Hi ,
The Hosts are Windows machines.
tsm: SWISP001>q filespace GBTLSWIOA001
Node Name Filespace FSID Platform Filespace Is Files- Capacity
Pct
Name Type pace (MB)
Util
Unicode?
--------------- ----------- ---- -------- --------- --------- --------
-----
GBTLSWIOA001 SYSTEM 1 WinNT SYSTEM Yes 0.0
0.0
SERVICES
GBTLSWIOA001 SYSTEM 2 WinNT SYSTEM Yes 0.0
0.0
STATE
GBTLSWIOA001 ASR 3 WinNT NTFS Yes 0.0
0.0
GBTLSWIOA001 \\gbtlswio- 4 WinNT NTFS Yes 22,489.4
83.3
a001\d$
GBTLSWIOA001 \\gbtlswio- 5 WinNT NTFS Yes 12,189.9
91.5
a001\c$
From the below output the IP address appears to be the same. There
doesn't seem to be 2 different IP addresses.
q actlog begindate=-2 search=GBTLSWIOA001
Date/Time Message
--------------------
----------------------------------------------------------
10/31/2006 07:39:02 ANR0406I Session 696475 started for node
GBTLSWIOA001
(WinNT) (Tcp/Ip 10.196.70.53(2624)). (SESSION:
696475)
10/31/2006 07:39:02 ANR2579E Schedule TBO_SEV3_INCR_2 in domain SWITBOW
for
node GBTLSWIOA001 failed (return code 12).
(SESSION:
696475)
10/31/2006 07:39:02 ANR0403I Session 696475 ended for node GBTLSWIOA001
(WinNT). (SESSION: 696475)
10/31/2006 07:39:02 ANR0406I Session 696476 started for node
GBTLSWIOA001
(WinNT) (Tcp/Ip 10.196.70.53(2625)). (SESSION:
696476)
10/31/2006 07:39:02 ANR0403I Session 696476 ended for node GBTLSWIOA001
(WinNT). (SESSION: 696476)
10/31/2006 08:39:03 ANR0406I Session 696758 started for node
GBTLSWIOA001
(WinNT) (Tcp/Ip 10.196.70.53(2947)). (SESSION:
696758)
10/31/2006 08:39:03 ANR0403I Session 696758 ended for node GBTLSWIOA001
(WinNT). (SESSION: 696758)
10/31/2006 09:39:04 ANR0406I Session 697041 started for node
GBTLSWIOA001
(WinNT) (Tcp/Ip 10.196.70.53(3263)). (SESSION:
697041)
10/31/2006 09:39:04 ANR0403I Session 697041 ended for node GBTLSWIOA001
(WinNT). (SESSION: 697041)
10/31/2006 10:39:04 ANR0406I Session 697678 started for node
GBTLSWIOA001
(WinNT) (Tcp/Ip 10.196.70.53(3580)). (SESSION:
697678)
10/31/2006 10:39:04 ANR0403I Session 697678 ended for node GBTLSWIOA001
(WinNT). (SESSION: 697678)
10/31/2006 11:39:04 ANR0406I Session 698559 started for node
GBTLSWIOA001
(WinNT) (Tcp/Ip 10.196.70.53(3884)). (SESSION:
698559)
10/31/2006 11:39:04 ANR0403I Session 698559 ended for node GBTLSWIOA001
(WinNT). (SESSION: 698559)
10/31/2006 12:39:04 ANR0406I Session 699196 started for node
GBTLSWIOA001
(WinNT) (Tcp/Ip 10.196.70.53(4207)). (SESSION:
699196)
10/31/2006 12:39:04 ANR0403I Session 699196 ended for node GBTLSWIOA001
(WinNT). (SESSION: 699196)
10/31/2006 13:39:04 ANR0406I Session 699868 started for node
GBTLSWIOA001
(WinNT) (Tcp/Ip 10.196.70.53(4531)). (SESSION:
699868)
10/31/2006 13:39:04 ANR0403I Session 699868 ended for node GBTLSWIOA001
(WinNT). (SESSION: 699868)
10/31/2006 14:39:04 ANR0406I Session 700225 started for node
GBTLSWIOA001
(WinNT) (Tcp/Ip 10.196.70.53(4848)). (SESSION:
700225)
10/31/2006 14:39:04 ANR0403I Session 700225 ended for node GBTLSWIOA001
(WinNT). (SESSION: 700225)
10/31/2006 15:39:04 ANR0406I Session 700657 started for node
GBTLSWIOA001
(WinNT) (Tcp/Ip 10.196.70.53(1213)). (SESSION:
700657)
10/31/2006 15:39:04 ANR0403I Session 700657 ended for node GBTLSWIOA001
(WinNT). (SESSION: 700657)
10/31/2006 15:51:51 ANR0482W Session 694902 for node GBTLSWIOA001
(WinNT)
terminated - idle for more than 750 minutes.
