Analyzing OPCOM messages from Operator log.

[Anjan Ganguly]

I have one Alpha DS10 Open VMS( ver 7.2-1) and Decnet Ver-V is installed in my system.
The system is having connectivity with WAN and LAN.The server macine is responsible for transmitting and receiving data packets form other servers connected in WAN.Recently there was a problem in the server (still undetected) for which data transfer from it and data receive activity from other Servers got hampered.I am getting the following messages in operator log.

--------------------------------------------

%%%%%%%%%%% OPCOM 3-MAY-2011 17:29:30.00 %%%%%%%%%%%
Message from user SYSTEM on EA0IC2
Event: Local Transport Disconnection from: Node LOCAL:.EA0IC2 OSI Transport Local NSAP IP_ANY Remote NSAP AC10C244,
at: 2011-05-03-17:29:30.004+05:30Iinf
Reason=Address unknown,
DNA Error=Unknown transport selector
eventUid E6E90DE8-75AA-11E0-A502-454130494332
entityUid 89BC4966-6B53-11E0-A4D5-454130494332
streamUid 56CF3FC2-6B53-11E0-846A-AA0004009905

%%%%%%%%%%% OPCOM 3-MAY-2011 17:29:30.01 %%%%%%%%%%%
Message from user SYSTEM on EA0IC2
Event: Local Transport Disconnection from: Node LOCAL:.EA0IC2 OSI Transport Local NSAP IP_ANY Remote NSAP AC10D244,
at: 2011-05-03-17:29:30.014+05:30Iinf
Reason=Address unknown,
DNA Error=Unknown transport selector
eventUid E6EA8B5A-75AA-11E0-A502-454130494332
entityUid 89BD7A8E-6B53-11E0-A4D6-454130494332
streamUid 56CF3FC2-6B53-11E0-846A-AA0004009905

%%%%%%%%%% OPCOM 3-MAY-2011 17:33:11.95 %%%%%%%%%%%
Message from user SYSTEM on EA0IC2
Event: Remote Transport Disconnection from: Node LOCAL:.EA0IC2 OSI Transport Local NSAP 4900010010643100CA21 Remote NSAP 490001AA000
400BA0521,
at: 2011-05-03-17:33:11.419+05:30Iinf
Additional Information='40'H,
Reason=Address unknown
eventUid 6AE24C81-75AB-11E0-A589-454130494332
entityUid E25A917A-6C19-11E0-BAD6-454130494332
streamUid 56CF3FC2-6B53-11E0-846A-AA0004009905
---------------------------------------------

Can somebody had a look on the operator log and help me out to find out the problem.
In the operator log I am getting Reason=Address unknown. What does it mean too?

[JohnDite · Accepted solution]

Anjan,

as you have seen this events relate to OSI Transport Connect Requests. The Address unknown event is an indication that the "Transport Selector" (equivalent to a well known port # in TCP speak) addressed in the CR-TPDU is not available on the system, ie. the application/process or the NCL definition is not present on the system.

If you look at the help in NCL see "Event_Message => OSI_transport => local_nsap=> remote_nsap" you will find an explanation of these events.

In the above examples you have two incoming CR-TPDU (RFC1006) which are rejected at:
17:29:30.00 and 17:29:30.01 from IP Address
AC10C244 = 172.16.194.68
(unfortunately in this DECnet version the TSEL addressed is not displayed in the event). You can use the trace facility to look at what TSEL they were trying to address.
$TRACE START/LIVE/FULL "OSITP CR Messages"
or use tcpdump to create a trace file and analyze this offline with wireshark. (You may require certain process rights to use TRACE eg. NET$TRACEALL etc.)

Your third event shows that a locally initiated Connect Request failed on the Node with NSAP 490001AA000400BA0521 (over CLNS).
You will have to use TRACE to find out the TSEL involved

$MC NCL SHOW NODE NET$490001AA000400BA0521 name

Now you should have all the pieces of information with regard to Node addresses and Transport Selectors to possibly identify the applications that are involved.

