Editing Tornedo.tetrain.com Upgrade Plan (section)

=== 11.2 Result: traffic to tornedo is current and substantial, not near zero — target not met ===

63 distinct IPs hit tornedo in the 36.5h window, most with '''timestamps in the last few minutes before the log snapshot was taken''' (i.e. essentially live at time of check), at volumes (~100- 160 connections per host over the window) consistent with normal periodic SSSD traffic, not stragglers. This is the opposite of the "traffic near zero, sustained" target set for Phase 3.

'''Group A — fully migrated (tornedo stale/absent, ipa current): safe.''' <code><nowiki>koha.tetra.in</nowiki></code>, <code><nowiki>li2028-191</nowiki></code>/<code><nowiki>li2092-64</nowiki></code>/<code><nowiki>li2095-168.members.linode.com</nowiki></code>, <code><nowiki>mail.sceh.net</nowiki></code>, <code><nowiki>mail.sysnetglobal.com</nowiki></code>, <code><nowiki>mail.tetra.in</nowiki></code>, <code><nowiki>mail.isonemployees.com</nowiki></code>/<code><nowiki>single.tetra.in</nowiki></code>/ <code><nowiki>zm.isonemployees.co.za</nowiki></code> (shared IP), <code><nowiki>mbox1.mysecuremail.email</nowiki></code>, <code><nowiki>mbox2.mysecuremail.email</nowiki></code>, <code><nowiki>php-devel-1.tetra.in</nowiki></code>, <code><nowiki>relay.isgec.com</nowiki></code>, <code><nowiki>upyog.tetrain.com</nowiki></code>, <code><nowiki>zm.wbtea.com</nowiki></code>, <code><nowiki>zurt-ison.mysecuremail.email</nowiki></code>, <code><nowiki>zurt-sysnet.mysecuremail.email</nowiki></code>, <code><nowiki>devel-isonbpo-ihelpdesk.tetra.in</nowiki></code>. Confirms the two client-flagged "stragglers" <code><nowiki>mbox2.mysecuremail.email</nowiki></code> and <code><nowiki>devel-isonbpo-ihelpdesk.tetra.in</nowiki></code> are indeed resolved.

'''Group B — dual-hitting, still transitional:''' <code><nowiki>cloud-storage.tetra.in</nowiki></code>, <code><nowiki>ihelpdesk-belpoc.tetra.in</nowiki></code>, <code><nowiki>www.mobilepedia.in</nowiki></code>, <code><nowiki>nextcloud.tetra.in</nowiki></code>, <code><nowiki>tetra-demo2.tetrain.com</nowiki></code>, <code><nowiki>www.tetrain.com</nowiki></code>, <code><nowiki>zurt.tetrain.com</nowiki></code> — hitting both servers currently, ipa share growing but not yet exclusive. Not blockers, but not done either.

'''Group C — tornedo-only or tornedo-dominant, live right now — hard blockers:''' <code><nowiki>app-1.tetrain.com</nowiki></code>, <code><nowiki>mail.energoconstruction.com</nowiki></code>/<code><nowiki>mail.energoproducts.com</nowiki></code> (shared IP), <code><nowiki>nic.tetra.in</nowiki></code>, <code><nowiki>server-relay.tetrain.com</nowiki></code>, <code><nowiki>server-relay-2.tetrain.com</nowiki></code>, <code><nowiki>indorama-relay.tetrain.com</nowiki></code>, <code><nowiki>app.brijraj.in</nowiki></code>, <code><nowiki>tetra-demo.tetrain.com</nowiki></code>, <code><nowiki>cloud-storage.triburg.co.in</nowiki></code>, and — '''important discrepancy''' — <code><nowiki>mail.tetrain.com</nowiki></code>/ <code><nowiki>zimbra-test.tetra.in</nowiki></code> (shared IP <code><nowiki>139.84.171.188</nowiki></code>): 161 live connections to tornedo vs. a single stray hit on ipa 13+ hours ago. This one was on the client's "confirmed closed" list for Phase 1 but the log data says it has '''not''' cut over — worth a direct re-check on that host's <code><nowiki>sssd.conf</nowiki></code>/<code><nowiki>krb5.conf</nowiki></code> before trusting it as closed.

'''Group D — active clients hitting tornedo that aren't in the 50-host inventory at all:''' <code><nowiki>server-relay-1.tetra.in</nowiki></code> (52.199.95.254), <code><nowiki>mail.prime-sdec.com</nowiki></code> (111.93.232.170), an Airtel static/NAT IP (182.72.51.106), two bare AWS EC2 IPs with no reverse hostname (3.6.120.132, 3.111.216.210), and one IP that timed out on reverse lookup (139.84.143.206) — all with live, recent, regular (~100-150 count) traffic. These need identifying and adding to inventory before decommission, since they're real current dependents we don't otherwise have visibility into.

'''Background noise, not decommission-relevant:''' <code><nowiki>172.26.27.51</nowiki></code> (private VPC IP, highest count of all at 250 — almost certainly <code><nowiki>ipa.tetrain.com</nowiki></code>'s own replication connection to tornedo over the internal network, expected until topology is formally torn down in a later phase); <code><nowiki>127.0.0.1</nowiki></code>/<code><nowiki>::1</nowiki></code> (local health checks); <code><nowiki>65.20.78.116</nowiki></code> (old <code><nowiki>ipa8.tetrain.com</nowiki></code> IP, last seen 16h+ before window close — dead, matches its decommission); <code><nowiki>13.232.220.151</nowiki></code> (old <code><nowiki>ipa.tetrain.com</nowiki></code> IP pre-cutover, 1 stray hit); ~15 single/low-count IPs from Jul 22-23 consistent with the SSH-brute-force scanning residue documented in section 10, not real IPA clients.