RE: Weird one the last couple of days
- From: Phill Hardstaff <phillh@xxxxxxx>
- To: "[ISAserver.org Discussion List]" <isalist@xxxxxxxxxxxxx>
- Date: Wed, 24 Dec 2003 08:28:51 +1100
Do you mean the servers went really slow for access to the web or access to
the console was really slow or both. Nachi behind your ISA box will make CPU
go to 100%, everything is still working but if you go the console the server
looks like it is locked, but it's not, pull the cable from the NIC to the
internal network and CPU usage will drop the 0% almost immediately, we had
to do this to isolate which building had a Nachi infected machine in it. So
more likely is that new network has some infected PC's on it.
Cheers
Phill
_____
From: Smith, Carl [mailto:CWSmith@xxxxxxxxxxxx]
Sent: Wednesday, 24 December 2003 6:49 AM
To: [ISAserver.org Discussion List]
Subject: [isalist] Weird one the last couple of days
http://www.ISAserver.org
We have been tracking down a ghost error the last couple of days. Basically
what would happen is that the ISA servers in the array would crawl for
access (we just do outbound for web access). We would reboot them, and they
would come back up fine. Couple of hours would pass, and boom, it would
happen again. Of course it did not help we moved to a Win2k+3 DC this
weekend so we were trying to track that down.
Anyway, we found someone decided to bring up another segment. so these new
IPs ranges were hitting the ISA servers. Since this was not a known IP
their were no routes or LAT entries so everything was routed out the
external adapter, not the internal. Added them and bam, everything cleared
up. The back of my mind says this was a fluke and the problem is going to
creep up again. Anyone have any ideas for a general slowness problem.. btw,
my car is making the pinging noise.. I know, ghost error, but this is
stumping me. Anyone have any issues with win2k+3 DCs?
Thanks -- Carl
------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Other Internet Software Marketing Sites:
Leading Network Software Directory: http://www.serverfiles.com
No.1 Exchange Server Resource Site: http://www.msexchange.org
Windows Security Resource Site: http://www.windowsecurity.com/
Network Security Library: http://www.secinf.net/
Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
phillh@xxxxxxx
To unsubscribe send a blank email to $subst('Email.Unsub')
---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.554 / Virus Database: 346 - Release Date: 20/12/2003
---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.554 / Virus Database: 346 - Release Date: 20/12/2003
Other related posts:
