Re: how to write an incident report

[Hank Nussbacher <hank () efes iucc ac il>]

On Fri, 19 Oct 2007, Joe Abley wrote:

> For those who don't recognise the name (presumably many people), Citylink are 
> a disruptive high-speed metro transport provider in Wellington, New Zealand. 
> They run the most elaborate and scary layer-2 switched ethernet network I've 
> ever heard of, and the other week they ran into some problems which caused a 
> prolonged outage.
>
> Here's their writeup:
>
> http://news.clnz.net/2007/10/19#Loopback-Saturday-Discussion
>
> Why don't I have any suppliers like this?

Probably because your suppliers run everything thru their lawyers.  This 
obviously was posted straight via the NOC/OPs group.  They'll continue to 
post incident reports like this until they get hit by their first lawsuit 
by someone similar to "spilling hot coffee on their lap".

"This take somewhat longer than it should have..."

"then we are pretty sure that the measures above (enforcing MAC count 
limits on every port, disabling keepalives on interswitch links, single 
homing all 2950's) will prevent the problem from reoccuring..."

There is enough info in that posting to bury them in frivilous lawsuits.

-Hank