network lost conection

[schinwari]

We had a network problem on weekend.
the network was unreachable, while system was rununig without any problem. after rebooting the system the network was again avalibale

I want to find out what was happend ? why lost network connection ?
i checked , syslog, samba log etc. all shows only network failure , i need more detailed information about lost.

if you can give me hints, where to look and for the furture what kind of tracing can i enable and configure mail to be informed ?

[schinwari]

additional information :
HP-UX tcemap10 B.11.11 U 9000/800 2698365133 unlimited-user license

[R.K. #]

Hello,

- Were you able to ping the server from outside?
- Were you able to telnet/ssh or only condole access?
- Please paste the syslog errors
- Any changes made on newtwork/switch side recently?
- Was there any "dead gateway detection" in syslog.log?
- Is this the only server affected?
- How many times issue occured?

Thanks..

[schinwari]

- the server could not be pinged from outside
- ping hostname was ok
- console Access via serial interface and Lilo access were Ok, all filesystem ok
- no other system affected at this Ip range
- this was the first time with such failure

- Syslog :

Jan 9 00:56:39 ServerXXX xntpd[1317]:
synchronisation lost
Jan 9 00:57:41 tcemap10 inetd[16693]: registrar/tcp: Connection from ServerXXX
Jan 9 01:05:26 ServerXXX smbd[18413]: [2010/01/09 01:05:26, 0] lib/util_sock.c:(436)
Jan 9 01:05:26 ServerXXX smbd[18413]: read_data: read failure for 4. Error = Connection timed out
Jan 9 01:05:41 ServerXXX inetd[18397]: registrar/tcp: Connection from ServerXXX (10.50.56.206) at Sat Jan 9 01:05:41 2010
Jan 9 01:07:41 ServerXXX inetd[18742]: registrar/tcp: Connection from ServerXXX (10.50.56.206) at Sat Jan 9 01:07:41 2010
Jan 9 01:07:47 ServerXXX smbd[15050]: [2010/01/09 01:07:47, 0] lib/util_sock.c:(436)
Jan 9 01:07:47 ServerXXX smbd[15050]: read_data: read failure for 4. Error = Network is unreachable
Jan 9 01:08:57 ServerXXX smbd[8180]: [2010/01/09 01:08:57, 0] lib/util_sock.c:(436)
Jan 9 01:08:57 ServerXXX smbd[8180]: read_data: read failure for 4. Error = Network is unreachable
Jan 9 01:09:41 ServerXXX inetd[19294]: registrar/tcp: Connection from ServerXXX

[R.K. #]

Hi..


Have a look here, may be this can help:

http://lists.samba.org/archive/samba/2002-September/051952.html

[schinwari]

The problem, is that frist the network connection was lost and then samba error appeard.
- is there a way to find logs about network activities ?

[Bill Hassell]

> The problem, is that frist the network connection was lost and then samba error appeard.

syslog adequately describes the problem. NTP detected a communication error, then registrar (another network service) detected the same problem and several minutes later, SAMBA/CIFS saw the error. Basically, someone pulled out the LAN cable, or changed the switch settings or root issued an ifconfig down command or changed the IP address of the LAN card. For this particular error (fixed by a reboot), I suspect that an ifconfig command may have been issued by accident. Look at root's .sh_history to see if this was the case.

> - is there a way to find logs about network activities ?

You can turn on network tracing but it would require gigabytes of storage until the next failure. When such a failure is seen, you start with lanadmin and lanscan to check the status of the card. Look specifically for the IP address.

[Viktor Balogh]

>after rebooting the system the network was again avalibale

Very strange approach to an unknown network problem. How came you to this idea?

[schinwari]

Hello Viktor,

I was not in able to ping the server, then i accessed the Server via Console and rebooted the Severn then ist was online

[Viktor Balogh]

I'm not sure if the reboot is what solved your problem. Ask the network team if they had any changes/outage at that time. Did you make any changes to the server?