Re: Intermittent SQLNET errors

problem is, that I see these errors relating to SEVERAL types of programs. see below the types.

I am not declaring ANYTHING to run locally. Also, all pages are running using a domain-based user created to run anonymous IIS requests. no page should be be run under SYSTEM or any other special user.

if its rogue process, why is it usually happening at several web servers at the same time ?

can it be some kind of special web-based attack? I don't see any suspicious page on the IIS logs

new information: I have found out that we instances of "mini" slowdowns, in which I see a shorter break in the trace file, but not an error in the sqlnet.log file, it seems the break is not long enough to register as an error.

types of errors in log file:

1. win2k, from IIS

(DESCRIPTION=(ADDRESS=(PROTOCOL=BEQ)(PROGRAM=oracle)(ARGV0=oracleORCL)(ARGS='(DESCRIPTION=(LOCAL=YES)(ADDRESS=(PROTOCOL=beq)))'))(CONNECT_DATA=(SID=ORCL)(CID=(PROGRAM=C:\WINNT\System32\inetsrv\inetinfo.exe)(HOST=xxxxxx)(USER=SYSTEM))))

2) win2k, from Cold Fusion

(DESCRIPTION=(ADDRESS=(PROTOCOL=BEQ)(PROGRAM=oracle)(ARGV0=oracleORCL)(ARGS='(DESCRIPTION=(LOCAL=YES)(ADDRESS=(PROTOCOL=beq)))'))(CONNECT_DATA=(SID=ORCL)(CID=(PROGRAM=D:\CFusion\Bin\cfserver.exe)(HOST=xxxxxx)(USER=SYSTEM))))

3) server 2003, from IIS
(DESCRIPTION=(ADDRESS=(PROTOCOL=BEQ)(PROGRAM=oracle)(ARGV0=oracleORCL)(ARGS='(DESCRIPTION=(LOCAL=YES)(ADDRESS=(PROTOCOL=beq)))'))(CONNECT_DATA=(SID=ORCL)(CID=(PROGRAM=c:\windows\system32\inetsrv\w3wp.exe)(HOST=yyyyyy)(USER=NETWORK?SERVICE))))

4) server 2003 from Cold Fusion

(DESCRIPTION=(ADDRESS=(PROTOCOL=BEQ)(PROGRAM=oracle)(ARGV0=oracleORCL)(ARGS='(DESCRIPTION=(LOCAL=YES)(ADDRESS=(PROTOCOL=beq)))'))(CONNECT_DATA=(SID=ORCL)(CID=(PROGRAM=D:\CFusion\Bin\cfserver.exe)(HOST=yyyyyy)(USER=SYSTEM))))
Received on Mon Apr 03 2006 - 18:40:37 CEST