Disc lock up on 8.0-STABLE

[Ivan Voras]

Pete French wrote:
> Interesting... I just got another hard lock on the system, not at 3am
> this time. The only other common factor in this is that the lockup
> is always preceeded by a flood of failed ssh logins. I;m sure we've
> all seen these - I get them on every BSD system I have - they look
> like this:
> 
> Dec 22 17:37:10 turpentine sshd[8188]: error: PAM: authentication error for illegal user kevin from 61.74.75.43
> Dec 22 17:43:21 turpentine sshd[9983]: error: PAM: authentication error for illegal user kevin from 58.60.106.24
> Dec 22 17:49:30 turpentine sshd[11781]: error: PAM: authentication error for illegal user kevin from 219.234.95.164
> Dec 22 18:01:47 turpentine sshd[15435]: error: PAM: authentication error for illegal user kevin from 61.74.75.43
> Dec 22 18:07:54 turpentine sshd[17259]: error: PAM: authentication error for illegal user kevin from 61.74.75.43
> Dec 22 18:14:06 turpentine sshd[19282]: error: PAM: authentication error for illegal user kevin from 61.74.75.53
> 
> Theres always a flood of those on the console immediately preceeding
> the lockup. So this time it cant have been anything to do with the
> 3am run.

When you say "lock up" and "can't login" (in your original mail) - are 
you sure this really is a lockup and not e.g. sshd dieing because of the 
attacks? E.g. can you ping the machine, can you leave something like 
"date >> /root/run.txt && vmstat 1 3 >> /root/run.txt" in crontab so you 
track the moment it dies more closely?