[prev in list] [next in list] [prev in thread] [next in thread]
List: dragonidsuser
Subject: Re: [Dragonidsuser] Alarmtool errors
From: Jeffrey.Stebelton () bisys ! com
Date: 2004-09-05 0:07:43
Message-ID: OF90979E7F.15C0C13E-ON85256F05.0083231C-85256F06.0000B3CD () fund ! bisys ! com
[Download RAW message or body]
Hank: We found our problem was caused by an errant HIDS that could not
establish a connection on 9111 for policy, but the Replication Agent was
sending event data (there was an established connect on 9112). Locked the
HIDS out and it all cleared up.
Jeff Stebelton
Manager, Network Security
BISYS Network Security Group
614-470-8249 direct
614-203-2563 cell
\
Hank Leininger \
<hlein@progressive-com To: \
dragonidsuser@enterasys.com \
p.com> cc: \
Sent by: Subject: Re: [Dragonidsuser] \
Alarmtool errors
dragonidsuser-admin@en \
terasys.com \
\
\
09/04/2004 05:09 PM \
Please respond to \
dragonidsuser \
\
\
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On Tue, 31 Aug 2004 Jeffrey.Stebelton@bisys.com wrote:
> Any seen these errors before. I have a continuing problem with Alarmtool
> dying with no resolution yet. Any ideas?
>
[snip]
> 08-31-2004 11:30:36 [LVL: 9] [alarmtool (14993)]: invalid db buffer: not
an
> event
> 08-31-2004 11:35:14 [LVL: 1] [alarmtool (14993)]: processed 10000 events
> 08-31-2004 11:41:14 [LVL: 9] [alarmtool (14993)]: invalid db buffer: not
an
> event
> 08-31-2004 11:46:33 [LVL: 9] [alarmtool (14993)]: caught fatal signal 11
> 08-31-2004 11:46:33 [LVL: 5] [alarmtool (14993)]: outstanding summary
> records dumped, alert #####-#####-alert
At least you are somewhat lucky in that Alarmtool prints *some* kind of
error messages when it dies :-P Although actually, the 5-minute gap
between the last 'invalid db buffer' and the sig-11 makes me wonder if
they are really connected--perhaps they are not directly related after
all.
For me it is a simple, recurring story of:
09-04-2004 16:20:51 [LVL: 1] [alarmtool (1522)]: processed 140000 events
09-04-2004 16:42:55 [LVL: 1] [alarmtool (1522)]: processed 150000 events
09-04-2004 16:44:22 [LVL: 9] [alarmtool (1522)]: caught fatal signal 11
09-04-2004 16:45:29 [LVL: 1] [alarmtool (45)]: alarmtool started
09-04-2004 16:45:29 [LVL: 9] [alarmtool (45)]: caught fatal signal 11
09-04-2004 16:45:32 [LVL: 1] [alarmtool (9242)]: alarmtool started
09-04-2004 16:45:32 [LVL: 9] [alarmtool (9242)]: caught fatal signal 11
09-04-2004 16:45:35 [LVL: 1] [alarmtool (11062)]: alarmtool started
09-04-2004 16:45:35 [LVL: 9] [alarmtool (11062)]: caught fatal signal 11
09-04-2004 16:45:38 [LVL: 1] [alarmtool (20409)]: alarmtool started
09-04-2004 16:45:38 [LVL: 9] [alarmtool (20409)]: caught fatal signal 11
09-04-2004 16:45:41 [LVL: 1] [alarmtool (22147)]: alarmtool started
09-04-2004 16:45:41 [LVL: 9] [alarmtool (22147)]: caught fatal signal 11
09-04-2004 16:45:44 [LVL: 1] [alarmtool (19515)]: alarmtool started
09-04-2004 16:45:44 [LVL: 9] [alarmtool (19515)]: caught fatal signal 11
09-04-2004 16:45:47 [LVL: 1] [alarmtool (7694)]: alarmtool started
09-04-2004 16:45:47 [LVL: 9] [alarmtool (7694)]: caught fatal signal 11
09-04-2004 16:45:50 [LVL: 1] [alarmtool (18303)]: alarmtool started
09-04-2004 16:45:50 [LVL: 9] [alarmtool (18303)]: caught fatal signal 11
09-04-2004 16:45:53 [LVL: 1] [alarmtool (19921)]: alarmtool started
09-04-2004 16:45:53 [LVL: 9] [alarmtool (19921)]: caught fatal signal 11
09-04-2004 16:45:56 [LVL: 1] [alarmtool (7174)]: alarmtool started
09-04-2004 16:45:56 [LVL: 9] [alarmtool (7174)]: caught fatal signal 11
09-04-2004 16:52:55 [LVL: 1] [alarmtool (11830)]: alarmtool started
...That last restart was manual, after I blew away the
.cache/agent6000.cache file. And while alarmtool is catching the
segv's, it's not writing core files :(
Again, I wish there was some tool to sanity-check .cache/agentNNNN.cache
files...
Hank
-----BEGIN PGP SIGNATURE-----
iD8DBQFBOi7zIvjvEYYapvERArhMAJ41EhN2euDPt1jB+vtIwmM5b9Fd5QCeKFYd
4xwl4eklZnZQnRbG6HPlyX8=
-----END PGP SIGNATURE-----
_______________________________________________
Dragonidsuser mailing list
For help please follow the below instructions.
You can make subsciption adjustments via email by sending a message to:
Dragonidsuser-request@enterasys.com
with the word `help' in the subject or body (don't include the quotes), and
you will get back a message with instructions.
You must know your password to change your options (including changing the
password, itself) or to unsubscribe.
If you forget your password, don't worry, you will receive a monthly
reminder telling you what all your enterasys.com mailing list passwords
are, and how to unsubscribe or change your options.
This email is confidential and intended solely for the use of the
individual or entity to whom it is addressed. If you have received this
email in error please notify the system manager at mailadmin@bisys.com and
delete the email immediately.
_______________________________________________
Dragonidsuser mailing list
For help please follow the below instructions.
You can make subsciption adjustments via email by sending a message to:
Dragonidsuser-request@enterasys.com
with the word `help' in the subject or body (don't include the quotes), and you will \
get back a message with instructions.
You must know your password to change your options (including changing the password, \
itself) or to unsubscribe. If you forget your password, don't worry, you will \
receive a monthly reminder telling you what all your enterasys.com mailing list \
passwords are, and how to unsubscribe or change your options.
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic