Re: [cobalt-security] Raq4 rebooting itself

["Antonio" <nino@xxxxxxxxxxx>]

----- Original Message -----
From: "Gerald Waugh" <gwaugh@xxxxxxxxxxxxxxxxxxxxxxx>
To: <cobalt-security@xxxxxxxxxxxxxxx>
Sent: Tuesday, May 20, 2003 12:53 AM
Subject: Re: [cobalt-security] Raq4 rebooting itself


> On Monday 19 May 2003 23:53, Antonio wrote:
> > Hi there,
> >
> > I have a Raq4 that since yesterday started to reboot itself for
apparently
> > no reason. There is no sign of instrusion, chkrootkit is not returning
any
> > suspicious output and I have all the security patchs installed. The CPU
> > temp is always normal (30-33 celsius), the load is very light and I'm
not
> > running under low disk space.
> >
> > There is also no clues in my logs files, this is what reports my
> > /var/messages near a reboot time:
> >
> > May 20 00:00:07 www proftpd[18243]: (localhost[127.0.0.1]) - FTP session
> > closed.
> > May 20 00:31:42 www syslogd 1.3-3: restart.
> >
> > The server restarted itself about 00:08 while I was monitoring it ...
> > Apparently no suspicous process, neither a shutdown detected ...
> >
> > Any hints/thoughts/ideias ?!? Any help would be appreciate.
>
> if you are talking about;
> May 20 00:31:42 www syslogd 1.3-3: restart.
>
> That is not a reboot, that is syslogd restarting.
> IIRC it happens once a day.

Yes, I know, but the server indeed rebooted itself at 00:08 ... This is
(suposed) the first entry after the server booted ... so far, I have no idea
why it is rebooting itself ...

Also, thats what my /log/kernel reports near 00:08 ... still not a clue ...

May 19 11:19:31 www kernel: nacctd uses obsolete (PF_INET,SOCK_PACKET)
May 20 00:31:42 www kernel: klogd 1.3-3, log source = /proc/kmsg started.

Thanx again

>
> Gerald
> --
> http://frontstreetnetworks.com | http://store.raqware.com
> ICQ: 229276628                        | AIM handle: raqware
> Front Street Networks LLC      |  Phone: 203-785-0699
> 229 Front Street, Suite C, New Haven, CT 06513-3203
>
> _______________________________________________
> cobalt-security mailing list
> cobalt-security@xxxxxxxxxxxxxxx
> http://list.cobalt.com/mailman/listinfo/cobalt-security
>