Lost Network Connection to Server - Again - What should I check

[flambot]

Greetings,

 

This is perhaps part of this post https://lime-technology.com/forum/index.php?topic=47358.0

 

No weird Bios messages this time, but while watching a show again (via HTPC), the video on screen froze again. I checked my server via SMB shares under "Network Places" and I couldn't access it. Nor could I access it via the GUI.

 

I could however "Ping" it and I could get a reply. I could also see that it had a network address via ifconfig at the cmdline. I rebooted the router. That didn't do anything. I ended up rebooting the server and that got the connection back up again.

 

So what should I be looking for?? This is the second time it has done it (It's never done it in the past) - so something is obviously amiss. I did notice that ifconfig eth0 shows some packets dropped? Is this normal?

 

I couldn't see anything in the log. I have included it here, but I cut off the shutdown part to get the space down in the file.

 

Hope to get to the bottom of it.

 

Thanks.

syslog-.txt

[RobJ]

No need to cut it, just zip and attach - they compress very small.

A few packets dropped are probably not an issue, only if a large number are.

I'd recommend trying an Intel network card, disabling the onboard Realtek, and see if that helps.

In v6, the diagnostics have a lot more info available for us, including the ps report.  If you can next time, try to obtain a ps -ef report.

[flambot]

No need to cut it, just zip and attach - they compress very small.

I realised this after I had uploaded the cut version DOH!!

A few packets dropped are probably not an issue, only if a large number are. I'd recommend trying an Intel network card, disabling the onboard Realtek, and see if that helps.

How many packets would be a lot? Currently, of 214000 odd packets it shows 405 have dropped. And...I do have an Intel netwrok card - the onboard one died some time back.

If you can next time, try to obtain a ps -ef report.

I tired this ps -e thingee and it displayed a long list on stuff. I am assuming I do this after the issue? What is the best way to get it to a file? Via outty (cut&Paste)?

 

I've been trying to understand why the SMB shares would go down (permissions??) I can't access them via my own puter, but I can ping the server - which is odd. It's also a pain rebooting the router doesn't reset the issue.

 

This is a first for me - losing the shares - but still having a ping connection to the server. There are lots of things in the chain (HTPC, 2x network switch, router and server). But because I can't access the SMB shares on the server, I guess it is a server issue??

 

Finally, I just found a "Processes" link in the V5 Gui that looks a lot like the ps -e output?

 

Thx for the help

[Helmonder]

The fact that you can still ping is not weird. Its a layered architecture.

 

First you've got your network layer (which provides answers to the ping)

 

Then you have a layer on top of that, that provides SMB shares (or NFS, or appletalk).

 

The fact that you can still ping but shares are gone most probably means that your smb daemon has died. Since you are running V5 this means that your system cannot use more then 4gb in memory which is not a lot.. 

 

Check your log for out of memory errors and stuff related to smbd ..

[RobJ]

A few packets dropped are probably not an issue, only if a large number are. I'd recommend trying an Intel network card, disabling the onboard Realtek, and see if that helps.

How many packets would be a lot? Currently, of 214000 odd packets it shows 405 have dropped. And...I do have an Intel netwrok card - the onboard one died some time back.

This is something to check, as your syslog of 3-14 shows no evidence at all of an Intel card, only a Realtek one, using the standard r8169 driver.  405 drops is not great, but OK for an Intel card (which is not visible though), but rather unusual for a Realtek.  But don't know what to make of it without other info.  Try the command lspci -vnn >/boot/lspci.txt, which will save a report on your flash drive about your PCI devices (and please attach it).  You should be able to see the Realtek/Intel cards, and their address.

 

If you can next time, try to obtain a ps -ef report.

I tired this ps -e thingee and it displayed a long list on stuff. I am assuming I do this after the issue? What is the best way to get it to a file? Via outty (cut&Paste)?

 

I've been trying to understand why the SMB shares would go down (permissions??) I can't access them via my own puter, but I can ping the server - which is odd. It's also a pain rebooting the router doesn't reset the issue.

 

This is a first for me - losing the shares - but still having a ping connection to the server. There are lots of things in the chain (HTPC, 2x network switch, router and server). But because I can't access the SMB shares on the server, I guess it is a server issue??

 

Finally, I just found a "Processes" link in the V5 Gui that looks a lot like the ps -e output?

I'm not terribly experienced with the ps command myself, but was hoping that you might see in one of the columns something that is hogging an unusual amount of memory, or using an unusually high amount of CPU, or has been forking over and over (a process name that is repeated numerous times).

[flambot]

The fact that you can still ping is not weird. Its a layered architecture.

