ewsNetHTTPStart + Communications-QUEUE FULL

[casablancag]

Hi

I have seen in our log that we have several error-messages. See below:

Some customers claims that they can't reach our Web-Site. Do you have any idea ?

Syslog from the Loadbalancer

21 JUL 01:06:38 1/1 167 SYSSOFT-4: Communications-QUEUE FULL-Ipv4SlaveArpTx: Internal Messages Dropped.

21 JUL 01:06:41 1/1 168 SYSSOFT-4: Communications-QUEUE FULL-Ipv4SlaveArpTx: Internal Messages Dropped.

21 JUL 05:28:56 1/1 169 SYSSOFT-4: Communications-QUEUE FULL-Ipv4SlaveArpTx: Internal Messages Dropped.

21 JUL 13:17:57 1/1 170 NETMAN-2: Enterprise:Service Transition:h01ivy_81 -> down

21 JUL 13:27:14 1/1 171 NETMAN-5: Enterprise:Service Transition:h01ivy_81 -> alive

22 JUL 05:28:35 1/1 172 SYSSOFT-4: Communications-QUEUE FULL-Ipv4SlaveArpTx: Internal Messages Dropped.

22 JUL 18:51:53 1/1 173 NETMAN-3: ewsNetHTTPStart refused connection

22 JUL 18:52:19 1/1 174 NETMAN-3: ewsNetHTTPStart refused connection

23 JUL 05:29:08 1/1 175 SYSSOFT-4: Communications-QUEUE FULL-Ipv4SlaveArpTx: Internal Messages Dropped.

24 JUL 05:28:30 1/1 176 SYSSOFT-4: Communications-QUEUE FULL-Ipv4SlaveArpTx: Internal Messages Dropped.

25 JUL 05:29:21 1/1 177 SYSSOFT-4: Communications-QUEUE FULL-Ipv4SlaveArpTx: Internal Messages Dropped.

[Gilles Dufour]

the QUEUE FULL message is usually no good when you get a lot of them.

It means the CSS is dropping traffic.

Apparently, the queue is the outgoing arp queue.

So the CSS is dropping arp messages.

I would sniff the network and verify the traffic is normal [no device sending abnormal amount of arp requests].

Do you have any /16 subnet on your CSS or other big subnet ?

Thanks,

Gilles.

[casablancag]

Hi Gilles

we don't have /16 subnets on the css. What I see is a high amount of syn dos attacks (15000 in one day). Could be this an indicator for the communication queue full? The version of the CSS is 7.4.108s.

Thanks

Giuseppe