ACS Tacacs Log and Max sessions error

[cdellis]

Has anyone ever seen this in the TCS log on an ACS 3.0 NT box?

TCS 01/13/2003 15:38:05 A 1672 0081 Note: The maximum 40 sessions are busy. If the system is consistently under load you may wish to increase the number of sessions. (This is a registry configurable setting SOFTWARE\Cisco\CiscoAAAv3.0\CSTacacs\MaxSessions. The service will need to be restarted for the change to take effect.)

ANy pointers would help! What is the max value of this registry entry? 255?

[gfullage]

Yep, seen this many times on a busy server. Basically the default number of threads the CSTACACS service gets is 40, which basically means there can be 40 outstanding sessions (authentication, authorization or accounting) going on at any one time.

I would double it first off and see how you go. Also, if you're using single-connection, take that off cause that holds open connections (threads) for a long time.

[cdellis]

Thanks for the reply!!

Since you are the only person that has been able to tell me what that reg key was for I am going to ask another question.

Have you ever seen these messages in the RDS.log file? dea1jrx is a username...

RDS 01/13/2003 10:06:22 E 2215 0179 Error -16 authenticating dea1jrx - no NAS response sent

RDS 01/13/2003 10:06:23 E 1251 0389 Server too busy - request from 10.159.192.130 ignored

[gfullage]

Hmmm, can't say I've seen that before. Did a searhc of old cases for "server too busy" and didn't find anything either, so doesn't look like it's to common. Just looking at it though it looks to be related to the similar problem you were having with the CSTACACS process.

There's similar registry keys for the CSRadius process under the same registry location (although replace CSTacacs with CSRadius), you could try changing AuthThreads and AcctThreads to something higher and see how that goes. Would it be possible that you have more than 50 Radius srequests coming in at once though? If not, then it's probably not necessary to do the registry fix and we'll need to look elsewhere.

[cdellis]

It is very possible that there are more than 50 RADIUS requests at one time...

I will adjust the registry values and see how that affects the logs.

Thanks!