(SESSION:
694902)
10/31/2006 15:51:51 ANR2579E Schedule TBO_SEV3_INCR_2 in domain SWITBOW
for
node GBTLSWIOA001 failed (return code 12).
(SESSION:
694889)
10/31/2006 15:51:51 ANR2576W An attempt was made to update an event
record for a scheduled operation which has already
been
executed multiple client schedulers may be
active for
node GBTLSWIOA001. (SESSION: 694889)
10/31/2006 15:51:51 ANR0480W Session 694889 for node GBTLSWIOA001
(WinNT)
terminated - connection with client severed.
(SESSION:
694889)
10/31/2006 16:39:04 ANR0406I Session 701085 started for node
GBTLSWIOA001
(WinNT) (Tcp/Ip 10.196.70.53(1516)). (SESSION:
701085)
10/31/2006 16:39:05 ANR0403I Session 701085 ended for node GBTLSWIOA001
(WinNT). (SESSION: 701085)
10/31/2006 17:39:04 ANR0406I Session 701516 started for node
GBTLSWIOA001
(WinNT) (Tcp/Ip 10.196.70.53(1852)). (SESSION:
701516)
10/31/2006 17:39:05 ANR0403I Session 701516 ended for node GBTLSWIOA001
(WinNT). (SESSION: 701516)
10/31/2006 18:39:04 ANR0406I Session 702340 started for node
GBTLSWIOA001
(WinNT) (Tcp/Ip 10.196.70.53(2146)). (SESSION:
702340)
10/31/2006 18:39:05 ANR0403I Session 702340 ended for node GBTLSWIOA001
(WinNT). (SESSION: 702340)
10/31/2006 19:39:05 ANR0406I Session 702866 started for node
GBTLSWIOA001
(WinNT) (Tcp/Ip 10.196.70.53(2465)). (SESSION:
702866)
10/31/2006 19:39:05 ANR0403I Session 702866 ended for node GBTLSWIOA001
(WinNT). (SESSION: 702866)
10/31/2006 20:39:05 ANR0406I Session 703971 started for node
GBTLSWIOA001
(WinNT) (Tcp/Ip 10.196.70.53(2797)). (SESSION:
703971)
10/31/2006 20:39:05 ANR0403I Session 703971 ended for node GBTLSWIOA001
(WinNT). (SESSION: 703971)
10/31/2006 21:39:05 ANR0406I Session 704676 started for node
GBTLSWIOA001
(WinNT) (Tcp/Ip 10.196.70.53(3117)). (SESSION:
704676)
10/31/2006 21:39:05 ANR0403I Session 704676 ended for node GBTLSWIOA001
(WinNT). (SESSION: 704676)
10/31/2006 22:39:05 ANR0406I Session 705253 started for node
GBTLSWIOA001
(WinNT) (Tcp/Ip 10.196.70.53(3443)). (SESSION:
705253)
10/31/2006 22:39:05 ANR0403I Session 705253 ended for node GBTLSWIOA001
(WinNT). (SESSION: 705253)
10/31/2006 23:39:05 ANR0406I Session 706020 started for node
GBTLSWIOA001
(WinNT) (Tcp/Ip 10.196.70.53(3754)). (SESSION:
706020)
10/31/2006 23:39:05 ANR0403I Session 706020 ended for node GBTLSWIOA001
(WinNT). (SESSION: 706020)
11/01/2006 00:39:05 ANR0406I Session 706695 started for node
GBTLSWIOA001
(WinNT) (Tcp/Ip 10.196.70.53(4094)). (SESSION:
706695)
11/01/2006 00:39:05 ANR0403I Session 706695 ended for node GBTLSWIOA001
(WinNT). (SESSION: 706695)
11/01/2006 01:39:05 ANR0406I Session 707121 started for node
GBTLSWIOA001
(WinNT) (Tcp/Ip 10.196.70.53(4412)). (SESSION:
707121)
11/01/2006 01:39:06 ANR0403I Session 707121 ended for node GBTLSWIOA001
(WinNT). (SESSION: 707121)
11/01/2006 02:39:05 ANR0406I Session 707667 started for node
GBTLSWIOA001
