Ray Olszewski wrote:
>
> I'm afraid that your answers eliminated most of the tentative ideas I had
> about your problem. There are a few things you may find helpful, though.
>
> >Filesystem 1024-blocks Used Available Capacity Mounted on
> >/dev/hda1 495714 405488 64625 86% /
>
> This is pretty full. If you were running "who" as a user (not as root), it
> might have had trouble creating a needed file in /tmp . I don't recall for
> sure, but "who" *may* report this failure as a memory problem instead of as
> a disk problem.
64 MB hard drive space doesn't seem all that low for a machine that has
very little disk activity.
> > 3:22pm up 2 days, 19:49, 3 users, load average: 0.07, 0.05, 0.06
> > total used free shared buffers cached
> >Mem: 34852 33776 1076 13436 10564 15928
> >-/+ buffers/cache: 7284 27568
> >Swap: 20124 0 20124
>
> This indicates plenty of free memory. Of about 35 megs of real RAM, you have
> over 27 available (the second line under "free"). Plus you have 20 megs of swap.
>
> On the other hand, the slowness you describe is a classic sign of heavy use
> of swap. If this problem occurs again, take another look at "free" and see
> particularly if the swap is being used. This (probably) indicates a
> transient load on the system from some source. Run "top" or "ps -aux" to
> find the app that is using a lot of memory.
I agree with the transient load theory, but I can't attribute it to
anything. There's just not that much running. I suppose I could kill
netatalk for a while since my wife doesn't use it that much...
> BTW, you didn't mention what distribution and version of Linux you are
> running. I doubt this would by itself suggest anything, but if you do
> experience the problem again and write about it, do include that info next time.
Actually, I think I did, but here it is again just in case: RH 5.0,
Linux 2.0.34
> Also BTW, if you still are considering your break-in hypothesis, you might
> look for evidence of it in wtmp (use "last") or in the entries that tcpd
> (assuming you run it) makes in your logs.
Well, periodically I run:
grep -v 192 /var/log/secure
and I don't find anything. (192 being part the prefix of my local Class
C address block) In any case last shows nothing unusual.
> At 03:30 PM 6/12/99 -0700, David Rysdam wrote [in part]:
> >I don't have anything to connect the memory issue (if it IS an issue) to
> >my ppp connection problem, except the fact that they *may* have cleared
> >up once I rebooted.
> ...
> >My main question is: Why the "memory exhausted" message from "who"? I'm
> >perfectly willing to accept that either my phone line or ISP sucks to
> >explain the rest.
>
> ------------------------------------"Never tell me the odds!"---
> Ray Olszewski -- Han Solo
> Palo Alto, CA 94303-3603 [EMAIL PROTECTED]
> ----------------------------------------------------------------
--
My public encryption key is available from
www.az.com/~drysdam/crypt/rysdam.gpg.html
and of course www.keyserver.net
