From owner-freebsd-questions@freebsd.org Mon Oct 2 01:04:33 2017 Return-Path: Delivered-To: freebsd-questions@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 3D51BE32BB5 for ; Mon, 2 Oct 2017 01:04:33 +0000 (UTC) (envelope-from doctor@doctor.nl2k.ab.ca) Received: from doctor.nl2k.ab.ca (doctor.nl2k.ab.ca [204.209.81.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 254BD7525F for ; Mon, 2 Oct 2017 01:04:32 +0000 (UTC) (envelope-from doctor@doctor.nl2k.ab.ca) Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.89 (FreeBSD)) (envelope-from ) id 1dyp9p-000GuA-Fs; Sun, 01 Oct 2017 19:04:29 -0600 Date: Sun, 1 Oct 2017 19:04:29 -0600 From: The Doctor To: Adam Vande More Cc: Polytropon , FreeBSD Questions Subject: Re: Weird turnoff Message-ID: <20171002010429.GA64459@doctor.nl2k.ab.ca> References: <20171001232531.GA18260@doctor.nl2k.ab.ca> <20171002021140.931f17de.freebsd@edvax.de> <20171002002506.GA42212@doctor.nl2k.ab.ca> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.9.1 (2017-09-22) X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 02 Oct 2017 01:04:33 -0000 On Sun, Oct 01, 2017 at 07:59:02PM -0500, Adam Vande More wrote: > On Sun, Oct 1, 2017 at 7:25 PM, The Doctor wrote: > > > On Mon, Oct 02, 2017 at 02:11:40AM +0200, Polytropon wrote: > > > On Sun, 1 Oct 2017 17:25:31 -0600, The Doctor wrote: > > > > Could be an attack. > > > > Perhaps by a mouse... > > Doubtful. > > > > All right. > > > > > > > > As of this morning (3 p.m. UTC) my seconday FreeBSD 11.1 server > > > > has been going intreface down then up and then unable to route. > > > > > > > > Rebooted this system 2 times today. > > > > > > > > > > > > What should I bee looking for? > > > > > > Primarily the system's log files in /var/log: messages, auth.log, > > > security. Also check the output of the periodic scripts (mailed > > > to root or another user), do they contain hints to something that > > > looks suspicious (SUID changes, system file modifications, etc.)? > > > > > > > exactly what I am looking for > > > > Punctuation, like question marks, for a start. > > Otherwise, I'd look into why it appears the switch the system is plugged > into is losing connectivity. What it rebooted or something? > Nope. For no viable reason , the server is loosing connectivity, not the switch. > -- > Adam > _______________________________________________ > freebsd-questions@freebsd.org mailing list > https://lists.freebsd.org/mailman/listinfo/freebsd-questions > To unsubscribe, send any mail to "freebsd-questions-unsubscribe@freebsd.org" -- Member - Liberal International This is doctor@@nl2k.ab.ca Ici doctor@@nl2k.ab.ca Yahweh, Queen & country!Never Satan President Republic!Beware AntiChrist rising! https://www.empire.kred/ROOTNK?t=94a1f39b Look at Psalms 14 and 53 on Atheism Talk Sense to a fool and he calls you foolish - Euripides