[THIN] Re: many instances of csrss.exe (chat)

Exactly.  What is the issue?


----- Original Message -----
From: <Leon.Jaimes@xxxxxxxx>
To: <thin@xxxxxxxxxxxxx>
Sent: Thursday, February 27, 2003 7:07 PM
Subject: [THIN] Re: many instances of csrss.exe (chat)


> Are you by any chance using thin clients with an auto connect desktop as
the
> published application on the client?
>
> -----Original Message-----
> From: Mack, Rick [mailto:RMack@xxxxxxxxxxxxxx]
> Sent: Thursday, February 20, 2003 8:52 PM
> To: 'thin@xxxxxxxxxxxxx'
> Subject: [THIN] Re: many instances of csrss.exe (chat)
>
>
> HI John,
>
> Now that'd be a project.
>
> Satellite comms link, steerable dish on boat.
> Remote controlled fishing rod.
> Robot fish handler.
> Stereo webcams on stern of boat.
>
> Nah. It'd be cheaper to fly me there ;-)
>
> Regards,
>
> Rick
>
> Ulrich Mack
> rmack@xxxxxxxxxxxxxx
> Volante Solutions
> 18 Heussler Terrace, Milton 4064
> Queensland Australia.
> tel +61 7 3246 7777
>
>
>
> -----Original Message-----
> From: Rowlandson, John [mailto:John.Rowlandson@xxxxxxxxxxxxx]
> Sent: Friday, 21 February 2003 1:47 PM
> To: thin@xxxxxxxxxxxxx
> Subject: [THIN] Re: many instances of csrss.exe (chat)
>
>
>
> Mallesons Stephen Jaques
> www.mallesons.com
>
> Confidential communication
>
>
>
> pity you can't do some remote access fishing while in virtual weipa :D
>
> -----Original Message-----
> From: Mack, Rick [mailto:RMack@xxxxxxxxxxxxxx]
> Sent: Friday, 21 February 2003 2:32 PM
> To: 'thin@xxxxxxxxxxxxx'
> Subject: [THIN] Re: many instances of csrss.exe
>
>
> Hi People,
>
> Got called in to have a look at this one, the wonders of remote =
access;-).
>
> There really were hundreds of instances of csrss.exe, from 500-2400 and
> growing on servers in the farm that were hosting the main published app, =
a
> desktop session.=20
>
> Most instances of csrss.exe had no accompanying instances of =
winlogon.exe
>
> One of the servers has very high sessionid numbers (thousands) despite =
the
> fact the server had been running for less than 11 hours and had 30-40 =
> users, in at best the second shift since server reboot. Session Ids should
> have been no more than 200.
>
> When logins were disabled, the number of instances of csrss.exe started
> falling.
>
> Basically it takes quite a while for csrss.exe to die after an aborted =
> login attempt. So if the aborted login attempts are frequent enough, there
=
> will be a net increase in the number of instances of csrss.exe on a
server.
>
> Still have to track down the offending machine, but I guess this rates =
as
> an ICA denial of service attack.
>
> One to watch out for.
>
> Regards,
>
> Rick
>
> Ulrich Mack
> rmack@xxxxxxxxxxxxxx
> Volante Solutions
> 18 Heussler Terrace, Milton 4064
> Queensland Australia.
> tel +61 7 3246 7777
>
>
> *********************************************************
> This Week's Sponsor - Neoware=20
> Now through March 31, 2003=20
> Neoware is offering a Capio 500/Eon Proven 2100=20
> for $299! Click the link below:
> http://www.neoware.com/promocp4a/thinnetban.html
> **********************************************************
>
> For Archives, to Unsubscribe, Subscribe or=20
> set Digest or Vacation mode use the below link:
> http://thethin.net/citrixlist.cfm
> *********************************************************
> This Week's Sponsor - Neoware
> Now through March 31, 2003
> Neoware is offering a Capio 500/Eon Proven 2100
> for $299! Click the link below:
> http://www.neoware.com/promocp4a/thinnetban.html
> **********************************************************
>
> For Archives, to Unsubscribe, Subscribe or
> set Digest or Vacation mode use the below link:
> http://thethin.net/citrixlist.cfm
>
>
> *********************************************************
> This Week's Sponsor - Neoware
> Now through March 31, 2003
> Neoware is offering a Capio 500/Eon Proven 2100
> for $299! Click the link below:
> http://www.neoware.com/promocp4a/thinnetban.html
> **********************************************************
>
> For Archives, to Unsubscribe, Subscribe or
> set Digest or Vacation mode use the below link:
> http://thethin.net/citrixlist.cfm
>
>
> *********************************************************
> This Week's Sponsor - ThinPrint
> Simply the best print solution for Citrix
> Metaframe and Microsoft Terminal Services!
> http://www.thinprint.com
> **********************************************************
>
> For Archives, to Unsubscribe, Subscribe or
> set Digest or Vacation mode use the below link:
> http://thethin.net/citrixlist.cfm
>

*********************************************************
This Week's Sponsor - ThinPrint
Simply the best print solution for Citrix
Metaframe and Microsoft Terminal Services!
http://www.thinprint.com
**********************************************************

For Archives, to Unsubscribe, Subscribe or 
set Digest or Vacation mode use the below link:
http://thethin.net/citrixlist.cfm

Other related posts: