I have 6 servers on a WAN, five are in the same tree, one test box is not.

Three of the servers abend within 10-60 minutes (usually about 25
minutes) of being on the network. If they are disconnected from the
network they run rock solid. Sometimes multiple abends and then system
halt, sometimes just a single abend and a system halt.

Two of the abending servers are in the same tree but on different LANs,
the other (my test server) is not. Another server holding the master
replica is on the same LAN as my test server and it remains unaffected.

The abend logs usually indicate server.nlm, sometimes libnss.nlm,
occasionally mxmgr.nlm and ds.nlm. Seems almost random which process is
implicated in the logs. Sorry, I don't have access to the abend logs ATM
but me and a colleague with much expertise in Netware have examined them
closely and they seem inconclusive as to why the abends only occur when
the servers are on the network.

Also have experienced some FAT FS errors which the NOS corrects or I
have corrected from DOS, presumably due to having to hard reset the
boxes. After each restart I have run dsrepair on all servers, sometimes
0 errors, sometimes over 10,000 errors, usually over 100 errors. I
repeat dsrepairs until there are no errors but occasionally a server
will abend and halt during dsrepair unless it is disconnected from the

I have replaced server.exe with a known good copy thinking it may have
been corrupted by hard resets and FAT FS errors, have applied the latest
TCP patch with the results being the same.

This all started this last week when a new high speed backbone WAN
circuit was put in place, failed, and switched back to the old circuit.
That's when the abends began. After the new circuit was successfully
switched to the abends continued. I've had network engineers closely
examine switches, routers and network interfaces for an anomalies that
might account for these abends but nothing conclusive has been discovered.

Additionally, we have had a couple of LAN locations that have shown
indications of worm/virus activity but we've had such situations before
without these results. I am suspicious that these abends might be caused
by a sort of DOS attack from worms but can find no information about
such things as related to Netware boxes, and if that were the case I'd
expect to see some indications of such problems with Apache/Tomcat
services hosted on the affected boxes. Steps are being taken to locate
and disconnect any suspect boxes and the suspect worm like activity has
lessened considerably, yet the server abends continue.

Everything indicates something on the WAN causing the abends, but we
can't find a solid cause nor fathom why only these three servers are
affected. The hardware is very similar (HP Netserver 2000 and 4100
series) but they have run flawlessly for years until this.

My next step is to apply SP4a and NSS patches to my test box, but to be
honest I seriously doubt that this will correct the problem.

Any ideas are certainly welcome and when I return to work I will follow
up with posting the abend logs. I know it seems to obviously implicate
something on the network, worm activity being highly suspect, but as I
said, we've never seen worm activity abend or otherwise affect a Netware
server. Perhaps we've been hit by a newer threat?

Steve N.