 

First you've got your network layer (which provides answers to the ping)

 

Then you have a layer on top of that, that provides SMB shares (or NFS, or appletalk).

 

The fact that you can still ping but shares are gone most probably means that your smb daemon has died. Since you are running V5 this means that your system cannot use more then 4gb in memory which is not a lot.. 

 

Check your log for out of memory errors and stuff related to smbd ..

 

Thx for this. I didn't know that's how things work.

[flambot]

This is something to check, as your syslog of 3-14 shows no evidence at all of an Intel card, only a Realtek one, using the standard r8169 driver.  405 drops is not great, but OK for an Intel card (which is not visible though), but rather unusual for a Realtek.  But don't know what to make of it without other info.  Try the command lspci -vnn >/boot/lspci.txt, which will save a report on your flash drive about your PCI devices (and please attach it).  You should be able to see the Realtek/Intel cards, and their address.

 

I can't guarantee it's an intel. I'm pretty sure it was this card https://www.ascent.co.nz/productspecification.aspx?itemID=366099

 

Trying this cmd "lspci -vnn >/boot/lspci.txt" says "Command not found"

 

I'll give the ps cmd a go next time it happens.

 

Do you think this is definitely a server problem, or could something else be causing this? Both times it happened shortly after waking my HTPC from sleep and starting a video (some minutes after through).

[RobJ]

This is something to check, as your syslog of 3-14 shows no evidence at all of an Intel card, only a Realtek one, using the standard r8169 driver.  405 drops is not great, but OK for an Intel card (which is not visible though), but rather unusual for a Realtek.  But don't know what to make of it without other info.  Try the command lspci -vnn >/boot/lspci.txt, which will save a report on your flash drive about your PCI devices (and please attach it).  You should be able to see the Realtek/Intel cards, and their address.

 

I can't guarantee it's an intel. I'm pretty sure it was this card https://www.ascent.co.nz/productspecification.aspx?itemID=366099

It's a TP-Link 3269, a PCI card based on the Realtek 8169SC chipset (you can see it in a picture of the card).  That may be better than onboard Realteks, possibly bigger buffers.  But it doesn't offload the workload like the Intels do.

 

Trying this cmd "lspci -vnn >/boot/lspci.txt" says "Command not found"

Sorry, I forgot this was v5 and lspci wasn't available then.  Really wish you were on v6, the diagnostics package has ALL the info we needed. 

 

Do you think this is definitely a server problem, or could something else be causing this? Both times it happened shortly after waking my HTPC from sleep and starting a video (some minutes after through).

I don't know.  Waking from sleep is often problematic, but yours did work for a few minutes.

[flambot]

Rob,

 

I couldn't tell one electronic thingee from another  as far as the card is concerned. The card has been working fine. This "video freeze" is a new thing - twice in one week. The onboard realtek nic worked fine since 2007 (it died last year). I seem to get more issues with the router. I've had several over the years - the latest came with an ISP package - not as good as some of the others I've had - but the price made the deal too good to miss out on.

 

The previous router allowed me to reserve an IP address (which I set for a static server one). A static IP caused me issues with the new router (the server sometimes started without an IP), so I switched to dchp and it's been fine.

 

I never grew up with computers - came to them late in life - so I struggle to understand a lot of it. I try, but I don't have the underlying knowledge you get when you grow up with them. I see kids today doing all sorts of amazing stuff with them  .  I've acepted I'll never have that understanding. C'est la vie!

 

So far I've managed to sort my issues (with some stress  :'( ).

 

Probably my biggest probelm is knowing where to look for the problem - and what questions to ask using the correct terminlogy. A lot of it takes oodles of time - something I just don't have with all ones responsibilites.

 

Really appreciate the help. Some hand-holding is definitely needed on my end 

 

I haven't upgraded to V6 because V5 does everything I need - and upgrading and changing things makes me break out in a cold sweat!

[RobJ]

Wish we could have solved it!  If it happens again, try and get a ps report, either a screen capture of that Processes page or a ps report file ->  ps  -ef  >/boot/ps.txt  *Maybe* we'll find a clue there.

[flambot]

Wish we could have solved it!  If it happens again, try and get a ps report, either a screen capture of that Processes page or a ps report file ->  ps  -ef  >/boot/ps.txt  *Maybe* we'll find a clue there.

Thx Rob,

Lets hope it was actually a "ghost in the machine" that has now gone away

 

I got better things to do than isolate a network issue  . It's always nice to suss something out though - especially when one is a little scared of it 

 

Thx again for the help. Should there be a next time..."I'll be back!.." but without the muscles