Server rebooted at 3 a.m. and 7 a.m. for the past few days
Magnus J
magnus_os at yahoo.se
Thu Aug 14 17:22:29 PDT 2003
Hello
Thanks for replying. /etc/crontab looks OK.
This is how 'last' looks like (user1 is myself)
user1 ttyp0 zzz.12.28.40 Thu Aug 14 12:43 -
13:30 (00:46)
user1 ttyp1 zzz.12.28.40 Thu Aug 14 12:20 -
13:30 (01:09)
user1 ttyp0 zzz.12.28.40 Thu Aug 14 12:08 -
12:21 (00:12)
user1 ttyp0 zzz.12.27.12 Thu Aug 14 10:06 -
11:22 (01:15)
user1 ttyp1 zzz.12.28.52 Thu Aug 14 08:06 -
08:07 (00:00)
user1 ttyp0 zzz.12.28.52 Thu Aug 14 07:10 -
08:07 (00:56)
reboot ~ Thu Aug 14 07:10
reboot ~ Thu Aug 14 03:09
reboot ~ Wed Aug 13 07:13
reboot ~ Wed Aug 13 03:09
reboot ~ Tue Aug 12 07:12
reboot ~ Tue Aug 12 03:09
reboot ~ Mon Aug 11 07:11
reboot ~ Mon Aug 11 03:09
reboot ~ Sun Aug 10 07:10
reboot ~ Sun Aug 10 03:08
reboot ~ Sat Aug 9 07:10
reboot ~ Sat Aug 9 04:22
reboot ~ Sat Aug 9 03:08
reboot ~ Fri Aug 8 07:10
reboot ~ Thu Aug 7 22:21
user1 ttyp4 zzz.12.28.14 Mon Aug 4 22:39 -
22:40 (00:00)
wtmp begins Mon Aug 4 22:39:55 CEST 2003
bash-2.05b# date
Fri Aug 15 02:06:22 CEST 2003
bash-2.05b#
Should I worry about these messages?
Jul 16 14:06:47 magnus1 sshd[22292]: scanned from zzz.7.104.10
with SSH-1.0-SSH_
Version_Mapper. Don't panic.
Jul 16 14:06:47 magnus1 sshd[22291]: Did not receive
identification string from zzz.7.104.10
Jul 27 19:58:36 magnus1 sshd[1811]: scanned from zzz.18.53.102
with SSH-1.0-SSH_Ve
Jul 27 19:58:36 magnus1 sshd[1811]: scanned from zzz.18.53.102
with SSH-1.0-SSH_Ve
rsion_Mapper. Don't panic.
Jul 27 19:58:36 magnus1 sshd[1810]: Did not receive
identification string from zzz.18.53.102
Jul 28 07:00:07 magnus1 sshd[2568]: Did not receive
identification string from zzz.155.91.132
Jul 29 05:59:55 magnus1 sshd[3798]: Did not receive
identification string from zzz.235.37.77
Jul 30 10:53:55 magnus1 sshd[5285]: Did not receive
identification string from zzz.111.110.6
Jul 30 10:56:51 magnus1 sshd[5289]: Did not receive
identification string from zzz.111.110.6
Jul 30 12:51:46 magnus1 sshd[5365]: Did not receive
identification string from zzz.212.236.18
Jul 31 02:57:59 magnus1 sshd[5935]: Did not receive
identification string from zzz.30.187.2
Aug 4 08:15:11 magnus1 sshd[14242]: Did not receive
identification string from zzz.246.43.167
Previously, I have had easily two months of uptime on this
server.
Regards
Magnus
--- Steve Hovey <shovey at buffnet.net> skrev: >
> I would start with your cron jobs
>
>
> On Thu, 14 Aug 2003, [iso-8859-1] Magnus J wrote:
>
> > Hello everyone
> >
> >
> > I'm not sure if I should have posted this to
> freebsd-security,
> > but I start here.
> >
> > I'm out traveling, and finally got a chance to login to my
> > server back home through SSH, which is running 4.8 and is
> > protected by an IPFILTER firewall.
> >
> > Looking at /var/log/messages , the server has been
> mysteriously
> > rebooted around 3 a.m. and 7 a.m. CET every day for the past
> few
> > days. I have never seen this before.
> > It doesn't look like hardware problem because it's not
> random
> > and there are no messages about filesystems not being
> unmounted
> > cleanly.
> >
> > Any ideas where I should start looking to see what's going
> on?
> > Obviously I will try to monitor what's happening next time
> > around 3 a.m. and 7 a.m., which processes are running, etc.,
> but
> > is there something special I should look out for?
> >
> > Unfortunately, I have not installed Tripwire.
> >
> > Best regards
> > Magnus (not a member of this list)
> >
> >
> > Yahoo! Mail - Gratis: 6 MB lagringsutrymme, spamfilter och
> virusscan. Se mer på http://se.mail.yahoo.com
> > _______________________________________________
> > freebsd-questions at freebsd.org mailing list
> > http://lists.freebsd.org/mailman/listinfo/freebsd-questions
> > To unsubscribe, send any mail to
> "freebsd-questions-unsubscribe at freebsd.org"
> >
>
Yahoo! Mail - Gratis: 6 MB lagringsutrymme, spamfilter och virusscan. Se mer på http://se.mail.yahoo.com
More information about the freebsd-questions
mailing list