Anonymous_User Absent Member.
Absent Member.
1637 views

NW6.0SP5 server Shutdown

Just a few minutes ago my Netware 6.0SP5 server Abram shut itself down if
Station 0 is the server. And I thought it was. No info in the abend log
and this in the sys$log.err file:
12-20-2006 10:25:27 am: SHUTDOWN-1.0-0
Severity = 4
Down file server was requested by user ABRAM on station 0.

I always have Monitor up and running and it was idling along at 2%
Utilization as usual. It is mainly a file server, but has iPrint, SLP
DA, McAfees Netshield 4.63a, BackupExec 9.1 running too.
eDir is 8.7.3.8.


This servers last abend was May of this year from Mcafee and I upgraded
that to Netshield 4.63a. It normally stays up 50 days and then I reboot
it to clear open files in MAS90. It was rebooted on December 10th.

Peter

Labels (2)
0 Likes
6 Replies
Anonymous_User Absent Member.
Absent Member.

Re: NW6.0SP5 server Shutdown

You don't really say what you want from us. I guess you're asking why
this happened?

Yes, Station 0 is the server itself. A user or application on the
console with full rights requested the server be downed, with that user
name you mention. There's nothing in the abend log as the server did not
abend.

One possibility is someone has a rogue copy of FConsole (from NW 3.x
days) which allows remote downing. IIRC there is also a facility like
this in iMonitor somewhere. I would at least change the password on that
user, or possibly delete it altogether.
--
Andrew C Taubman
Novell Support Forums Volunteer SysOp
http://support.novell.com/forums
(Sorry, support is not provided via e-mail)

Opinions expressed above are not
necessarily those of Novell Inc.
0 Likes
Anonymous_User Absent Member.
Absent Member.

Re: NW6.0SP5 server Shutdown

> You don't really say what you want from us. I guess you're asking why
> this happened?
>
> Yes, Station 0 is the server itself. A user or application on the
> console with full rights requested the server be downed, with that user
> name you mention. There's nothing in the abend log as the server did not
> abend.
>
> One possibility is someone has a rogue copy of FConsole (from NW 3.x
> days) which allows remote downing. IIRC there is also a facility like
> this in iMonitor somewhere. I would at least change the password on that
> user, or possibly delete it altogether.
> --
> Andrew C Taubman
> Novell Support Forums Volunteer SysOp

Andrew:
I realize it did not bend so wasn't surprised not to find it in the
abend.log, but it was locked up deactivating volumes and I had to do a
ctl alt esc to down it and to restart it. Yes I was wondering how it
happened and how to prevent. I had 15 users logged into our MAS90
database and six or seven draftsmen with solidworks or AutoCad drawings
open.
The server room was locked and no one was in there when I got there
(approx 100ft walk).
I am not sure what yo mean by user on the server as it was the server or
console that shut it down. I had Adrem Free Remote console 6.0.0.422
open to Monitor when it happened, but as far as i know there is no-one
else in the building that could get into the server. We are on a WAN
that is locked down to everything as far as I know.

> http://support.novell.com/forums
> (Sorry, support is not provided via e-mail)
>
> Opinions expressed above are not
> necessarily those of Novell Inc.


0 Likes
Anonymous_User Absent Member.
Absent Member.

Re: NW6.0SP5 server Shutdown

On 22/12/06 pjam@do-no-spam-me-lorch.com wrote:
> I realize it did not abend so wasn't surprised not to find it in the
> abend.log, but it was locked up deactivating volumes and I had to do
> a ctl alt esc to down it and to restart it.


Ah, OK, you didn't mention that! 🙂


> I am not sure what you mean by user on the server as it was the server or console that shut it down.


I understand that. When an application loads on the console it can still
need to log into the server to be able to do things, and it's not
uncommon for it to require a user id for that login. For instance when
you load dsrepair - advanced - global schema operations, you have to log
in as an Admin user before it will access that menu.