(WinNT) (Tcp/Ip 10.196.70.53(4714)). (SESSION:
707667)
11/01/2006 02:39:06 ANR0403I Session 707667 ended for node GBTLSWIOA001
(WinNT). (SESSION: 707667)
11/01/2006 03:18:06 ANR0406I Session 708049 started for node
GBTLSWIOA001
(WinNT) (Tcp/Ip 10.196.70.53(4920)). (SESSION:
708049)
11/01/2006 03:19:38 ANR0406I Session 708053 started for node
GBTLSWIOA001
(WinNT) (Tcp/Ip 10.196.70.53(4925)). (SESSION:
708053)
11/01/2006 09:28:12 ANR2017I Administrator STORAGE issued command:
QUERY
ACTLOG begind=today begint=03:00:00 s=GBTLSWIOA001
(SESSION: 711068)
11/01/2006 09:29:23 ANR2017I Administrator STORAGE issued command:
QUERY EVENT
* * nodes=GBTLSWIOA001 begind=-7 (SESSION:
711068)
11/01/2006 09:29:29 ANR2017I Administrator STORAGE issued command:
QUERY EVENT
* * nodes=GBTLSWIOA001 begind=-7 endd=today
(SESSION:
711068)
11/01/2006 10:48:43 ANE4952I (Session: 708049, Node: GBTLSWIOA001)
Total
number of objects inspected: 49,985 (SESSION:
708049)
11/01/2006 10:48:43 ANE4954I (Session: 708049, Node: GBTLSWIOA001)
Total
number of objects backed up: 118 (SESSION:
708049)
11/01/2006 10:48:43 ANE4958I (Session: 708049, Node: GBTLSWIOA001)
Total
number of objects updated: 0 (SESSION:
708049)
11/01/2006 10:48:43 ANE4960I (Session: 708049, Node: GBTLSWIOA001)
Total
number of objects rebound: 0 (SESSION:
708049)
11/01/2006 10:48:43 ANE4957I (Session: 708049, Node: GBTLSWIOA001)
Total
number of objects deleted: 0 (SESSION:
708049)
11/01/2006 10:48:43 ANE4970I (Session: 708049, Node: GBTLSWIOA001)
Total
number of objects expired: 16 (SESSION:
708049)
11/01/2006 10:48:43 ANE4959I (Session: 708049, Node: GBTLSWIOA001)
Total
number of objects failed: 0 (SESSION:
708049)
11/01/2006 10:48:43 ANE4965I (Session: 708049, Node: GBTLSWIOA001)
Elapsed
processing time (H:MM:SS): 0 (SESSION: 708049)
11/01/2006 10:48:43 ANE4961I (Session: 708049, Node: GBTLSWIOA001)
Total
number of bytes transferred: 55.51 MB (SESSION:
708049)
11/01/2006 10:48:43 ANE4963I (Session: 708049, Node: GBTLSWIOA001)
Data
transfer time: 24.87 sec
(SESSION:
708049)
11/01/2006 10:48:43 ANE4966I (Session: 708049, Node: GBTLSWIOA001)
Network
data transfer rate: 2,285.27 KB/sec
(SESSION:
708049)
11/01/2006 10:48:43 ANE4967I (Session: 708049, Node: GBTLSWIOA001)
Aggregate
data transfer rate: 2.10 KB/sec (SESSION:
708049)
11/01/2006 10:48:43 ANE4968I (Session: 708049, Node: GBTLSWIOA001)
Objects
compressed by: 47% (SESSION:
708049)
11/01/2006 10:48:43 ANE4969I (Session: 708049, Node: GBTLSWIOA001)
Total
failures: 0 (SESSION:
708049)
11/01/2006 10:48:43 ANE4964I (Session: 708049, Node: GBTLSWIOA001)
Elapsed
processing time: 07:30:36 (SESSION:
708049)
11/01/2006 13:08:43 ANR0406I Session 713921 started for node
GBTLSWIOA001
(WinNT) (Tcp/Ip 10.196.70.53(4055)). (SESSION:
713921)
11/01/2006 13:08:43 ANR2579E Schedule TBO_SEV3_INCR_2 in domain SWITBOW
for
node GBTLSWIOA001 failed (return code 12).
