RE: [good] [cobalt-security] April fools day?

["Mark" <mark@xxxxxxxxxxxxxxxxxxxxxx>]

Tricky - the uptime says 11 hours, but there are no init messages in the log. 
Therefore, I would guess that the time changes messed up the uptime, and I don't think it rebooted.

Mark

-----Original Message-----
From: cobalt-security-admin@xxxxxxxxxxxxxxx
[mailto:cobalt-security-admin@xxxxxxxxxxxxxxx]On Behalf Of tim doyle
Sent: 02 April 2003 00:20
To: cobalt-security@xxxxxxxxxxxxxxx
Subject: Re: [good] [cobalt-security] April fools day?


Did the machine reboot, and the hardware clock is not in sync with the
system time?

Tim

----- Original Message -----
From: "Mark" <mark@xxxxxxxxxxxxxxxxxxxxxx>
To: <cobalt-security@xxxxxxxxxxxxxxx>
Sent: Tuesday, April 01, 2003 3:09 PM
Subject: [good] [cobalt-security] April fools day?


> Can anyone shed any light on this please?
>
> Strange thing happened this morning at around 5am - monitors reported that
my RAQ4 was not available for a short time. When I checked the logs, the
date had changed from April 1st 2003 to June 5th 2005.
>
> ----snip----
> Apr  1 04:45:07 ns proftpd[24521]: ns.mydomain.net
(localhost[127.0.0.1]) - FTP session closed.
> Jun  5 20:37:43 ns syslogd 1.3-3: restart.
> ----snip----
>
> ...then later (when the clock thought it was 5am again) it changed
again???
>
> Jun  6 04:37:45 ns named[407]: XSTATS 1118029065 1118000266 RR=443
RNXD=185 RFwdR=270 RDupR=0 RFail=4 RFErr=0 RErr=0 RAXFR=0 RLame=5 ROpts=0
SSysQ=259 SAns=1822 SFwdQ=106 SDupQ=13 SErr=0 RQ=1866 RIQ=0 RFwdQ=106
RDupQ=0 RTCP=138 SFwdR=270 SFail=0 SFErr=0 SNaAns=743 SNXD=202 RUQ=0 RURQ=0
RUXFR=0 RUUpd=1
> Jun 14 03:37:25 ns syslogd 1.3-3: restart.
> Jun 14 03:37:27 ns named[406]: starting (/etc/named.conf).  named
8.2.3-REL Tue Sep 18 12:35:18 PDT 2001
^Iroot@xxxxxxxxxxxxxxx:/home/redhat/BUILD/bind-8.2.3/src/bin/named
>
> ...annoyingly, this makes a mess of the timestamps, stops cron working
etc.
> chkrootkit says everything is clear - and otherwise the server seems fine.
> Any ideas anyone?
>
> TIA
> Mark Remde
> _______________________________________________
> cobalt-security mailing list
> cobalt-security@xxxxxxxxxxxxxxx
> http://list.cobalt.com/mailman/listinfo/cobalt-security

_______________________________________________
cobalt-security mailing list
cobalt-security@xxxxxxxxxxxxxxx
http://list.cobalt.com/mailman/listinfo/cobalt-security