Steve M. Fabac, Jr. wrote:
> My clients system has started throwing the following message
> on the system console (retyped from description read over
> the phone):
>
> WARNING: allocb failed - NSTRPAGES exceeded
>
> I read TA116684 on how to debug failures and the
> items on kernel tuning and drivers don't seem to be
> applicable as this just started happening.
>
> 4. Failing hardware
>
> 5. External network hardware misbehaving
>
> 6. Extremely high network traffic
>
> Items 4, 5, and 6 seem to be possible candidates.
>
> The client called today when he simply rebooted the system
> (as that was what I was advising him to do on previous
> occasions) and then the system spontaneously rebooted about
> an hour later.
>
> I connected via SSH to the running system and as I was
> monitoring it, it rebooted again.
>
> I found the following in /usr/adm/syslog:
> Mar 7 14:55:05 vetreal bootpd[1359]: IP address not found: 192.168.160.143
> Mar 7 15:00:53 vetreal TLW param1=-1
> Fri Mar 7 15:00:53 CST 2008 reboot initated
> Mar 7 15:03:44 vetreal syslogd: restart
>
> The two odd things that jump out above is TLW param1=-1
> and "reboot initiated" both at 15:00:53.
>
> Does anyone recognize these two entries that seem to be related?
>
> I've never seen a system log with the message "YYYY reboot initiated"
>
> Checking /usr/adm/syslog:
>
> # grep "2008 reboot initated" /usr/adm/syslog
> Mon Jan 28 13:19:20 CST 2008 reboot initated
> Sat Feb 16 13:35:05 CST 2008 reboot initated
> Mon Feb 25 17:30:05 CST 2008 reboot initated
> Wed Mar 5 16:37:54 CST 2008 reboot initated
> Fri Mar 7 12:38:13 CST 2008 reboot initated
> Fri Mar 7 14:09:16 CST 2008 reboot initated
> Fri Mar 7 14:16:23 CST 2008 reboot initated
> Fri Mar 7 15:00:53 CST 2008 reboot initated
> # grep "2007 reboot initated" /usr/adm/syslog
> Tue May 1 00:04:44 CDT 2007 reboot initated
> # grep "2006 reboot initated" /usr/adm/syslog
> # grep "2005 reboot initated" /usr/adm/syslog
> #
>
> Syslog starts Jan 31 2005.
>
> I see that it has been occurring but not to the level that it
> has today.
>
>
>

Is this on an HP or Compaq system, with the full EFS installed?

I've seen similar things from cpqmon, the EFS health monitor.

But nothing matching that particular entry. Do you have some other HW
monitor installed?

Is 'initiated' really misspelled 'initated' that way? Might be
worthwhile to run strings on binaries looking for 'reboot' or that
particular mis-spelling of initiated.

--
----------------------------------------------------
Pat Welch, UBB Computer Services, a WCS Affiliate
SCO Authorized Partner
Microlite BackupEdge Certified Reseller
Unix/Linux/Windows/Hardware Sales/Support
(209) 745-1401 Cell: (209) 251-9120
E-mail: patubb@inreach.com
----------------------------------------------------