Date: Thu, 14 Aug 2003 17:49:42 -0700 From: "Brent Wiese" <brently@bjwcs.com> To: "'Magnus J'" <magnus_os@yahoo.se>, "'Steve Hovey'" <shovey@buffnet.net> Cc: freebsd-questions@freebsd.org Subject: RE: Server rebooted at 3 a.m. and 7 a.m. for the past few days Message-ID: <009901c362c7$1d60e850$0a0114ac@home.bjwcs.com> In-Reply-To: <20030815002228.40351.qmail@web12906.mail.yahoo.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Do you have any scripts that run at those times? If you run something = like a database update or something that can crank some CPU cycles, you could = be overheating the box, causing a reboot. Could happen "all of a sudden" if = a fan decided to quit... Dmesg show any panics? > -----Original Message----- > From: owner-freebsd-questions@freebsd.org=20 > [mailto:owner-freebsd-questions@freebsd.org] On Behalf Of Magnus J > Sent: Thursday, August 14, 2003 5:22 PM > To: Steve Hovey > Cc: freebsd-questions@freebsd.org > Subject: Re: Server rebooted at 3 a.m. and 7 a.m. for the=20 > past few days >=20 >=20 > Hello >=20 >=20 > Thanks for replying. /etc/crontab looks OK. >=20 > This is how 'last' looks like (user1 is myself) >=20 > user1 ttyp0 zzz.12.28.40 Thu Aug 14 12:43 - > 13:30 (00:46) > user1 ttyp1 zzz.12.28.40 Thu Aug 14 12:20 - > 13:30 (01:09) > user1 ttyp0 zzz.12.28.40 Thu Aug 14 12:08 - > 12:21 (00:12) > user1 ttyp0 zzz.12.27.12 Thu Aug 14 10:06 - > 11:22 (01:15) > user1 ttyp1 zzz.12.28.52 Thu Aug 14 08:06 - > 08:07 (00:00) > user1 ttyp0 zzz.12.28.52 Thu Aug 14 07:10 - > 08:07 (00:56) > reboot ~ Thu Aug 14 07:10 > reboot ~ Thu Aug 14 03:09 > reboot ~ Wed Aug 13 07:13 > reboot ~ Wed Aug 13 03:09 > reboot ~ Tue Aug 12 07:12 > reboot ~ Tue Aug 12 03:09 > reboot ~ Mon Aug 11 07:11 > reboot ~ Mon Aug 11 03:09 > reboot ~ Sun Aug 10 07:10 > reboot ~ Sun Aug 10 03:08 > reboot ~ Sat Aug 9 07:10 > reboot ~ Sat Aug 9 04:22 > reboot ~ Sat Aug 9 03:08 > reboot ~ Fri Aug 8 07:10 > reboot ~ Thu Aug 7 22:21 > user1 ttyp4 zzz.12.28.14 Mon Aug 4 22:39 - > 22:40 (00:00) >=20 > wtmp begins Mon Aug 4 22:39:55 CEST 2003 > bash-2.05b# date > Fri Aug 15 02:06:22 CEST 2003 > bash-2.05b# >=20 > Should I worry about these messages? >=20 > Jul 16 14:06:47 magnus1 sshd[22292]: scanned from=20 > zzz.7.104.10 with SSH-1.0-SSH_ Version_Mapper. Don't panic.=20 > Jul 16 14:06:47 magnus1 sshd[22291]: Did not receive=20 > identification string from zzz.7.104.10 Jul 27 19:58:36=20 > magnus1 sshd[1811]: scanned from zzz.18.53.102 with=20 > SSH-1.0-SSH_Ve Jul 27 19:58:36 magnus1 sshd[1811]: scanned=20 > from zzz.18.53.102 with SSH-1.0-SSH_Ve rsion_Mapper. Don't=20 > panic. Jul 27 19:58:36 magnus1 sshd[1810]: Did not receive=20 > identification string from zzz.18.53.102 Jul 28 07:00:07=20 > magnus1 sshd[2568]: Did not receive identification string=20 > from zzz.155.91.132 Jul 29 05:59:55 magnus1 sshd[3798]: Did=20 > not receive identification string from zzz.235.37.77 Jul 30=20 > 10:53:55 magnus1 sshd[5285]: Did not receive identification=20 > string from zzz.111.110.6 Jul 30 10:56:51 magnus1 sshd[5289]:=20 > Did not receive identification string from zzz.111.110.6 Jul=20 > 30 12:51:46 magnus1 sshd[5365]: Did not receive=20 > identification string from zzz.212.236.18 Jul 31 02:57:59=20 > magnus1 sshd[5935]: Did not receive identification string=20 > from zzz.30.187.2 Aug 4 08:15:11 magnus1 sshd[14242]: Did=20 > not receive identification string from zzz.246.43.167 >=20 >=20 > Previously, I have had easily two months of uptime on this server. >=20 > Regards > Magnus >=20 >=20 >=20 > --- Steve Hovey <shovey@buffnet.net> skrev: >=20 > > I would start with your cron jobs > >=20 > >=20 > > On Thu, 14 Aug 2003, [iso-8859-1] Magnus J wrote: > >=20 > > > Hello everyone > > >=20 > > >=20 > > > I'm not sure if I should have posted this to > > freebsd-security, > > > but I start here. > > >=20 > > > I'm out traveling, and finally got a chance to login to my server=20 > > > back home through SSH, which is running 4.8 and is=20 > protected by an=20 > > > IPFILTER firewall. > > >=20 > > > Looking at /var/log/messages , the server has been > > mysteriously > > > rebooted around 3 a.m. and 7 a.m. CET every day for the past > > few > > > days. I have never seen this before. > > > It doesn't look like hardware problem because it's not > > random > > > and there are no messages about filesystems not being > > unmounted > > > cleanly. > > >=20 > > > Any ideas where I should start looking to see what's going > > on? > > > Obviously I will try to monitor what's happening next=20 > time around 3=20 > > > a.m. and 7 a.m., which processes are running, etc., > > but > > > is there something special I should look out for? > > >=20 > > > Unfortunately, I have not installed Tripwire. > > >=20 > > > Best regards > > > Magnus (not a member of this list) > > >=20 > > >=20 > > > Yahoo! Mail - Gratis: 6 MB lagringsutrymme, spamfilter och > > virusscan. Se mer p=E5 http://se.mail.yahoo.com > > > _______________________________________________ > > > freebsd-questions@freebsd.org mailing list=20 > > > http://lists.freebsd.org/mailman/listinfo/freebsd-questions > > > To unsubscribe, send any mail to > > "freebsd-questions-unsubscribe@freebsd.org" > > >=20 > > =20 >=20 > Yahoo! Mail - Gratis: 6 MB lagringsutrymme, spamfilter och=20 > virusscan. Se mer p=E5 http://se.mail.yahoo.com=20 > _______________________________________________ > freebsd-questions@freebsd.org mailing list=20 > http://lists.freebsd.org/mailman/listinfo/freebsd->; questions >=20 > To unsubscribe, send any mail to=20 > "freebsd-questions-unsubscribe@freebsd.org" >=20 >=20
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?009901c362c7$1d60e850$0a0114ac>