[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[cobalt-security] Mysterious reboot..



I just had a reboot today at 12:50 which I never initiated, also worrying was noticing this
which I have never seen before in my messages log as the system came back up, I can
not ever recall seeing postgres do this before :-
 
May  9 12:51:57 ns named[378]: listening on [127.0.0.1].53 (lo)
May  9 12:51:57 ns named[378]: listening on [213.239.56.135].53 (eth0)
May  9 12:51:57 ns named[378]: Forwarding source address is [0.0.0.0].1024
May  9 12:51:57 ns named[379]: Ready to answer queries.
May  9 12:51:57 ns modprobe: can't locate module net-pf-10
May  9 12:51:57 ns kernel: family 10 not registered
May  9 12:51:57 ns sshd[384]: Server listening on 0.0.0.0 port 22.
May  9 12:52:08 ns PAM_pwdb[428]: (su) session opened for user postgres by (uid=0)
May  9 12:52:08 ns PAM_pwdb[428]: (su) session closed for user postgres
 
please also see the attached file reboot.txt
 
if anyone can shed some light on this and offer a legitimate explanation for the reboot
and the session above I would appreciate it before I start to become paranoid...
 
thanks
 
Adam
 
May  9 12:50:08 ns init: Switching to runlevel: 6
May  9 12:50:08 ns getty[549]: exiting on TERM signal
May  9 12:50:13 ns sshd[23511]: Received signal 15; terminating.
May  9 12:50:16 ns named[14299]: named shutting down
May  9 12:50:16 ns named[14299]: USAGE 989409016 984625208 CPU=3.99u/10.29s CHILDCPU=0u/0s
May  9 12:50:16 ns named[14299]: NSTATS 989409016 984625208 A=4311 NS=18 SOA=700 PTR=6 HINFO=1 MX=254 TXT=77 AAAA=4 AXFR=8 ANY=78
May  9 12:50:16 ns named[14299]: XSTATS 989409016 984625208 RR=47 RNXD=2 RFwdR=3 RDupR=0 RFail=2 RFErr=0 RErr=0 RAXFR=8 RLame=0 ROpts=0 SSysQ=48 SAns=5663 SFwdQ=2 SDupQ=10 SErr=0 RQ=5590 RIQ=92 RFwdQ=2 RDupQ=0 RTCP=23 SFwdR=3 SFail=0 SFErr=0 SNaAns=233 SNXD=145 RUQ=0 RURQ=0 RUXFR=0 RUUpd=0
May  9 12:50:24 ns kernel: Kernel logging (proc) stopped.
May  9 12:50:24 ns kernel: Kernel log daemon terminating.
May  9 12:50:28 ns exiting on signal 15
May  9 12:51:33 ns syslogd 1.3-3: restart.
May  9 12:51:35 ns kernel: klogd 1.3-3, log source = /proc/kmsg started.
May  9 12:51:35 ns kernel: Inspecting /boot/System.map
May  9 12:51:36 ns kernel: Loaded 7079 symbols from /boot/System.map.
May  9 12:51:36 ns kernel: Symbols match kernel version 2.2.14.
May  9 12:51:36 ns kernel: Loaded 104 symbols from 1 module.
May  9 12:51:36 ns kernel: Linux version 2.2.14C10 (root@xxxxxxxxxxxxxxxxxx) (gcc version 2.95.2 19991024 (release)) #3 Wed Jun 21 15:05:10 JST 2000
May  9 12:51:36 ns kernel: Ignoring bogus EBDA pointer 3FF7000
May  9 12:51:36 ns kernel: Detected 298807189 Hz processor.
May  9 12:51:36 ns kernel: Calibrating delay loop... 596.38 BogoMIPS
May  9 12:51:36 ns kernel: Memory: 63092k/65536k available (1076k kernel code, 416k reserved, 892k data, 60k init)
May  9 12:51:36 ns kernel: Dentry hash table entries: 8192 (order 4, 64k)
May  9 12:51:36 ns kernel: Buffer cache hash table entries: 65536 (order 6, 256k)
May  9 12:51:36 ns kernel: Page cache hash table entries: 16384 (order 4, 64k)
May  9 12:51:36 ns kernel: VFS: Diskquotas version dquot_6.4.0 initialized
