----- Original Message -----
From: "Magnus J" <[EMAIL PROTECTED]>
To: "Brent Wiese" <[EMAIL PROTECTED]>
Cc: <[EMAIL PROTECTED]>
Sent: Friday, August 15, 2003 10:44 AM
Subject: RE: Server rebooted at 3 a.m. and 7 a.m. for the past few days


> Hello
>
>
> dmesg shows no panic, and nothing that consumes much CPU has
> been running since the first reboot.
> Around 3 a.m. the daily periodic runs (which is default) and
> around 7 a.m. cvsup runs.
>
> Thanks
> Magnus
>
>  --- Brent Wiese <[EMAIL PROTECTED]> skrev:
> > Do you have any scripts that run at those times? If you run
> > something like a
> > database update or something that can crank some CPU cycles,
> > you could be
> > overheating the box, causing a reboot. Could happen "all of a
> > sudden" if a
> > fan decided to quit...
> >
> > Dmesg show any panics?
> >
> > > -----Original Message-----
> > > From: [EMAIL PROTECTED]
> > > [mailto:[EMAIL PROTECTED] On Behalf Of
> > Magnus J
> > > Sent: Thursday, August 14, 2003 5:22 PM
> > > To: Steve Hovey
> > > Cc: [EMAIL PROTECTED]
> > > Subject: Re: Server rebooted at 3 a.m. and 7 a.m. for the
> > > past few days
> > >
> > >
> > > Hello
> > >
> > >
> > > Thanks for replying. /etc/crontab looks OK.
> > >
> > > This is how 'last' looks like (user1 is myself)
> > >
> > > user1           ttyp0    zzz.12.28.40      Thu Aug 14 12:43
> > -
> > > 13:30  (00:46)
> > > user1           ttyp1    zzz.12.28.40      Thu Aug 14 12:20
> > -
> > > 13:30  (01:09)
> > > user1           ttyp0    zzz.12.28.40      Thu Aug 14 12:08
> > -
> > > 12:21  (00:12)
> > > user1           ttyp0    zzz.12.27.12      Thu Aug 14 10:06
> > -
> > > 11:22  (01:15)
> > > user1           ttyp1    zzz.12.28.52      Thu Aug 14 08:06
> > -
> > > 08:07  (00:00)
> > > user1           ttyp0    zzz.12.28.52      Thu Aug 14 07:10
> > -
> > > 08:07  (00:56)
> > > reboot           ~                         Thu Aug 14 07:10
> > > reboot           ~                         Thu Aug 14 03:09
> > > reboot           ~                         Wed Aug 13 07:13
> > > reboot           ~                         Wed Aug 13 03:09
> > > reboot           ~                         Tue Aug 12 07:12
> > > reboot           ~                         Tue Aug 12 03:09
> > > reboot           ~                         Mon Aug 11 07:11
> > > reboot           ~                         Mon Aug 11 03:09
> > > reboot           ~                         Sun Aug 10 07:10
> > > reboot           ~                         Sun Aug 10 03:08
> > > reboot           ~                         Sat Aug  9 07:10
> > > reboot           ~                         Sat Aug  9 04:22
> > > reboot           ~                         Sat Aug  9 03:08
> > > reboot           ~                         Fri Aug  8 07:10
> > > reboot           ~                         Thu Aug  7 22:21
> > > user1           ttyp4    zzz.12.28.14      Mon Aug  4 22:39
> > -
> > > 22:40  (00:00)
> > >
> > > wtmp begins Mon Aug  4 22:39:55 CEST 2003
> > > bash-2.05b# date
> > > Fri Aug 15 02:06:22 CEST 2003
> > > bash-2.05b#
> > >
> > > Should I worry about these messages?
> > >
> > > Jul 16 14:06:47 magnus1 sshd[22292]: scanned from
> > > zzz.7.104.10 with SSH-1.0-SSH_ Version_Mapper.  Don't panic.
> >
> > > Jul 16 14:06:47 magnus1 sshd[22291]: Did not receive
> > > identification string from zzz.7.104.10 Jul 27 19:58:36
> > > magnus1 sshd[1811]: scanned from zzz.18.53.102 with
> > > SSH-1.0-SSH_Ve Jul 27 19:58:36 magnus1 sshd[1811]: scanned
> > > from zzz.18.53.102 with SSH-1.0-SSH_Ve rsion_Mapper.  Don't
> > > panic. Jul 27 19:58:36 magnus1 sshd[1810]: Did not receive
> > > identification string from zzz.18.53.102 Jul 28 07:00:07
> > > magnus1 sshd[2568]: Did not receive identification string
> > > from zzz.155.91.132 Jul 29 05:59:55 magnus1 sshd[3798]: Did
> > > not receive identification string from zzz.235.37.77 Jul 30
> > > 10:53:55 magnus1 sshd[5285]: Did not receive identification
> > > string from zzz.111.110.6 Jul 30 10:56:51 magnus1
> > sshd[5289]:
> > > Did not receive identification string from zzz.111.110.6 Jul
> >
> > > 30 12:51:46 magnus1 sshd[5365]: Did not receive
> > > identification string from zzz.212.236.18 Jul 31 02:57:59
> > > magnus1 sshd[5935]: Did not receive identification string
> > > from zzz.30.187.2 Aug  4 08:15:11 magnus1 sshd[14242]: Did
> > > not receive identification string from zzz.246.43.167
> > >
> > >
> > > Previously, I have had easily two months of uptime on this
> > server.
> > >
> > > Regards
> > > Magnus
> > >
> > >
> > >
> > >  --- Steve Hovey <[EMAIL PROTECTED]> skrev: >
> > > > I would start with your cron jobs
> > > >
> > > >
> > > > On Thu, 14 Aug 2003, [iso-8859-1] Magnus J wrote:
> > > >
> > > > > Hello everyone
> > > > >
> > > > >
> > > > > I'm not sure if I should have posted this to
> > > > freebsd-security,
> > > > > but I start here.
> > > > >
> > > > > I'm out traveling, and finally got a chance to login to
> > my server
> > > > > back home through SSH, which is running 4.8 and is
> > > protected by an
> > > > > IPFILTER firewall.
> > > > >
> > > > > Looking at /var/log/messages , the server has been
> > > > mysteriously
> > > > > rebooted around 3 a.m. and 7 a.m. CET every day for the
> > past
> > > > few
> > > > > days. I have never seen this before.
> > > > > It doesn't look like hardware problem because it's not
> > > > random
> > > > > and there are no messages about filesystems not being
> > > > unmounted
> > > > > cleanly.
> > > > >
> > > > > Any ideas where I should start looking to see what's
> > going
> > > > on?
> > > > > Obviously I will try to monitor what's happening next
> > > time around 3
> > > > > a.m. and 7 a.m., which processes are running, etc.,
> > > > but
> > > > > is there something special I should look out for?
> > > > >
> > > > > Unfortunately, I have not installed Tripwire.
> > > > >
> > > > > Best regards
> > > > > Magnus          (not a member of this list)

I tend to agree with Brent's assesment. Something your machine is trying to
do at those times is causing it to reboot without notice. The fact that
there is no complaints about not dismounting properly is curious but the
clockwork like regularity of this issue leads me to believe that your issues
are there, perhaps as an experiment remove the cvsup job from the crontab
over night and see if that had any noticeable difference. Alternatively run
the periodic scripts and other cronjobs once by hand and see if that causes
a reboot. crank up your syslog so that *everything* is getting logged to get
more forensic evidence on the problems might also be an avenue of attack.

HTH


_______________________________________________
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "[EMAIL PROTECTED]"

Reply via email to