Hi Rob, anything in /etc/cron.daily which would run at or about
midnight? Or any files in /var/spool/cron/crontabs or /etc/cron.d? Or
even a self-re-scheduling "at" job? ("sudo atq" will list any pending jobs)
On 13/03/2023 08:02, rmluglist2--- via Hampshire wrote:
Hi all
I have an Ubuntu box which is on 24/7/365. It has ufw running
allowing nothing from outside my lan.
A couple of times recently, I’ve come in to find the machine locked up
with a lot of disk access (it can be ping’d but I can’t ssh into it
and it doesn’t respond to mouse or keyboard on the console – only
power cycling brings it back). As I say, this has now happened twice
in the last 3-4 nights.
It may have been hacked (but I doubt it looking at kern.log and
auth.log – and I’m behind a NAT router with no ports open). Does
anyone know if Ubuntu (Jammy) does some indexing or some other regular
task overnight? The reason I ask is I’m wondering if it’s said
indexing that’s crashed the (very old) system. It’s fine for a file
server but not really fit for anything else. Incidentally, I’ve
checked crontab and there’s nothing in there.
Anything else I should be checking?
Cheers
Rob
--
Please post to: Hampshire@mailman.lug.org.uk
Web Interface: https://mailman.lug.org.uk/mailman/listinfo/hampshire
LUG URL: http://www.hantslug.org.uk
--------------------------------------------------------------
