RE: What would cause hundreds of interactive users all start dropping, from multiple LPARs

Ahhh, finally 20 years after I left that egg opened !!




-----Original Message-----
From: Steinmetz, Paul [mailto:PSteinmetz@xxxxxxxxxx]
Sent: Friday, February 17, 2017 3:56 PM
To: 'Midrange Systems Technical Discussion' <midrange-l@xxxxxxxxxxxx>
Subject: RE: What would cause hundreds of interactive users all start dropping, from multiple LPARs

Actually it was an email spoofed from Hillary to look like it came from Trump

-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of DrFranken
Sent: Friday, February 17, 2017 3:39 PM
To: Midrange Systems Technical Discussion
Subject: Re: What would cause hundreds of interactive users all start dropping, from multiple LPARs

The Russians :-)

- Larry "DrFranken" Bolhuis

www.Frankeni.com
www.iDevCloud.com - Personal Development IBM i timeshare service.
www.iInTheCloud.com - Commercial IBM i Cloud Hosting.

On 2/17/2017 3:16 PM, Steinmetz, Paul wrote:

We found what happened but we did not find the source.
The NIC card on the PCs were sent a command to shutoff.

From the PC Windows System log.

Event ID 7036 - The TCP/IP NetBIOS Helper service was successfully sent a stop control.

Paul

-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of
Steinmetz, Paul
Sent: Wednesday, February 08, 2017 4:18 PM
To: 'Midrange Systems Technical Discussion'
Subject: RE: What would cause hundreds of interactive users all start
dropping, from multiple LPARs

Interesting find

PC obtained a new lease shortly before the CPF5140 was posted.
I'm not a network person, but could there have been an issue with leases expiring and being renewed?

CPF5140 Diagnostic 70 02/07/17 13:30:55.498675

Paul



-----Original Message-----
From: Steinmetz, Paul
Sent: Tuesday, February 07, 2017 4:43 PM
To: 'Midrange Systems Technical Discussion'
Subject: RE: What would cause hundreds of interactive users all start
dropping, from multiple LPARs

Started at 12:45.
Multiple iSeries LPARs - Pencor05, Pencor06, Pencor07, Penco08 My connections to 4 different LPARS, 3 different NICS, all at the same time.
Not all users at once.
About 20 every minute.
Each user only once (so far)
No entries in any logs. PAL, LIC, QHST

Problem appears to have stopped around 14:25.
iSeries performance graph showed high number of TCP connection resets during the 12:45 thru 14:25 problem window.

from 3 LPARS, 3 different NICs
Appears that only 5250 Client Access and GUI was impacted (PC traffic). from 3 LPARS, 3 different NICs All other applications (hundreds) connecting to both internal and external remotes were fine.

Possibly an issue with QTVDEVICE jobs ???

CPF5140 Diagnostic 70 02/07/17 12:45:56.790988 QWSERROR QSYS 0630 QWSGET QSYS 067C
Message . . . . : Session stopped by a request from device QPADEV004S.
CPF5503 Diagnostic 30 02/07/17 12:45:56.791059 QWSERROR QSYS 0652 QWSGET QSYS 067C
Message . . . . : Input or Output request failed. See message CPF5140.

Paul

-----Original Message-----
From: Steinmetz, Paul
Sent: Tuesday, February 07, 2017 2:06 PM
To: 'Midrange Systems Technical Discussion'
Subject: RE: What would cause hundreds of interactive users all start
dropping, from multiple LPARs

Problem still occurring.
Started at 12:53.
Not all users at once.
About 20 every minute.



-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of
Ken Meade
Sent: Tuesday, February 07, 2017 1:45 PM
To: Midrange Systems Technical Discussion
Subject: RE: What would cause hundreds of interactive users all start
dropping, from multiple LPARs

We saw something similar a few years ago. Turned out it was a glitch in an addressing table in one of our switches.

-----Original Message-----
From: James H. H. Lampert [mailto:jamesl@xxxxxxxxxxxxxxxxx]
Sent: Tuesday, February 07, 2017 1:40 PM
To: Midrange Systems Technical Discussion
Subject: Re: What would cause hundreds of interactive users all start
dropping, from multiple LPARs

On 2/7/17, 10:34 AM, Steinmetz, Paul wrote:

What would cause hundreds of interactive users all start dropping,
from

multiple LPARS

Massive communications glitch?

--
JHHL


--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a moment to review the archives at http://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: http://amzn.to/2dEadiD
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a moment to review the archives at http://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: http://amzn.to/2dEadiD

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a moment to review the archives at http://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related questions.

Help support midrange.com by shopping at amazon.com with our affiliate link: http://amzn.to/2dEadiD