[THIN] Re: System under attack

Malcolm,

This has happened to me several times and has caused me much distress. The
recently migrated farm will be running fine for some time, and then
everything goes to heck in a handbasket, conincidentally about the time of
an app server crash on the back-end that disastrously affects the farm. I
get numerous (20-100) sessions that have no session ID (e.g., ICA-TCP#). I
also get the event error you mention below. We believe it is related to a
large number of user disconns/re-conns when the specific function related to
the app servers fails. It appears to build on a few servers and then cascade
to as many as 8-10 of the 30 servers. Of course, users get extremely slow
login times; as much as 6-10 minutes from 8-10 seconds. I am drilling down
into the KeepAlive setting that I thought was implemented farm-wide. This
issue has caused me much grief for nearly 4 weeks now, ever since we
migrated from NT4-MF 1.8 to Server 2003-MFXPe. 

Rob
24 Hour Fitness 

-----Original Message-----
From: BRUTON, Malcolm, FM [mailto:Malcolm.BRUTON@xxxxxxxx] 
Sent: Thursday, May 27, 2004 1:58 AM
To: 'thin@xxxxxxxxxxxxx'
Subject: [THIN] System under attack

Has anyone come across a System event ID that says
 

The terminal server received large number of incomplete connections. The
system may be under attack.  Source is Termserver and event ID 1006.

 

Thanks

Malcolm



****************************************************************************
*******
The Royal Bank of Scotland plc. Registered in Scotland No 90312.
Registered Office: 36 St Andrew Square, Edinburgh EH2 2YB.

Authorised and regulated by the Financial Services Authority     
 
This e-mail message is confidential and for use by the                      
addressee only. If the message is received by anyone other             
than the addressee, please return the message to the sender          
by replying to it and then delete the message from your                    
computer. Internet e-mails are not necessarily secure. The               
Royal Bank of Scotland plc does not accept responsibility for          
changes made to this message after it was sent.

 

Whilst all reasonable care has been taken to avoid the                   
transmission of viruses, it is the responsibility of the recipient to

ensure that the onward transmission, opening or use of this             
message and any attachments will not adversely affect its               
systems or data.  No responsibility is accepted by The Royal           
Bank of Scotland plc in this regard and the recipient should carry   
out such virus and other checks as it considers appropriate.           
 
Visit our websites at:

http://www.rbs.co.uk/CBFM

http://www.rbsmarkets.com

 
****************************************************************************
****



********************************************************
This Week's Sponsor - Tarantella Secure Global Desktop Tarantella Secure
Global Desktop Terminal Server Edition Free Terminal Service Edition
software with 2 years maintenance.
http://www.tarantella.com/ttba
**********************************************************
Useful Thin Client Computing Links are available at:
http://thin.net/links.cfm
***********************************************************
For Archives, to Unsubscribe, Subscribe or set Digest or Vacation mode use
the below link:
http://thin.net/citrixlist.cfm
********************************************************
This Week's Sponsor - Tarantella Secure Global Desktop
Tarantella Secure Global Desktop Terminal Server Edition
Free Terminal Service Edition software with 2 years maintenance.
http://www.tarantella.com/ttba
**********************************************************
Useful Thin Client Computing Links are available at:
http://thin.net/links.cfm
***********************************************************
For Archives, to Unsubscribe, Subscribe or 
set Digest or Vacation mode use the below link:
http://thin.net/citrixlist.cfm

Other related posts: