I participated in a thread about this previously.
I thought that I had solved my reboot problems by recompiling (on a RH5.1
machine) some programs that had been copied over from a RH4.2 machine and
by linking /etc/localtime to /usr/share/zoneinfo/US/Central.
I was looking for a correlation between the log entries with incorrect
times and the reboots. (as it usually happened at 5:23 a.m. or so.)
I had another reboot this morning and found a peculiarity that I am
pursuing.
It seems that logrotate was performed on the 4th at 3:58 a.m. Two days
later at 5:23 a.m. the machine rebooted without warning.
In looking back...one of the previous reboots was on the 22nd of
September at 5:23, two days after the logs were rotated on Sept. 20 at
4:01.
-------------
-rw-r----- 1 root admin 65151 Oct 6 09:24 messages
-rw-r----- 1 root admin 166890 Oct 4 03:58 messages.1
-rw-r----- 1 root admin 204160 Sep 27 03:59 messages.2
-rw-r----- 1 root admin 203070 Sep 20 04:01 messages.3
-rw-r----- 1 root admin 184212 Sep 13 03:58 messages.4
-------------
$ more messages* |grep klogd
Oct 6 05:23:40 thumper kernel: klogd 1.3-3, log source = /proc/kmsg
started.
Sep 22 05:23:24 thumper kernel: klogd 1.3-3, log source = /proc/kmsg
started.
Sep 19 11:23:12 thumper kernel: klogd 1.3-3, log source = /proc/kmsg
started.
Sep 19 11:38:25 thumper kernel: klogd 1.3-3, log source = /proc/kmsg
started.
Sep 8 05:23:00 thumper kernel: klogd 1.3-3, log source = /proc/kmsg
started.
-------------
The Sept. 19 entries are from reboots I performed while working on the
machine.
-------------
Oct 6 05:11:29 thumper named[18434]: NSTATS 907668689 906499687 A=3820
PTR=3820
Oct 6 05:11:29 thumper named[18434]: XSTATS 907668689 906499687 RR=1106
RNXD=0 RFwdR=0 RDupR=0 R
Fail=0 RFErr=0 RErr=0 RAXFR=0 RLame=0 ROpts=0 SSysQ=1106 SAns=7640 SFwdQ=0
SDupQ=0 SErr=0 RQ=7640
RIQ=1 RFwdQ=0 RDupQ=0 RTCP=1 SFwdR=0 SFail=0 SFErr=0 SNaAns=0 SNXD=0
Oct 6 05:12:19 thumper ftpd[9826]: FTP session closed
Oct 6 05:23:40 thumper syslogd 1.3-3: restart.
Oct 6 05:23:40 thumper kernel: klogd 1.3-3, log source = /proc/kmsg
started.
-------------
The named entry doesn't seem unusual and on previous reboots there is not
necessarily a named entry within minutes of the reboot.
The ftpd entry is expected. I am running Big Brother to monitor this
machine among others and it connects to ftpd, etc. every 5 minutes. (no
other entries/errors before reboot!?)
I also found that...2 days before the reboot...when logrotate is being
performed, there are 4 syslogd restart messages at the beginning of the
messages file. (Oct 4 and Sep 20 below). Sep 15 I did not have a reboot,
but there was 4 syslogd restart messages.
-------------
$ more messages* |grep restart
Oct 4 04:02:00 thumper syslogd 1.3-3: restart.
Oct 4 04:02:00 thumper syslogd 1.3-3: restart.
Oct 4 04:02:00 thumper syslogd 1.3-3: restart.
Oct 4 04:02:00 thumper syslogd 1.3-3: restart.
Oct 6 05:23:40 thumper syslogd 1.3-3: restart.
Sep 27 04:02:01 thumper syslogd 1.3-3: restart.
Sep 27 04:02:01 thumper syslogd 1.3-3: restart.
Sep 27 04:02:01 thumper syslogd 1.3-3: restart.
Sep 20 04:02:00 thumper syslogd 1.3-3: restart.
Sep 20 04:02:00 thumper syslogd 1.3-3: restart.
Sep 20 04:02:00 thumper syslogd 1.3-3: restart.
Sep 20 04:02:00 thumper syslogd 1.3-3: restart.
Sep 22 05:23:24 thumper syslogd 1.3-3: restart.
Sep 13 04:02:00 thumper syslogd 1.3-3: restart.
Sep 13 04:02:00 thumper syslogd 1.3-3: restart.
Sep 13 04:02:01 thumper syslogd 1.3-3: restart.
Sep 13 04:02:01 thumper syslogd 1.3-3: restart.
Sep 19 11:23:12 thumper syslogd 1.3-3: restart.
Sep 19 11:38:25 thumper syslogd 1.3-3: restart.
Sep 6 04:02:01 thumper syslogd 1.3-3: restart.
Sep 6 04:02:01 thumper syslogd 1.3-3: restart.
Sep 6 04:02:01 thumper syslogd 1.3-3: restart.
Sep 8 05:23:00 thumper syslogd 1.3-3: restart.
-------------
I have disconnected the reset button from the motherboard.
The machine is plugged into a UPS (no power loss that UPS didn't hold up).
Tyan Titan Pro dual PPro 180MHz
128MB RAM
9G UW SCSI drive
BT958 controller
WD8013 ethernet (SMC ISA 10MB)
RH5.1, 2.0.35 kernel
SCSI in kernel, ethernet as module
sendmail-8.8.7-17, apache-1.2.6-4 (now running Apache 1.3.1 compiled from
source with FrontPage patch), bind-4.9.7-1, no pop server running.
Please advise on where I can look next!
Thanks,
Curt Schibonski
Netlink Communications, Inc.
