[Info-vax] TCPIP tying up system

[Jan-Erik Soderholm]

On 2010-11-28 17:22, JF Mezei wrote:
> John Wallace wrote:
>
>> While we await the crash dump info, would it be appropriate, for the
>> benefit of other readers who may one day find themselves in a similar
>> situation where a crash dump provides answers rather than the present
>> guesswork and speculation,
>
>
> Excuse me ?
>
> Why a crash dump because you CPU reaches 100% and you can't issue
> commands because thge TCPIP processes that consume CPU have higher
> priority than normal interactivce processes ?
>
> There is no "crash" here, just piss poor implementation of TCPIP
> Services which grants itself too high a priority and will bog down a system.
>
> Once the attack is ended, the system returns to normal. Teling people to
>   get a crash dump on VMS like that is like asking Windows users to ALT
> CTRL DEL their system and re-install Windows because their ADSL modem is
> not performing well.

Yep, to me it "just" looked like a over-loaded system with a
number of out-swapped processes. No crash, apart from the
user caused (if I remember correctly). The SHO SYS output
quite clearly showed what was going on and what services
was causing the over-load situation, not ?

I'd start with lowering a max-number of allowed processes for
each service type (SSH, SMTP, whatever it was) to at least try
to not get the system into a to heavy swapping state. Then
try to find out what causes all this processes to be created
in the first place.

I do not remember if this was an up-to-date system as far
as patches and TCPIP versions is concerned, but I do remember
that it was a 7.something system, which isn't that up-to-date
as such. I do not know if it's is rellevant...

Taking a crash-dump and trying to understand that isn't
something I would ask from, well, not even *me*... :-)
At least not until I had hit the wall using the normal
day-to-day tools.

Jan-Erik.