Four servers abended within a few seconds of each other. All referenced
btcpcom.nlm [see Item 1 for part of abend message.] All were updated from
NetWare 5.1 to Netware 6.5sp4 within the last two weeks. File systems of
two of the servers (workstation class prototyping servers) were all NSS; the
other two (production Proliant ML370s) were all trads.

The only TID I found that seemed to apply was TID 2966492 [see Item 2],
which was a 2003 TID on abends caused by Nessus or other port scanners. The
organization is known to do port scanning regularly.

The file recommended in the TID was from 2003 for NetWare 6 and lower [see
Item 3].

The current btcpcom.nlm is version 7.90 from 2001.

BTCPCOM.NLM BTCPCOM.NLM v7.90.000, Build 230
Version 7.90 March 20, 2001


Do you have any other reasonable explanation for the abends based on the
info I've given?

If not, should I use the 2003 btcpcom.nlm?

Is there anything else you would suggest?

Thanks

pvz




***Item 1***
Novell Open Enterprise Server, NetWare 6.5
PVER: 6.50.04

Server LSU-DOCE-SERV halted Monday, October 3, 2005 4:00:44.980 pm
Abend 1 on P00: Server-5.70.04-1937: CPU Hog Detected by Timer

Registers:
CS = 0060 DS = 007B ES = 007B FS = 007B GS = 007B SS = 0068
EAX = FBF17BC3 EBX = 000001FC ECX = 00000028 EDX = 8BABD122
ESI = 8BABD27E EDI = 8BABD27E EBP = 8BABD120 ESP = 8B076344
EIP = 00000000 FLAGS = 00000002


Running process: BTCPCOM.NLM 7 Process
Thread Owned by NLM: BTCPCOM.NLM
Stack pointer: 8B076314
OS Stack limit: 8B0703E0
Scheduling priority: 67371008
Wait state: 5050030 Blocked on Semaphore
Stack: --FBF17BC3 ?
8AAF00FD (BTCPCOM.NLM|GetBCommStats2+2751)
--8BABD122 ?
--00000007 ?
--00000000 ?
--8BABD122 ?
--00000000 ?
--00000000 ?
8AAED314 (BTCPCOM.NLM|(Code Start)+314)
--8ADD2A80 ?
--81EED5C0 ?
8AAED3F6 (BTCPCOM.NLM|(Code Start)+3F6)
--8BABD100 ?
--8BABD100 ?
8AAED314 (BTCPCOM.NLM|(Code Start)+314)
--87C0E7E0 ?
80549306 (THREADS.NLM|getcmd+21E)
--00000000 ?
--3F9EC93E ?
8CC00000 (STATUSLG.NLM|SL_unisize+9BD0)
--00000246 ?
--8B06F0E0 ?
--00000000 ?
80549144 (THREADS.NLM|getcmd+5C)
--8A479D40 ?
--00000000 ?
8054913C (THREADS.NLM|getcmd+54)
--8A479D40 ?
--00000000 ?
--8B06F0E0 ?
--00000000 ?
--8B06F0E0 ?
-80563750 (THREADS.NLM|(Data Start)+2750)
00225408 (SERVER.NLM|TcoNewSystemThreadEntryPoint+40)
--8B06F0E0 ?
--00000000 ?
--00000000 ?
--00000000 ?
--00000000 ?
--00000000 ?
--13B00000 ?
--0000E8A5 ?
--019B8DC3 ?
--008C1FAE ?
--00B2D14E ?
--0CAE0036 ?
--34343434 ?
--00000000 ?
--E03A46A5 ?
8E1C0000
(OWCIMOMD.NLM|_ZSt10__copy_ni1IN9__gnu_cxx17__norm al_iteratorIPtSt6vectorItS
aItEEEES6_ET0_T_S8_S7_11__true_type+166)
--2BF2019B ?
--4DC5008C ?
0036254A (SERVER.NLM|kdb50LineDestructor+36)
--09E5FFFF ?
--00000000 ?
--D5EC0000 ?
--0000D3B5 ?
--019B8E80 ?
--008C362B ?
--0A581A13 ?
--09070036 ?
--0000089C ?
--00000000 ?
--4EF64623 ?
--8EE40000 ?
--3F1B019B ?
--320B008C ?
0036C188 (SERVER.NLM|PatchArea+20)
--049B02B3 ?
--00000000 ?
--E9810000 ?
--00009B91 ?
--019B8F48 ?
--008C440A ?
--D1C8D8EC ?
--FFFF002F ?
--0000104D ?
--00000000 ?
--D974AD73 ?
--8FAC0000 ?
--54A4019B ?
--1357008C ?
00339316 (SERVER.NLM|SetTempBreakpoint+7A)
--0360FFFF ?
--00000000 ?
--1B420000 ?
--0000614A ?
--019B9009 ?
--008C5855 ?
--68C3CEAA ?
--0A9D0024 ?
--00000F9F ?
--00000000 ?
--2B9D8060 ?
906A0000 ?
--6836019B ?
--268E008C ?
002B18F1 (SERVER.NLM|UnloadModuleFromAddressSpace+13ED)
--03BFFFFF ?
--00000000 ?

Additional Information:
The NetWare OS detected a problem with the system while executing a
process owned by SERVER.NLM. It may be the source of the problem or there
may have been a memory corruption.

===========================================


***Item 2***
TID 2966492

This document (2966492) is provided subject to the disclaimer at the end of
this document.
Associated File

Click the filename to download: btcpcom.exe 131882 bytes 11Jul2003 06:42AM
Abstract

This download file contains a field test version of BTCPCOM.NLM. This fixes
a CPU Hog Timeout Abend that occurs when running a port scanning utility
against a NetWare Server.
Installation Instructions

When the file is extracted, there will be two folders called v7.9 and v8.1.
On your server console, type MODULES BTCPCOM.NLM and note the version you
have installed. Apply the appropriate fix.

All files should be copied to the SYS:\SYSTEM directory.


======================================
***Item 3***
Description of patch btcpcom.exe

NetWare 5.1, NetWare 6, Novell Small Business Suite 5.1, Novell Small
Business Suite 6

Beta Patch BTCPCOM CPU Hog ABEND Fix 11 Jul 2003 128K bytes

This download file contains a field test version of BTCPCOM.NLM. This fixes
a CPU Hog Timeout Abend that occurs when running a port scanning utility
against a NetWare Server.