EZZ8666I

Explanation
 The TCP out-of-order queue for the specified connection
is constrained because excessive or old data is accumulating on the
queue.
 In the message text: date
The date when the queue became constrained.
time
The time when the queue became constrained.
connid
The ID of the connection that is associated with the queue that
is constrained.
jobname
The job name of the connection that is associated with the queue
that is constrained.
lipaddr
The local IP address of the connection that is associated with
the queue that  is constrained.
lport
The local port of the connection that is associated with the queue
that is constrained.
ripaddr
The remote IP address of the connection that is associated with
the queue that  is constrained.
rport
The remote port of the connection that is associated with the
queue that is constrained.
trigger
The condition that triggered the queue to become constrained.
This field is one of the following values: DataAge
The constraint was triggered because data remained on the out-of-order
queue for at least 60 seconds.
BytesQueued
The constraint was triggered because a given amount of data remained
on the out-of-order queue for at least 30 seconds. This amount is
configured in IDS policy using one of four abstract queue sizes.

dataage
The age in seconds of the oldest data on the out-of-order queue
when the queue became constrained.
bytesqueued
The number of bytes queued on the out-of-order queue when the
queue became constrained.
queuesize
The configured abstract queue length for the TCP Queue Size IDS
attack type. Possible values are: VS - very short
S - short
L  - long
VL - very long

correlator
The correlator for a constrained queue condition. The correlator
can be used to locate the entry and exit log messages for an event
that was caused by a constrained TCP queue. Message EZZ8667I is issued,
with the same correlator  value, when the queue exits the constrained
state.
probeid
The unique identifier of the probe detection point. See the intrusion detection services probeids  in z/OS Communications Server: IP and SNA Codes for a  description of the IDS probe IDs.
sensorhostname
The fully qualified host name of the IDS sensor.

System action
 Processing continues.

Operator response
 Determine why the local application had excessive
or old data on the out-of-order queue. Excessive or old data on the
out-of-order queue might be the result of a remote application sending
partial data either as an attack or because of a problem with the
remote application. Excessive or old data might also be the result
of a network problem that prevented data that was sent by the remote
application from reaching its destination.

System programmer response
 No action is needed.

User response
 Not applicable.

Problem determination
 See the operator response.

Source
 z/OS® Communications
Server TCP/IP: TRMD

Module
 EZATRMD

Routing code
 *

Descriptor code
 *

Automation
 This message is written to syslogd. This message
is a good candidate for  automation. Automation can alert you when
the TCP out-of-order queue for a  connection enters a constrained
state. Message EZZ8667I is issued, with the same correlator value,
when the queue exits the constrained state.

Example
  EZZ8666I TRMD TCP out-of-order queue constrained entry logged: 06/09/2010 17:11:28.55 connid= 00000125 
jobname= USER15 lipaddr= 4.4.4.4 lport= 1165 ripaddr= 7.7.7.7 rport= 5000 trigger= DataAge dataage= 60 
bytesqueued= 576 queuesize= S correlator= 137 probeid= 040A0007 sensorhostname= HOST1.COMPANYA.COM