HP-UX

Hi,

Thanks all for the tons of replies and suggestions.

Could be possible that the load/number of users steadily increased.
Network configurations in this sense means? Which file?
Maximum connections you mean maximum ssh connections allowed? I believe it is still at the system default which is 60.
A week or 2 earlier, there were few occurrences of where users were not able to login into the server due to too many ssh connections from one user which had root (0) privilege.

Machine model : HP RX7640 ia64
OS version : HPUX B11.23
CPU : 4 Physical, 8 Core
Memory : 128 G

I am not aware of any security scanning devices used in the server.

There was nothing in particular happening in the server at the time of the crash.

The scanner is not in the server but somewhere on your network, internal I hope, or it may be an attack as mentionned... so in internal it seems there is something looking like a such device at the IP I pointed out - Check!
Years ago I had many HP-UX crashes once a month till I decided to write at the direction saying those "non-intrusive" devices were all but that and crashing HP servers or some mainframe devices, mostly the ones trusted and having/using NFS, the reason is mainly it opens so many connections id doesnt care for itself (MS.. OS?) but on a UNIX server the timeouts are regularly over 5 minutes so a opened port cannot be used till it is cleaned and so in such cases quickly you run out and then no one can connect, not even root and you are doomed... Once I proved where it came from the HP servers were listed out the scanning process... and now they changed system, but I have no more HP either... If you have NFS mounted on that server and the scan manages to make it unreadable then your system depending what is running will try to read desperatly and it s load will go beyond control till the system crashes...

Hi,

As "vbe" and myself have already said, track down the machine/user combination at "10.61.1.55" - if this is not a machine on your LAN/WAN it is some kind of intrusion.

If it is on your network find out what it's function is, even if you resolve any local issues with your HPUX system locally - it is likely that they will return if this machine carries on doing what it is doing.

Regards

Gull04