(SESSION:
713921)
11/01/2006 13:08:43 ANR0403I Session 713921 ended for node GBTLSWIOA001
(WinNT). (SESSION: 713921)
11/01/2006 13:08:43 ANR0406I Session 713922 started for node
GBTLSWIOA001
(WinNT) (Tcp/Ip 10.196.70.53(4056)). (SESSION:
713922)
11/01/2006 13:08:43 ANR0403I Session 713922 ended for node GBTLSWIOA001
(WinNT). (SESSION: 713922)
11/01/2006 14:08:43 ANR0406I Session 714350 started for node
GBTLSWIOA001
(WinNT) (Tcp/Ip 10.196.70.53(4380)). (SESSION:
714350)
11/01/2006 14:08:43 ANR0403I Session 714350 ended for node GBTLSWIOA001
(WinNT). (SESSION: 714350)
11/01/2006 15:08:43 ANR0406I Session 714765 started for node
GBTLSWIOA001
(WinNT) (Tcp/Ip 10.196.70.53(4685)). (SESSION:
714765)
11/01/2006 15:08:43 ANR0403I Session 714765 ended for node GBTLSWIOA001
(WinNT). (SESSION: 714765)
11/01/2006 15:50:10 ANR0482W Session 708053 for node GBTLSWIOA001
(WinNT)
terminated - idle for more than 750 minutes.
(SESSION:
708053) node GBTLSWIOA001 failed (return code 12).
(SESSION:708049)
11/01/2006 15:50:10 ANR2576W An attempt was made to update an event
record for a scheduled operation which has already
been
executed multiple client schedulers may be
active for
node GBTLSWIOA001. (SESSION: 708049)
11/01/2006 15:50:10 ANR0480W Session 708049 for node GBTLSWIOA001
(WinNT)
terminated - connection with client severed.
(SESSION:
708049)
11/01/2006 16:08:43 ANR0406I Session 715183 started for node
GBTLSWIOA001
(WinNT) (Tcp/Ip 10.196.70.53(1032)). (SESSION:
715183)
11/01/2006 16:08:43 ANR0403I Session 715183 ended for node GBTLSWIOA001
(WinNT). (SESSION: 715183)
11/01/2006 17:08:43 ANR0406I Session 715602 started for node
GBTLSWIOA001
(WinNT) (Tcp/Ip 10.196.70.53(1373)). (SESSION:
715602)
11/01/2006 17:08:43 ANR0403I Session 715602 ended for node GBTLSWIOA001
(WinNT). (SESSION: 715602)
11/01/2006 18:08:43 ANR0406I Session 716144 started for node
GBTLSWIOA001
(WinNT) (Tcp/Ip 10.196.70.53(1705)). (SESSION:
716144)
11/01/2006 18:08:44 ANR0403I Session 716144 ended for node GBTLSWIOA001
(WinNT). (SESSION: 716144)
11/01/2006 19:08:44 ANR0406I Session 716854 started for node
GBTLSWIOA001
(WinNT) (Tcp/Ip 10.196.70.53(2012)). (SESSION:
716854)
11/01/2006 19:08:45 ANR0403I Session 716854 ended for node GBTLSWIOA001
(WinNT). (SESSION: 716854)
11/01/2006 20:08:45 ANR0406I Session 717431 started for node
GBTLSWIOA001
(WinNT) (Tcp/Ip 10.196.70.53(2330)). (SESSION:
717431)
11/01/2006 20:08:45 ANR0403I Session 717431 ended for node GBTLSWIOA001
(WinNT). (SESSION: 717431)
11/01/2006 21:08:45 ANR0406I Session 718325 started for node
GBTLSWIOA001
(WinNT) (Tcp/Ip 10.196.70.53(2651)). (SESSION:
