Well, we should probably stop doing anything until #1 is resolved :-), but I'll give you some follow-ups anyway...

> 1. It apparently started in June or July. We were not made aware of
> it until this month. I say "apparently" because we have not been
> getting the full story.


Ah! Herein lies the crux of the problem.  If they want you to fix something, they *need* to give you the full story, otherwise you're spinning your wheels, wasting your time and theirs when complete information could significantly speed up the process.

Once you get the full story (and a semi-solid start date) getting the information about what changed in the month preceding the start date would be helpful.  And no matter what everyone tells you, *something* changed...I suppose it's left as an exercise for the user to figure out who is lyi...err...being forgetful. :-)

> 2. There were no changes that we were made aware of, we usually
> don't know about changes to the network until something breaks,
> until we installed z/VM 5.2 in August, after at least 2 occurrences.  


Here's where you have to go to whomever administers the network and firewall and get the information from them.

Did you move from 5.1 to 5.2? or were you on some other release? Have the symptoms gotten better or worse since the 5.2 install (again, check with whomever is seeing the problem)?

> 3. They do not. The ones monitoring the logs are InfoSec people, not
> network folks.


The firewall logs don't have the packet data in them?  If not, talk to firewall folks and see if they can do something about having the firewall gather packet data the next time this problem occurs.

Anyway, I'd say you're still several answers short of a good place to start digging.  Hopefully getting decent information from the other parties involved won't be *too* painful.

Regards,
Miguel Delapaz
z/VM TCP/IP Development

Reply via email to