Richard, I'd be looking for a coordinated denial-of-service attack, perhaps 
launched from a group of hacked backup client systems. Start looking for 
unusual activity in logs on your networking systems such as firewalls.

Roger Deschner
University of Illinois at Chicago
"I have not lost my mind; it's backed up on tape somewhere."

________________________________________
From: ADSM: Dist Stor Manager <ADSM-L AT VM.MARIST DOT EDU> on behalf of 
Rhodes, Richard L. <rrhodes AT FIRSTENERGYCORP DOT COM>
Sent: Saturday, April 21, 2018 17:44
To: ADSM-L AT VM.MARIST DOT EDU
Subject: Crashing TSM instances at 17:0x:xx

Hi Everyone . . .

Very strange things happening!

All TSM's are v7.1.5.

Friday, shortly after 17:00, two tsm instances crashed.
  tsm7 at 17:00:52
  tsmsap2 at 17:03:01

Saturday, shortly after 17:00, three instances crashed.
  tsm8 at 17:01:39
  tsm9 at 17:02:38
  tsm6 at 17:03:02

no core dump
nothing in the AIX errpt
the actlog just stops - no indication of any problem
  (although one instance handles storage agents and complained about com 
problems to them before dying)
next msgs in actlog is the startup msgs
all instances have been up for a long time, but not sure now long
they come back up just fine

Any thoughts are appreciated!
We will get a case opened with IBM, but thought I'd ask here also.


Thanks!

Rick




------------------------------------------------------------------------------

The information contained in this message is intended only for the personal and 
confidential use of the recipient(s) named above. If the reader of this message 
is not the intended recipient or an agent responsible for delivering it to the 
intended recipient, you are hereby notified that you have received this 
document in error and that any review, dissemination, distribution, or copying 
of this message is strictly prohibited. If you have received this communication 
in error, please notify us immediately, and delete the original message.