718325)
11/01/2006 21:08:45 ANR0403I Session 718325 ended for node GBTLSWIOA001
(WinNT). (SESSION: 718325)
11/01/2006 22:08:45 ANR0406I Session 719099 started for node
GBTLSWIOA001
(WinNT) (Tcp/Ip 10.196.70.53(2954)). (SESSION:
719099)
11/01/2006 22:08:45 ANR0403I Session 719099 ended for node GBTLSWIOA001
(WinNT). (SESSION: 719099)
11/01/2006 23:08:45 ANR0406I Session 719519 started for node
GBTLSWIOA001
(WinNT) (Tcp/Ip 10.196.70.53(3286)). (SESSION:
719519)
11/01/2006 23:08:46 ANR0403I Session 719519 ended for node GBTLSWIOA001
(WinNT). (SESSION: 719519)
11/02/2006 00:08:46 ANR0406I Session 720036 started for node
GBTLSWIOA001
(WinNT) (Tcp/Ip 10.196.70.53(3601)). (SESSION:
720036)
11/02/2006 00:08:46 ANR0403I Session 720036 ended for node GBTLSWIOA001
(WinNT). (SESSION: 720036)
11/02/2006 01:08:46 ANR0406I Session 720515 started for node
GBTLSWIOA001
(WinNT) (Tcp/Ip 10.196.70.53(3920)). (SESSION:
720515)
11/02/2006 01:08:46 ANR0403I Session 720515 ended for node GBTLSWIOA001
(WinNT). (SESSION: 720515)
11/02/2006 02:08:46 ANR0406I Session 721031 started for node
GBTLSWIOA001
(WinNT) (Tcp/Ip 10.196.70.53(4219)). (SESSION:
721031)
11/02/2006 02:08:47 ANR0403I Session 721031 ended for node GBTLSWIOA001
(WinNT). (SESSION: 721031)
11/02/2006 03:08:47 ANR0406I Session 721661 started for node
GBTLSWIOA001
(WinNT) (Tcp/Ip 10.196.70.53(4525)). (SESSION:
721661)
11/02/2006 03:08:47 ANR0403I Session 721661 ended for node GBTLSWIOA001
(WinNT). (SESSION: 721661)
-----Original Message-----
From: ADSM: Dist Stor Manager [mailto:ADSM-L AT VM.MARIST DOT EDU] On Behalf Of
Roger Deschner
Sent: 02 November 2006 05:56
To: ADSM-L AT VM.MARIST DOT EDU
Subject: Re: [ADSM-L] Backup failure
Looks to me like it could be two different machines trying to use one
node name. The biggest clue that this is the problem is your message
ANR2576W. Reboot the client machine, in case it really did get two
schedulers running. But it's more likely two different machines trying
to share one nodename. At any rate, do
q actlog begindate=-2 search=GBTLSWIOA001
and just check the IP addresses it is connecting from. This is one way
to catch cheaters who use one node name on two machines. Here's what
you're looking for:
2006-11-01 23:15:25 ANR0406I Session 81867 started for node
GBTLSWIOA001
(WinNT) (Tcp/Ip 111.222.111.16(2566)).
then a bit later...
2006-11-01 23:20:25 ANR0403I Session 81867 ended for node
GBTLSWIOA001
(WinNT).
This is as it sould be. But if you have
2006-11-01 23:15:25 ANR0406I Session 81867 started for node
GBTLSWIOA001
(WinNT) (Tcp/Ip 111.222.111.16(2566)).