> I had Adrem Free Remote console 6.0.0.422
> open to Monitor when it happened, but as far as i know there is
> no-one else in the building that could get into the server. We are on a WAN
> that is locked down to everything as far as I know.


I'm not saying someone was physically standing in front of the console.
But there are other ways of getting access to the server OS itself. I
mentioned two, FConsole and iMonitor. Adrem is another way, as it too
requires a user to log in (or to be already logged in).

Again, someone logged in as that User ID and shut down the server. How
exactly they did it we may not be able to determine, but they did. Have
you asked them? Have you changed that user's password or disabled the
account?
--
Andrew C Taubman
Novell Support Forums Volunteer SysOp
http://support.novell.com/forums
(Sorry, support is not provided via e-mail)

Opinions expressed above are not
necessarily those of Novell Inc.
0 Likes
Anonymous_User Absent Member.
Absent Member.

Re: NW6.0SP5 server Shutdown

there was no user ID that I know of. The server name is abram.
The Admin account is in a different OU, administrative context. Unless
someone is very NW savy and knew the Admin password 8 long alphanumeric,
caps, small letters & Numbers. Also there is only one Adrem and
iMonitor, here as far a I know and no fconsole.
It's a mystery to me.


Peter
> On 22/12/06 pjam@do-no-spam-me-lorch.com wrote:
> > I realize it did not abend so wasn't surprised not to find it in the
> > abend.log, but it was locked up deactivating volumes and I had to do
> > a ctl alt esc to down it and to restart it.

>
> Ah, OK, you didn't mention that! 🙂
>
>
> > I am not sure what you mean by user on the server as it was the

server or console that shut it down.
>
> I understand that. When an application loads on the console it can still
> need to log into the server to be able to do things, and it's not
> uncommon for it to require a user id for that login. For instance when
> you load dsrepair - advanced - global schema operations, you have to log
> in as an Admin user before it will access that menu.
>
>
> > I had Adrem Free Remote console 6.0.0.422
> > open to Monitor when it happened, but as far as i know there is
> > no-one else in the building that could get into the server. We are

on a WAN
> > that is locked down to everything as far as I know.

>
> I'm not saying someone was physically standing in front of the console.
> But there are other ways of getting access to the server OS itself. I
> mentioned two, FConsole and iMonitor. Adrem is another way, as it too
> requires a user to log in (or to be already logged in).
>
> Again, someone logged in as that User ID and shut down the server. How
> exactly they did it we may not be able to determine, but they did. Have
> you asked them? Have you changed that user's password or disabled the
> account?
> --
> Andrew C Taubman
> Novell Support Forums Volunteer SysOp
> http://support.novell.com/forums
> (Sorry, support is not provided via e-mail)
>
> Opinions expressed above are not
> necessarily those of Novell Inc.


0 Likes
Anonymous_User Absent Member.
Absent Member.

Re: NW6.0SP5 server Shutdown

On Fri, 22 Dec 2006 08:53:52 -0800, <pjam@do-no-spam-me-lorch.com> wrote:

> there was no user ID that I know of. The server name is abram.


Well, your sys$log.err clipping says "user ABRAM". But I'm not sure where
that came from, because I tried "down" and "shutdown" on the console, and
"down" in NRM, and I don't get an entry like that. Must be from some
other tool.

/dps

--
Using Opera's revolutionary e-mail client: http://www.opera.com/m2/
0 Likes
Anonymous_User Absent Member.
Absent Member.

Re: NW6.0SP5 server Shutdown

>Dave:
I guess that is the mystery isn't it 😆

On Fri, 22 Dec 2006 08:53:52 -0800, <pjam@do-no-spam-me-lorch.com> wrote:
>
> > there was no user ID that I know of. The server name is abram.

>
> Well, your sys$log.err clipping says "user ABRAM". But I'm not sure

where
> that came from, because I tried "down" and "shutdown" on the console,

and
> "down" in NRM, and I don't get an entry like that. Must be from some
> other tool.
>
> /dps
>
> --
> Using Opera's revolutionary e-mail client: http://www.opera.com/m2/


0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.