May  9 12:51:36 ns kernel: CPU: AMD AMD-K6(tm) 3D processor stepping 0c
May  9 12:51:36 ns kernel: Checking 386/387 coupling... OK, FPU using exception 16 error reporting.
May  9 12:51:36 ns kernel: Checking 'hlt' instruction... OK.
May  9 12:51:36 ns kernel: POSIX conformance testing by UNIFIX
May  9 12:51:36 ns kernel: mtrr: v1.35a (19990819) Richard Gooch (rgooch@xxxxxxxxxxxxx)
May  9 12:51:36 ns kernel: PCI: Using configuration type 1
May  9 12:51:36 ns kernel: PCI: Probing PCI hardware
May  9 12:51:36 ns kernel: Linux NET4.0 for Linux 2.2
May  9 12:51:36 ns kernel: Based upon Swansea University Computer Society NET3.039
May  9 12:51:36 ns kernel: NET4: Unix domain sockets 1.0 for Linux NET4.0.
May  9 12:51:36 ns kernel: NET4: Linux TCP/IP 1.0 for NET4.0
May  9 12:51:36 ns kernel: IP Protocols: ICMP, UDP, TCP, IGMP
May  9 12:51:36 ns kernel: TCP: Hash tables configured (ehash 65536 bhash 65536)
May  9 12:51:36 ns kernel: Initializing RT netlink socket
May  9 12:51:36 ns kernel: Starting kswapd v 1.3 
May  9 12:51:36 ns kernel: Cobalt watchdog v1.3 enabled
May  9 12:51:36 ns kernel: Cobalt temperature sensor v1.2 enabled
May  9 12:51:36 ns kernel: Serial driver version 4.27 with no serial options enabled
May  9 12:51:36 ns kernel: ttyS00 at 0x03f8 (irq = 4) is a 16550A
May  9 12:51:36 ns kernel: Keyboard timeout[2]
May  9 12:51:36 ns kernel: Keyboard timeout[2]
May  9 12:51:36 ns kernel: ttyS01 at 0x02f8 (irq = 3) is a 16550A
May  9 12:51:36 ns kernel: pty: 256 Unix98 ptys configured
May  9 12:51:36 ns kernel: Real Time Clock Driver v1.09
May  9 12:51:36 ns kernel: lcd: Cobalt LCD Driver v3.01 by^M
May  9 12:51:36 ns kernel: lcd: Andrew Bose <andrew@xxxxxxxxxxxxx>, Timothy Stonis <tim@xxxxxxxxxxxxx>
May  9 12:51:36 ns kernel: serialnumber: Version 1.1 initialized. Serial number=540000074bf07301. Copyright (c) 1994-2000 Axent Technologies, Inc
May  9 12:51:36 ns kernel: Uniform Multi-Platform E-IDE driver Revision: 6.30
May  9 12:51:36 ns kernel: ALI15X3: IDE controller on PCI bus 00 dev 78
May  9 12:51:36 ns kernel: ALI15X3: 100%% native mode on irq 14
May  9 12:51:36 ns kernel:     ide0: BM-DMA at 0xf000-0xf007, BIOS settings: hda:DMA, hdb:DMA
May  9 12:51:36 ns kernel:     ide1: BM-DMA at 0xf008-0xf00f, BIOS settings: hdc:DMA, hdd:DMA
May  9 12:51:36 ns kernel: hda: ST310212A, ATA DISK drive
May  9 12:51:36 ns kernel: ide0 at 0x1f0-0x1f7,0x3f6 on irq 14
May  9 12:51:36 ns kernel: ALI15X3: Ultra DMA enabled
May  9 12:51:36 ns kernel: hda: ST310212A, 9768MB w/512kB Cache, CHS=19846/16/63, (U)DMA
May  9 12:51:36 ns kernel: md driver 0.90.0 MAX_MD_DEVS=256, MAX_REAL=12
May  9 12:51:36 ns kernel: translucent personality registered
May  9 12:51:36 ns kernel: linear personality registered
May  9 12:51:36 ns kernel: raid0 personality registered
May  9 12:51:36 ns kernel: raid1 personality registered
May  9 12:51:36 ns kernel: raid5 personality registered
May  9 12:51:36 ns kernel: raid5: measuring checksumming speed
May  9 12:51:36 ns kernel: raid5: MMX detected, trying high-speed MMX checksum routines
May  9 12:51:36 ns kernel:    pII_mmx   :   670.941 MB/sec
May  9 12:51:36 ns kernel:    p5_mmx    :   647.319 MB/sec