2006-11-01 23:25:25 ANR0406I Session 81895 started for node
GBTLSWIOA001
(WinNT) (Tcp/Ip 111.222.111.50(2566)).
...Now you've got your perpetrator. They're running two machines on one
nodename, and you now have the IP addresses of both of them. Go gettum!
Q NODE GBTLSWIOA001 F=D shows the IP address this node last connected
from, which can be useful.
Beware that IP addresses can change if the client node uses DHCP (i.e. a
laptop), but even if the IP addresses change, you should see a start and
an end. If you see several starts from the same IP address, that is
normal too, especially if they have RESOURCEUTILIZATION set higher than
1. What you are looking for is several starts from different IP
addresses before you get the matching ends.
Also try
q filespace GBTLSWIOA001
and see if you can eyeball what looks like two different primary drives:
ROGERD.ADSM1 \\rogerd\c$ 1 WinME
ROGERD.ADSM1 \\861077\c$ 3 WinNT
Aha! This one has two different Windows C:\ drives. This is harder to
spot on unix-ish systems (including Mac OSX) because they all have the
same filespace names. You can eliminate false positives here by doing
Q FILESPACE F=D which shows the last backup start and end dates. It's
possible that one of those duplicate C:\ drives is from an old OS or
old machine that got upgraded, and backup dates will tell you that.
The most frequent cause of cheating like this is not people who set
out to beat the system, but rather people who replace their computer
with a new one and give away their old computer to a lucky colleague.
It still has the old TSM client including the scheduler on it, and
like the Energizer Bunny, it keeps going, and going, and going. We
find that most people with these Energizer Bunny nodes don't even know
they're backing up. The key message to look for to spot this kind of
problem is the ANR2576W you show below.
You might want to set minimum throughput thresholds, also. See the TSM
Admin Guide.
Roger Deschner University of Illinois at Chicago rogerd AT uic DOT edu
On Wed, 1 Nov 2006, Gopinathan, Srinath wrote:
>Hi All,
>
>I am having a backup which is failing regularly. There are no objects
>which is showing as failing. However, the backup is failing with the
>following errors.
>
>Any help on this would be appreciated.
>
>Regards,
>Srinath G
>
>10/31/2006 15:51:51 ANR0482W Session 694902 for node GBTLSWIOA001
>(WinNT)
> terminated - idle for more than 750 minutes.
>(SESSION:
> 694902)
>10/31/2006 15:51:51 ANR2579E Schedule TBO_SEV3_INCR_2 in domain
SWITBOW
>for
> node GBTLSWIOA001 failed (return code 12).
>(SESSION:
> 694889)
>10/31/2006 15:51:51 ANR2576W An attempt was made to update an event
>record for
> a scheduled operation which has already been
>executed -
> multiple client schedulers may be active for node
> GBTLSWIOA001. (SESSION: 694889)
>10/31/2006 15:51:51 ANR0480W Session 694889 for node GBTLSWIOA001
>(WinNT)
> terminated - connection with client severed.
>(SESSION:
> 694889)
>
>This e-mail has been scanned for viruses by the Cable & Wireless e-mail
security system - powered by MessageLabs. For more information on a
proactive managed e-mail security service, visit
http://www.cw.com/uk/emailprotection/
>
>The information contained in this e-mail is confidential and may also
be subject to legal privilege. It is intended only for the recipient(s)
named above. If you are not named above as a recipient, you must not
read, copy, disclose, forward or otherwise use the information contained
in this email. If you have received this e-mail in error, please notify
the sender (whose contact details are above) immediately by reply e-mail
and delete the message and any attachments without retaining any copies.
>
This e-mail has been scanned for viruses by the Cable & Wireless e-mail
security system - powered by MessageLabs. For more information on a proactive
managed e-mail security service, visit http://www.cw.com/uk/emailprotection/
The information contained in this e-mail is confidential and may also be
subject to legal privilege. It is intended only for the recipient(s) named
above. If you are not named above as a recipient, you must not read, copy,
disclose, forward or otherwise use the information contained in this email. If
you have received this e-mail in error, please notify the sender (whose contact
details are above) immediately by reply e-mail and delete the message and any
attachments without retaining any copies.
|
