EZZ8672I

Explanation
 A global TCP stall condition has exited. The global
TCP stall condition is entered for a TCP/IP stack when at least 50%
of active TCP connections are stalled and at least 1000 TCP connections
are active. The global TCP stall condition is exited for a TCP/IP
stack when less than 25% of active TCP connections are stalled or
the number of stalled connections drops to 450 or fewer.
 In
the message text:   date
The date when the global TCP stall condition was exited.
time
The time when the global TCP stall condition was exited.
totalconn
The total number of active TCP connections when the global TCP
stall condition was exited.
stalledpct
The percentage of active TCP connections that were stalled at
the time the global TCP stall condition was exited. A TCP connection
is considered stalled if one or more of the following conditions are
true: The TCP send window size is less than 256 or is less than the
smaller of the largest send window that has been seen for the connection
and the default MTU. The TCP send window size is set based on values
provided by the TCP peer. The default MTU for IPv4 is 576. The default
MTU for IPv6 is 1280.
The TCP send queue is full and data is not being retransmitted.

smallwindowpct
The percentage of active TCP connections that are stalled because
the TCP send window size is less than 256 or is less than the smaller
of the largest send window that has been seen for the connection and
the default MTU. A TCP connection can be stalled due to multiple conditions.
For example, a TCP connection might be included in both the smallwindowpct value
and the writeblockpct value.
writeblockpct
The percentage of active TCP connections that are stalled because
the TCP send queue is full and data is not being retransmitted. If
data is being retransmitted, there might be a network outage. A TCP
connection can be stalled due to multiple conditions. For example,
a TCP connection might be included in both the smallwindowpct value
and the writeblockpct value.
duration
The duration, in seconds, that the global TCP stall condition
was in effect.
action
The action specified in the policy for the Global TCP Stall attack
type. The action parameter can be one of the following
values: resetconn
All stalled TCP connections were reset when the global TCP stall
condition was detected. If you requested detailed syslogd messages
for the Global TCP Stall attack type, message EZZ8673I was generated for each
stalled connection that was reset.
noresetconn
Stalled TCP connections were not reset when the global TCP stall
condition was detected. If you requested detailed syslogd messages
for the Global TCP Stall attack type, message EZZ8674I was generated for each
stalled connection.

correlator
The correlator for a global TCP stall condition. Message EZZ8671I was issued, with the
same correlator value, when the global TCP stall condition was detected.
If you requested detailed syslogd messages for the Global TCP Stall
attack type, message EZZ8673I or EZZ8674I was issued, with the same
correlator value, for each stalled connection.
probeid
The unique identifier of the probe detection point. See the intrusion detection services probeids  in z/OS Communications Server: IP and SNA Codes for a description of the IDS probe IDs.
sensorhostname
The fully qualified host name of the IDS sensor.

System action
 Processing continues.

Operator response
 No action is needed.

System programmer response
 No action is needed.

User response
 Not applicable.

Problem determination
 See the operator response.

Source
 z/OS® Communications
Server TCP/IP: TRMD

Module
 EZATRMD

Routing code
 *

Descriptor code
 *

Automation
 This message is written to syslogd. Automation
on this message will provide you with an indication of when a global
TCP stall attack condition is exited.

Example
  EZZ8672I TRMD Global TCP Stall exited: 06/09/2010 17:11:28.55 totalconn=1000 stalledpct= 25 
smallwinpct= 25 writeblkpct= 10 duration= 312 action= resetconn correlator= 151 probeid= 040B0002 
sensorhostname= HOST1.COMPANYA.COM