A last piece of advice to make life easier and save disk space! In your DECnet configuration put the following command:
SET EVENT DISPATCHER SINK local_sink DISPLAYUIDS False

in your SYS$STARTUP:NET$EVENT_LOCAL.NCL

This will save the output of the last three lines of each of the events that you have been observing: (eg.)
eventUid 6AE24C81-75AB-11E0-A589-454130494332
entityUid E25A917A-6C19-11E0-BAD6-454130494332
streamUid 56CF3FC2-6B53-11E0-846A-AA0004009905

Good Luck !
John

[Anjan Ganguly]

John,

I have find out some statistics for Known node counters and all counter details of Osi transport from local node to remote node.
I have found something about the retransmitted PDUs.Can u have a look on this?
Seeing the statistics,some doubts about the communication link has arises in my mind.I may be wrong.Need to confirm about the doubts.I mean to say that i need to co-relate this parameters with my physical communication link.I am attaching the statics.
Let me also tell you that my servers are connected in WAN through Cisco routers (3600 series) to different physical locations.
Anjan

[JohnDite]

Anjan,

what about giving feedback to the questions you raised in your first post. Have you resolved these issues?

As regards your second issue, I would look at retransmissions being a serious issue if the % retransmitted PDUs to the total transmitted PDUS is high. I can't see at first glance that being the case in the figures you provided.
What kind of links are these? What is the theoretical speed of the WAN links? What protocols are being used on these WAN links? When you know all these factors then you can basically work out what a reasonable transmission rate should be.

You can monitor the behaviour of individual OSI Transport connections by studying the "Round Trip Delay Estimate".

Hope that helps.

John

[Anjan Ganguly]

John,

Your first reply really help me to start my further investigation.It is really a nice explanation that you had given.
Also,the required informations are,
---------------------------------
Link type is Point to Point
Link speed is 3 X 64 Kbps (3 links each of 64 Kbps)
Router to Router Protocol is OSPF(Open Shortest Path First)
----------------------------------

Also I am attaching the LANCP output for my dual LAN each of 100 Mbps.

Also in your first post you have translated the ip address "IP Address
AC10C244 = 172.16.194.68"
How could you do this?I mean what is the procedure to do the same.
and you have mentioned that there are 2 incoming CR-TPDU.I also like to have an idea about how you come to conclusion that there are 2 no of incoming CR-TPDU.?If I have this basic idea then I can go further.

Anjan

[Anjan Ganguly]

John,
I also like to know about the procedures and commands to monitor the Round trip Delay estimation in my network from one node to different nodes.Can u help me out in this?
If I am correct you are asking me to monitor (the time the PDU takes to be sent + the time it takes for an acknowledgment of that PDU to be received).!!!!!!!!!!!!

Anjan

[Walt McGaw]

Anjan,

The ip address translation is pretty straight forward. AC is hex, convert to decimal and it's 172. 10 hex is 16 decimal, D2 hex is 210 decimal and 44 hex is 68 decimal. 172.16.210.68.

Walt

[labadie_1]

Do it in DCl

>a="ac10c244"
>wr sys$output %X'f$extract(0,2,a)
172
>wr sys$output %X'f$extract(2,2,a)
16
>wr sys$output %X'f$extract(4,2,a)
194
>wr sys$output %X'f$extract(6,2,a)
68
>

[JohnDite]

Anjan,

you still have not described your WAN link protocol, but it could be tunneled (ie. over an IP backbone). [OSPF is the protocol used by the routers to inform each other of their network view and is not actually the protocol used to transport data.]

Every time that you see an OPCOM event (as in your first post) is an indication that incoming CR-TPDU has been received. The event reveals the address of the remote system. Normally if an application is trying to connect to another application on another system, then I would expect to see an endless series of these events, if the application is not available.

The events that you posted show 2 failed attempts of an incoming CR-TPDU (RFC1006) from the same system and 1 outgoing failed attempt CR-TPDU (CLNS).

Each OSI Transport connection is represented by an OSI TRANSPORT PORT entity instance.

NCL>SHOW OSI TRANSPORT PORT * all

You can also use scopeing ie.
NCL> SHOW OSI TRANSPORT PORT * Round Trip Delay Estimate, with Remote NSAP = 49:00-01:AA-00-04-00-BA-05:21

Do these links represent DECnet links or not? If so you could use DTSEND and DTR to give you some statistics as far as Transmission rates.

John

[Anjan Ganguly]

John,
I am getting really an end less series of this messages.I am using Decnet Phase V protocol.
An operatior log version also I am attaching.
Actually there are 5 machines exchanging Data with Decnet and there are 2 machines exchanging Data over TCPIP with my machine for which I am attaching the operator log.

Anjan