IP OFFICE REBOOTING AUTOMATICALLY EVERY WED AT 9:50 (+- a few secs every week)

[gr7131rg]

installed an avaya ip office rel 8.1.(43) a few months ago and worked fine however since about a month, every wednesday it reboots at around 09:50HRS i have checked and cant see what the problem may be, can anyone help.

i have looked on the audit trail and sysmon the error i am getting is : Termination Cause:<DSI Excep>009d0732

 

[amriddle01]

Do you have anything programmed that runs on a weekly cycle i.e time profiles?


Avaya Implementation Qualified Professional Specialist Technical Engineer (AIQPSTE)

 

[hairlessupportmonkey]

You can also try moving it to the latest 8.1 release

ACSS - SME
General Geek

 

[mattKnight]

Admittedly, it was an old old Network Alchemy box, but I had a similar issue with reboots happening at a precise time of day. It turned out to be SNMP polling - so don't limit your investigations to just the IP Office.

A wireshark sniff and a full sysmon trace may well provide some information. The DSI EXCEP line is pretty much undecipherable and is pretty much the same as the "Windows has detected a fatal error and has shutdwon" box...

Take Care

Matt
I have always wished that my computer would be as easy to use as my telephone.
My wish has come true. I no longer know how to use my telephone.

 

[gr7131rg]

this never happend until the IP office was connected to the customer network, My feeling is that the customer network is at fault and this ties in well with the SNMP Polling sugestion (Thanks Matt) not very familiar with SNMP but i will try and find out.

 

[gr7131rg]

Avaya and the Qualysguard scanning service.this is what created the problem,,,,, anyone have any suggestion on how to solve it ?? other than removing the ip office from the customer lan

 

[amriddle01]

Surely they can exclude the Avaya's address from the Qualysguard scanning service? It is that service causing the issue so that's what needs to be altered to solve this, there is nothing you can do on the IPO about this, and I doubt Avaya will even consider doing anything about it either


Avaya Implementation Qualified Professional Specialist Technical Engineer (AIQPSTE)

 

[hairlessupportmonkey]

bat it straight back into the customers court!

ACSS - SME
General Geek

 

[mattKnight]

> It is that service causing the issue

Whilst I don't doubt that the Qualsys scanner "causes" the issue - it seems to have found a fatal (or at least one that causes a reboot - a potential DOS) vulnerability within the IP office. Perhaps reviewing the Qualsys logs might be of advantage - for example it might highlight asconfiguration tweak that mat help (turning off HTTP / TFTP for example).

Likewise, it is probably worth reporitng to Avaya as a vulnerability.

Take Care

Matt
I have always wished that my computer would be as easy to use as my telephone.
My wish has come true. I no longer know how to use my telephone.

 

[DrDrayAvaya]

firewall it off perhaps, just open the ports you need open, do it linux style, lock all and open one at a time
wireshark trace same time if you SPAN port with Avaya LAN will show pretty quick what last dying messages were!