the profile useful.

1. Become an administrator or assume a role that includes the Service Management rights profile.

   For more information, see How to Use Your Assigned Administrative Rights in Oracle Solaris 11.1 Administration: Security Services.

2. Create a profile.

   In this example, the svccfg command is used to create a profile that represents the local customizations on the current system. Alternatively, you could make a copy of an existing profile to edit.

   # svccfg extract> profile.xml

   If you have large numbers of identical systems, or if you want to archive the system configuration for later restoration, you might want to use this procedure to create a unique version of a SMF profile.

3. Edit the profile.xml file to make any required changes.
   1. Change the name of the profile in the service_bundle declaration.

      In this example the name is changed to profile.

      # cat profile.xml
        ...
      <service_bundle type=`profile` name=`profile`
          xmIns::xi='http://www.w3.org/2003/XInclude'
        ...

   2. Remove any services that should not be managed by this profile.

      For each service, remove the three lines that describe the service. Each service description starts with <service and ends with </service. This example shows the lines for the LDAP client service.

      # cat profile.xml
       ...
       <service name='network/ldap/client' version='1' type='service'>
               <instance  name='default' enabled='true'/>
       </service>

   3. Add any services that should be managed by this profile.

      Each service needs to be defined using the three line syntax shown above.

   4. If necessary, change the enabled flag for selected services.

      In this example, the sendmail service is disabled.

      # cat profile.xml
        ...
        <service  name='network/smtp' version='1' type='service'>
          <instance  name='sendmail' enabled='false'/>
        </service>
        ...

4. When necessary, apply the new profile.

   See How to Apply an SMF Profile for instructions.

How to Apply an SMF Profile

1. Become an administrator or assume a role that includes the Service Management rights profile.

   For more information, see How to Use Your Assigned Administrative Rights in Oracle Solaris 11.1 Administration: Security Services.

2. Apply a profile.

   In this example, the profile.xml profile is applied.

   # svccfg apply profile.xml