Date: Fri, 15 Aug 2003 02:22:28 +0200 (CEST) From: =?iso-8859-1?q?Magnus=20J?= <magnus_os@yahoo.se> To: Steve Hovey <shovey@buffnet.net> Cc: freebsd-questions@freebsd.org Subject: Re: Server rebooted at 3 a.m. and 7 a.m. for the past few days Message-ID: <20030815002228.40351.qmail@web12906.mail.yahoo.com> In-Reply-To: <Pine.BSF.4.05.10308140722400.67650-100000@buffnet5.buffnet.net>
next in thread | previous in thread | raw e-mail | index | archive | help
Hello Thanks for replying. /etc/crontab looks OK. This is how 'last' looks like (user1 is myself) user1 ttyp0 zzz.12.28.40 Thu Aug 14 12:43 - 13:30 (00:46) user1 ttyp1 zzz.12.28.40 Thu Aug 14 12:20 - 13:30 (01:09) user1 ttyp0 zzz.12.28.40 Thu Aug 14 12:08 - 12:21 (00:12) user1 ttyp0 zzz.12.27.12 Thu Aug 14 10:06 - 11:22 (01:15) user1 ttyp1 zzz.12.28.52 Thu Aug 14 08:06 - 08:07 (00:00) user1 ttyp0 zzz.12.28.52 Thu Aug 14 07:10 - 08:07 (00:56) reboot ~ Thu Aug 14 07:10 reboot ~ Thu Aug 14 03:09 reboot ~ Wed Aug 13 07:13 reboot ~ Wed Aug 13 03:09 reboot ~ Tue Aug 12 07:12 reboot ~ Tue Aug 12 03:09 reboot ~ Mon Aug 11 07:11 reboot ~ Mon Aug 11 03:09 reboot ~ Sun Aug 10 07:10 reboot ~ Sun Aug 10 03:08 reboot ~ Sat Aug 9 07:10 reboot ~ Sat Aug 9 04:22 reboot ~ Sat Aug 9 03:08 reboot ~ Fri Aug 8 07:10 reboot ~ Thu Aug 7 22:21 user1 ttyp4 zzz.12.28.14 Mon Aug 4 22:39 - 22:40 (00:00) wtmp begins Mon Aug 4 22:39:55 CEST 2003 bash-2.05b# date Fri Aug 15 02:06:22 CEST 2003 bash-2.05b# Should I worry about these messages? Jul 16 14:06:47 magnus1 sshd[22292]: scanned from zzz.7.104.10 with SSH-1.0-SSH_ Version_Mapper. Don't panic. Jul 16 14:06:47 magnus1 sshd[22291]: Did not receive identification string from zzz.7.104.10 Jul 27 19:58:36 magnus1 sshd[1811]: scanned from zzz.18.53.102 with SSH-1.0-SSH_Ve Jul 27 19:58:36 magnus1 sshd[1811]: scanned from zzz.18.53.102 with SSH-1.0-SSH_Ve rsion_Mapper. Don't panic. Jul 27 19:58:36 magnus1 sshd[1810]: Did not receive identification string from zzz.18.53.102 Jul 28 07:00:07 magnus1 sshd[2568]: Did not receive identification string from zzz.155.91.132 Jul 29 05:59:55 magnus1 sshd[3798]: Did not receive identification string from zzz.235.37.77 Jul 30 10:53:55 magnus1 sshd[5285]: Did not receive identification string from zzz.111.110.6 Jul 30 10:56:51 magnus1 sshd[5289]: Did not receive identification string from zzz.111.110.6 Jul 30 12:51:46 magnus1 sshd[5365]: Did not receive identification string from zzz.212.236.18 Jul 31 02:57:59 magnus1 sshd[5935]: Did not receive identification string from zzz.30.187.2 Aug 4 08:15:11 magnus1 sshd[14242]: Did not receive identification string from zzz.246.43.167 Previously, I have had easily two months of uptime on this server. Regards Magnus --- Steve Hovey <shovey@buffnet.net> skrev: > > I would start with your cron jobs > > > On Thu, 14 Aug 2003, [iso-8859-1] Magnus J wrote: > > > Hello everyone > > > > > > I'm not sure if I should have posted this to > freebsd-security, > > but I start here. > > > > I'm out traveling, and finally got a chance to login to my > > server back home through SSH, which is running 4.8 and is > > protected by an IPFILTER firewall. > > > > Looking at /var/log/messages , the server has been > mysteriously > > rebooted around 3 a.m. and 7 a.m. CET every day for the past > few > > days. I have never seen this before. > > It doesn't look like hardware problem because it's not > random > > and there are no messages about filesystems not being > unmounted > > cleanly. > > > > Any ideas where I should start looking to see what's going > on? > > Obviously I will try to monitor what's happening next time > > around 3 a.m. and 7 a.m., which processes are running, etc., > but > > is there something special I should look out for? > > > > Unfortunately, I have not installed Tripwire. > > > > Best regards > > Magnus (not a member of this list) > > > > > > Yahoo! Mail - Gratis: 6 MB lagringsutrymme, spamfilter och > virusscan. Se mer på http://se.mail.yahoo.com > > _______________________________________________ > > freebsd-questions@freebsd.org mailing list > > http://lists.freebsd.org/mailman/listinfo/freebsd-questions > > To unsubscribe, send any mail to > "freebsd-questions-unsubscribe@freebsd.org" > > > Yahoo! Mail - Gratis: 6 MB lagringsutrymme, spamfilter och virusscan. Se mer på http://se.mail.yahoo.com
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20030815002228.40351.qmail>