Skip to main content
  • Subscribe by RSS
  • Ex Libris Knowledge Center

    Primo MT EU01 - March 9th 2016

    Confidential Information, Disclaimer and Trade Marks


    This document serves as a Root Cause Analysis for the Primo MT EU01 service interruption experienced by Ex Libris customers on March 9th, 2016.


    The goal of this document is to share our findings regarding the event, specify the root cause analysis, outline actions to be taken to solve the downtime event, as well as preventive measures Ex Libris is taking to avoid similar cases in future.

    Event Timeline

    Service interruption was experienced by Ex Libris customers served by the Primo MT EU01 instance at the Europe Data Center during the following hours: 


    March 9th, 2016 from 5:38 PM until 7:02 PM Amsterdam timezone


    March 9th, 2016 from 8:09 PM until 8:59 PM Amsterdam timezone


    March 9th, 2016 from 10:09 PM until 11:41 PM Amsterdam timezone


    During the event, the service was slow and became unavailable at times for the environment.

    Root Cause Analysis

    Ex Libris Engineers investigated this event to determine the root cause analysis with the following results:


    Ex Libris engineers had identified a “Denial of Service (DoS)  attack that had been directed to a specific function in the system.


    Previous DoS attacks had been directed to searches – and several code changes were done to prevent that from happening. This new type of attack has not been identified before.

    Technical Action Items and Preventive Measures

    Ex Libris has taken the following action and preventive measures to avoid such an occurrence in future:


    • Ex Libris engineers have identified the immediate solution for the problem and future DoS attacks with the new phenomena will be identified and cleared quickly.
    • Code changes in future releases will address the problem and prevent it from impacting the system.  

    Customer Communication

    ExLibris is committed to providing customers with prompt and ongoing updates during Cloud events. Ongoing and prompt updates on service interruptions appear in the system status portal at this address: