Oracle FAQ Your Portal to the Oracle Knowledge Grid
HOME | ASK QUESTION | ADD INFO | SEARCH | E-MAIL US
 

Home -> Community -> Usenet -> c.d.o.tools -> Re: Intermittent SQLNET errors

Re: Intermittent SQLNET errors

From: <yoram.ayalon_at_structuredweb.com>
Date: 3 Apr 2006 09:40:37 -0700
Message-ID: <1144082424.454004.109800@e56g2000cwe.googlegroups.com>


problem is, that I see these errors relating to SEVERAL types of programs. see below the types.

I am not declaring ANYTHING to run locally. Also, all pages are running using a domain-based user created to run anonymous IIS requests. no page should be be run under SYSTEM or any other special user.

if its rogue process, why is it usually happening at several web servers at the same time ?

can it be some kind of special web-based attack? I don't see any suspicious page on the IIS logs

new information: I have found out that we instances of "mini" slowdowns, in which I see a shorter break in the trace file, but not an error in the sqlnet.log file, it seems the break is not long enough to register as an error.

types of errors in log file:


  1. win2k, from IIS

(DESCRIPTION=(ADDRESS=(PROTOCOL=BEQ)(PROGRAM=oracle)(ARGV0=oracleORCL)(ARGS='(DESCRIPTION=(LOCAL=YES)(ADDRESS=(PROTOCOL=beq)))'))(CONNECT_DATA=(SID=ORCL)(CID=(PROGRAM=C:\WINNT\System32\inetsrv\inetinfo.exe)(HOST=xxxxxx)(USER=SYSTEM))))

2) win2k, from Cold Fusion

(DESCRIPTION=(ADDRESS=(PROTOCOL=BEQ)(PROGRAM=oracle)(ARGV0=oracleORCL)(ARGS='(DESCRIPTION=(LOCAL=YES)(ADDRESS=(PROTOCOL=beq)))'))(CONNECT_DATA=(SID=ORCL)(CID=(PROGRAM=D:\CFusion\Bin\cfserver.exe)(HOST=xxxxxx)(USER=SYSTEM))))

3) server 2003, from IIS
(DESCRIPTION=(ADDRESS=(PROTOCOL=BEQ)(PROGRAM=oracle)(ARGV0=oracleORCL)(ARGS='(DESCRIPTION=(LOCAL=YES)(ADDRESS=(PROTOCOL=beq)))'))(CONNECT_DATA=(SID=ORCL)(CID=(PROGRAM=c:\windows\system32\inetsrv\w3wp.exe)(HOST=yyyyyy)(USER=NETWORK?SERVICE))))

4) server 2003 from Cold Fusion

(DESCRIPTION=(ADDRESS=(PROTOCOL=BEQ)(PROGRAM=oracle)(ARGV0=oracleORCL)(ARGS='(DESCRIPTION=(LOCAL=YES)(ADDRESS=(PROTOCOL=beq)))'))(CONNECT_DATA=(SID=ORCL)(CID=(PROGRAM=D:\CFusion\Bin\cfserver.exe)(HOST=yyyyyy)(USER=SYSTEM))))
Received on Mon Apr 03 2006 - 11:40:37 CDT

Original text of this message

HOME | ASK QUESTION | ADD INFO | SEARCH | E-MAIL US