From: twotone@rio.engr.washington.edu
Newsgroups: comp.sys.hp
Subject: Network error found using nettl
Date: 6 Oct 92 19:23:03 GMT
Article-I.D.: u.1992Oct6.192303.14272
Followup-To: email, comp.sys.hp
Organization: Quinton Instruments, Seattle


I have question for anyonye who knows anything about the Network tracing and
logging program, nettl.

I have been experiencing some performance problems with our HP 9000/ 720, HP-UX
8.05 over our ethernet network. On occasion, any Xterminal connected to the
host will hang for 15 - 60 seconds. This has not been happening on our other
machines to the same extent or in the same manner. Only the X-terms logged
onto the one machine experience the problem, i.e. it doesn't seem to be an
external network event.

Using a network analyzer (very primitive one) I have observed a dead area in the
packet trace from this host at the time an error like this occurs. Basically,
no packets are transmitted for about the length of time of the hang.

Another observation was made during these symptoms using netstat to trace
packet statistics. I ran the command 'netstat 60' and obtained the following
output:

    input   (ni0)     output            input  (Total)    output
 packets  errs  packets  errs colls      packets  errs  packets  errs colls
       0     0        0     0     0    26312     1    27030     0   347
       0     0        0     0     0     2488     0     3362     0    17
       0     0        0     0     0     2263     0     2975     0     8
       0     0        0     0     0      937     0     1402     0     2
       0     0        0     0     0     2805     0     3638     0    21
       0     0        0     0     0   -23516    -1   -25624     0  -208 
       0     0        0     0     0     8227     0     8117     0    24
       0     0        0     0     0     6130     0     4269     0    11
       0     0        0     0     0     3622     0     5010     0     5

The line with the negative values corresponded to the exact minute of the 
hang.

Determined to gather more information on the problem, I dug deep into the HP
manuals and figured out how to use the tracing and logging program, nettl.
After some messing around, I came up with some important information. By default
nettl is started in /etc/netlinkrc, '/etc/nettl -start' so I just added some
additional logging by executing 'nettl -log w e -entity all'. w and e 
correspond to WARNING and ERROR logging. Then, using the netfmt command I was 
able to observe an error logged again at the exact time as the symptom (xterm
hang). 'netfmt -f /usr/adm/nettl.LOG00' returns the following:

Oct 02 11:25:53.72041: Network LAN Error 2005, pid [ICS]
   *** Unknown log event

Oct 02 12:58:44.72068: Network LAN Error 2005, pid [ICS]
   *** Unknown log event

Incidently, the output of netstat (as shown above) again retured this strange
negative value for packet i/o at the same moment the nettl error was logged.

To wrap up things, since the HP service guy that's comming out today isn't
familiar with nettl, I thought I'd try and find some answers while we're busy
swaping CPU boards. 

If anyone has any ideas I'd appreciate to hear them. Thanks,


Anthony King
sys adm
Quinton Instruments, Seattle
twotone@ee.washington.edu