CS1000E rebooting every Friday afternoon for past couple weeks

[pbxgirltech]

i have a CS1000E 7.5 that has rebooted every friday afternoon for past couple weeks. I am including a history of the time it happened today below. Anyone else see this happen, or have any ideas as to why?

TTY #13 LD 060 ADMIN 15:57:39 8/8/2014
%
% TIM000 16:00 8/8/2014 CPU 0
%
% ELAN005 Host IP=10.166.82.71 connection failed, no ELAN
% available on the M1 side, or call to rfcCall() failed
%
% ELAN005 Host IP=10.166.82.71 connection failed, no ELAN
% available on the M1 side, or call to rfcCall() failed
%
% ELAN005 Host IP=10.166.82.71 connection failed, no ELAN
% available on the M1 side, or call to rfcCall() failed
%
% SRPT168 PDT: Network socket read error, fd=91, errno=0x36, nbytes=1, rbytes=-1.
%
% SRPT167 PDT: Network peer information (remoteId) get error, fd=91, errno=0x0, parm1=0xff
% ffffff.
%
% SRPT016 OMM: IP link is DOWN between Call Server and IPMG[4 1]
%
% SRPT257 shutDownServerSession: shutting down ssd server session [3] for IPMG [4 1]
%
% CDN003 16 3560 16 05 25
%
% ELAN009 ELAN 0 host IP=10.166.80.18 disabled, write to socket
% fail due to far end disconnect or Ethernet problems
%
% SRPT091 HB: Remote side IPL health change from 12 to 10.
%
% SRPT016 OMM: IP link is DOWN between Call Server and IPMG[4 0]
%
% MSDL300 0 0 4 FROM: ENBL TO: SYS DSBL - NOT RESPONDING
% TIME: 16:05:31
%
% SRPT257 shutDownServerSession: shutting down ssd server session [2] for IPMG [4 0]
%
% SRPT016 OMM: IP link is DOWN between Call Server and IPMG[0 0]
%
% SRPT257 shutDownServerSession: shutting down ssd server session [0] for IPMG [0 0]
%
% MSDL300 0 1 2 FROM: ENBL TO: SYS DSBL - NOT RESPONDING
% TIME: 16:05:37
%
% MSDL300 0 1 3 FROM: ENBL TO: SYS DSBL - NOT RESPONDING
% TIME: 16:05:37
%
% ELAN009 ELAN 0 host IP=10.166.80.17 disabled, write to socket
% fail due to far end disconnect or Ethernet problems
%
% ELAN009 ELAN 0 host IP=10.166.80.15 disabled, write to socket
% fail due to far end disconnect or Ethernet problems
%
% SRPT091 HB: Remote side IPL health change from 10 to 6.
%
% SRPT016 OMM: IP link is DOWN between Call Server and IPMG[0 1]
%
% SRPT257 shutDownServerSession: shutting down ssd server session [1] for IPMG [0 1]
%
% ELAN009 ELAN 0 host IP=10.166.80.16 disabled, write to socket
% fail due to far end disconnect or Ethernet problems
%
% SRPT091 HB: Remote side IPL health change from 6 to 4.
%
% SRPT168 PDT: Network socket read error, fd=70, errno=0x36, nbytes=1, rbytes=-1.
%
% SRPT167 PDT: Network peer information (remoteId) get error, fd=70, errno=0x0, parm1=0xff
% ffffff.
%
% ELAN005 Host IP=10.166.82.71 connection failed, no ELAN
% available on the M1 side, or call to rfcCall() failed
%
% ELAN005 Host IP=10.166.82.71 connection failed, no ELAN
% available on the M1 side, or call to rfcCall() failed
%
% ELAN003 Connection failed, ELAN Server fails to accept new client connection
%
% SRPT091 HB: Local side IPL health change from 12 to 10.
%
% SRPT091 HB: Local side IPL health change from 10 to 6.
%
% SRPT226 Registration has been granted for IP[10.166.80.18] IPMG[4 1]
%
% SRPT077 IPMG[4 0]: Loadware version mismatch detected. Adding to sequential upgrade queu
% e.
%
% SRPT226 Registration has been granted for IP[10.166.80.17] IPMG[4 0]
%
% SRPT091 HB: Local side IPL health change from 6 to 4.
%
% SRPT077 IPMG 4 0:Received an upgrade request. Preparing IPMG for upgrade.
%
% SRPT017 OMM: IP link is UP between Call Server and IPMG[4 1]
%
% SRPT226 Registration has been granted for IP[10.166.80.15] IPMG[0 0]
%
% XMI002 4 1 3 XDLC
%
% CDN002 16 3560 16 07 27
%
% SRPT017 OMM: IP link is UP between Call Server and IPMG[4 0]
%
% XMI002 4 1 2 EXUT
%
% XMI002 4 0 2 XDLC
%
% XMI002 4 0 3 MGATE
%
% XMI002 4 0 4 MGATE
%
% XMI008 4 0 4
%
% SRPT226 Registration has been granted for IP[10.166.80.16] IPMG[0 1]
%
% SRPT017 OMM: IP link is UP between Call Server and IPMG[0 0]
%
% XMI002 0 0 3 XMLC
%
% XMI002 0 0 4 PRI2
%
% SRPT017 OMM: IP link is UP between Call Server and IPMG[0 1]
%
% DTA203 22 0 0
%
% XMI002 0 1 2 PRI2
%
% XMI002 0 1 3 PRI2
%
% XMI002 0 1 4 EXUT
%
% DTA203 24 0 0
%
% DTA203 23 0 0
%
% SRPT091 HB: Local side IPL health change from 4 to 6.
%
% SRPT091 HB: Local side IPL health change from 6 to 8.
%
% DTA102 22
%
% DTA105 22 0
%
% MSDL300 0 0 4 FROM: SYS DSBL - NOT RESPONDING TO: SYS DSBL - SELF TESTING
% TIME: 16:08:07
%
% ELAN014 ELAN 0 host IP=10.166.80.18 is enabled
%
% ELAN014 ELAN 0 host IP=10.166.80.17 is enabled
%
% SRPT091 HB: Local side IPL health change from 8 to 10.
%
% DTA102 23
%
% MSDL300 0 1 2 FROM: SYS DSBL - NOT RESPONDING TO: SYS DSBL - SELF TESTING
% TIME: 16:08:11
%
% DTA105 23 0
%
% DTA102 24
%
% DTA105 24 0
%
% MSDL300 0 1 3 FROM: SYS DSBL - NOT RESPONDING TO: SYS DSBL - SELF TESTING
% TIME: 16:08:13
%
% ELAN014 ELAN 0 host IP=10.166.80.15 is enabled
%
% SRPT091 HB: Local side IPL health change from 10 to 12.
%
% ELAN014 ELAN 0 host IP=10.166.80.16 is enabled
%
% MSDL300 0 0 4 FROM: SYS DSBL - SELF TESTING TO: SYS DSBL - SELFTESTS PASSED
% TIME: 16:08:49
%
% MSDL300 0 0 4 FROM: SYS DSBL - SELFTESTS PASSED TO: ENBL
% TIME: 16:08:49
%
% MSDL300 0 1 2 FROM: SYS DSBL - SELF TESTING TO: SYS DSBL - SELFTESTS PASSED
% TIME: 16:08:55
%
% MSDL300 0 1 3 FROM: SYS DSBL - SELF TESTING TO: SYS DSBL - SELFTESTS PASSED
% TIME: 16:08:55
%
% MSDL300 0 1 2 FROM: SYS DSBL - SELFTESTS PASSED TO: ENBL
% TIME: 16:08:55
%
% MSDL300 0 1 3 FROM: SYS DSBL - SELFTESTS PASSED TO: ENBL
% TIME: 16:08:55
%
% DCH054 DCH: 10 EST CONFIRM TIME: 16:09:21 8/08/2014
%
% DCH054 DCH: 14 EST CONFIRM TIME: 16:09:27 8/08/2014
%
% DCH054 DCH: 15 EST CONFIRM TIME: 16:09:27 8/08/2014
%
% SRPT091 HB: Remote side IPL health change from 4 to 6.
%
% SRPT091 HB: Remote side IPL health change from 6 to 8.
%
% SRPT077 Centralized Software Upgrade complete.
%
% SRPT091 HB: Remote side IPL health change from 8 to 10.
%
% SRPT091 HB: Remote side IPL health change from 10 to 12.
%
% SRPT016 OMM: IP link is DOWN between Call Server and IPMG[4 0]
%
% CDN003 16 3560 16 10 07
%
% SRPT257 shutDownServerSession: shutting down ssd server session [2] for IPMG [4 0]
%
% ELAN009 ELAN 0 host IP=10.166.80.17 disabled, write to socket
% fail due to far end disconnect or Ethernet problems
%
% SRPT091 HB: Remote side IPL health change from 12 to 10.
%
% SRPT091 HB: Local side IPL health change from 12 to 10.
%
% SRPT226 Registration has been granted for IP[10.166.80.17] IPMG[4 0]
%
% SRPT017 OMM: IP link is UP between Call Server and IPMG[4 0]
%
% CDN002 16 3560 16 12 09
%
% XMI002 4 0 2 XDLC
%
% XMI002 4 0 3 MGATE
%
% XMI002 4 0 4 MGATE
%
% XMI008 4 0 4
%
% SRPT091 HB: Local side IPL health change from 10 to 12.
%
% ELAN014 ELAN 0 host IP=10.166.80.17 is enabled
%
% SRPT091 HB: Remote side IPL health change from 10 to 12.
%
% TTY #13 LD 020 ADMIN 16:22:36 8/8/2014
%
% TTY #13 LD 032 ADMIN 16:22:38 8/8/2014
%
% TTY #13 LOGGED OUT ADMIN 16:22 8/8/2014
% SESSION DURATION: 00:50
%