May  9 12:51:36 ns kernel:    8regs     :   448.437 MB/sec
May  9 12:51:36 ns kernel:    32regs    :   281.178 MB/sec
May  9 12:51:36 ns kernel: using fastest function: pII_mmx (670.941 MB/sec)
May  9 12:51:36 ns kernel: scsi : 0 hosts.
May  9 12:51:36 ns kernel: scsi : detected total.
May  9 12:51:36 ns kernel: eth0: Invalid EEPROM checksum 0x33d8, check settings before activating this device!
May  9 12:51:36 ns kernel: eth0: Intel EtherExpress Pro 10/100 at 0x1000, 00:10:E0:01:F8:21, IRQ 11.
May  9 12:51:36 ns kernel:   Board assembly 000000-000, Physical connectors present:
May  9 12:51:36 ns kernel:   Primary interface chip None PHY #0.
May  9 12:51:36 ns kernel:   General self-test: passed.
May  9 12:51:36 ns kernel:   Serial sub-system self-test: passed.
May  9 12:51:36 ns kernel:   Internal registers self-test: passed.
May  9 12:51:36 ns kernel:   ROM checksum self-test: passed (0xdbd8681d).
May  9 12:51:36 ns kernel:   Receiver lock-up workaround activated.
May  9 12:51:36 ns kernel: md.c: sizeof(mdp_super_t) = 4096
May  9 12:51:36 ns kernel: Partition check:
May  9 12:51:36 ns kernel:  hda: hda1 hda2 hda3 hda4
May  9 12:51:36 ns kernel: autodetecting RAID arrays
May  9 12:51:36 ns kernel: autorun ...
May  9 12:51:36 ns kernel: ... autorun DONE.
May  9 12:51:36 ns kernel: VFS: Mounted root (ext2 filesystem) readonly.
May  9 12:51:36 ns kernel: Freeing unused kernel memory: 60k freed
May  9 12:51:36 ns kernel: Adding Swap: 131536k swap-space (priority -1)
May  9 12:51:36 ns kernel: Cobalt Networks Bandwidth Limiting Module
May  9 12:51:36 ns kernel: Copyright (c) 1999, Cobalt Networks, Inc.
May  9 12:51:36 ns kernel: All rights reserved
May  9 12:51:43 ns kernel: portmap: RPC call returned error 111
May  9 12:51:43 ns kernel: RPC: task of released request still queued!
May  9 12:51:43 ns kernel: RPC: (task is on xprt_pending)
May  9 12:51:48 ns kernel: portmap: RPC call returned error 111
May  9 12:51:48 ns kernel: RPC: task of released request still queued!
May  9 12:51:48 ns kernel: RPC: (task is on xprt_pending)
May  9 12:51:48 ns kernel: lockd_up: makesock failed, error=-111
May  9 12:51:53 ns kernel: portmap: RPC call returned error 111
May  9 12:51:53 ns kernel: RPC: task of released request still queued!
May  9 12:51:53 ns kernel: RPC: (task is on xprt_pending)
May  9 12:51:53 ns rpc.statd[249]: unable to register (SM_PROG, SM_VERS, udp).
May  9 12:51:54 ns modprobe: can't locate module block-major-22
May  9 12:51:54 ns modprobe: can't locate module block-major-22
May  9 12:51:54 ns modprobe: can't locate module block-major-33
May  9 12:51:54 ns modprobe: can't locate module block-major-33
May  9 12:51:54 ns modprobe: can't locate module block-major-34
May  9 12:51:55 ns modprobe: can't locate module block-major-34
May  9 12:51:55 ns modprobe: can't locate module block-major-8
May  9 12:51:55 ns last message repeated 4 times
May  9 12:51:55 ns modprobe: can't locate module block-major-13
May  9 12:51:55 ns modprobe: can't locate module block-major-13
May  9 12:51:56 ns named[378]: starting (/etc/named.conf).  named GO-AWAY Mon Jan 29 22:33:12 GMT 2001 ^Iadmin@removed:/home/cs/src/bin/named