 

[Jeffnortel]

Not seeing the CS reboot but the elan seems to be freaking out. What's 10.166.82.71?

 

[JTDubai]

The Power to ELAN switch may be the reason?
or someone is powering a device which has an ELAN IP connflict?

JT

 

[Wooliepride]

Agree with Jeff and JT.
Doesn't look like a PBX boot issue.
LAN power issue?

 

[bignose21]

Should point out that your media gateway did a loadware upgrade in the middle of all that causing the second reboot. In LD 143 upgmg stat is the mg in a good state? You might get more in the rd logs on the mgc. Just looks like the mgc restarting but you have to question the reason it upgraded, there is a setting in the boot menus to always boot the gold image but this should not really be set unless someone manually set it in the past.

 

[pbxgirltech]

i am still trying to locate what this IP is exactly; but this system has been in for a couple of years, and this starting occurring one Friday a couple weeks ago and then each Friday since?

 

[bignose21]

It looks like all your MGC's are restarting, we have a similar issue and have nailed it down to a network security scan that runs in the weekend, on ours everything else stays up except the MGCs they all reboot, could it be something like that?

 

[allenmac]

I agree with bignose21 above. I would suspect some type of security scan, as those seem to be all the rage these days, especially since it is happening on a somewhat repeatable schedule.

 

[pbxgirltech]

this ip is actually for a scan server as you all mentioned...i am trying to work with network to remove pbx devices from the scan