Root down was tun?

A

Armin

New Member
Hallo,

jetzt hat's mich auch getroffen, die angebliche 99,99% uptime Marke ist bei mir gescheitert.

Folgendes; Dedizierter Server 1HE in nem Rack...

Server offline, reagiert nicht und traceroute kommt nur bis zum Switch.

die 24 STunden Hotlin (0900 !!!) kickt mich nach 2,5 minuten weil kein Mitarbeiter da ist.

Das nenn ich mal Service!

Was kann ich jetzt noch tun ausser warten und einen besseren host suchen?
 
Nichts, wobei die Frage ist ob es jemand gibt der dir eine noch höhere Verfügbarkeit garantiert. Und auf was ist diese Verfügbarkeit gegeben? Auf Netzwerkverfügbarkeit, Hardwareverfügbarkeit oder was?
 
Das ganze ist jetzt schon seit gestern Abend um 20 Uhr bis jetzt andauernd, habe mit dem Hoster telefoniert und er will 39,90 zum starten.

Auf dem Server lief nur Apache2, Teamspeak2 und ein kleiner gta samp game server.

Serverdaten: 2 GB Ram, 2x 2,2 Ghz AMD ...

Garantiert wird eine Uptime von 99,5 % im Jahresmittel :rolleyes:
 
Gibt es denn schon einen Hinweis für die Ursache? Wenn es am Netzwerk liegt, können Dir schwerlich 39.95 EUR für einen Reboot berechnet werden. Was ist das überhaupt für ein (unverschämter) Preis?

Ich kenne ja Gepflogenheiten, 5-10 EUR für einen Reboot zu verlangen (u. U. ausserhalb der Geschäftszeiten), aber knapp 40 EUR sind schon eine Ansage. Zumal das nichts mit Ursachenforschung zu tun hat. Wenn etwas schief läuft, ist die Kiste danach genau sowenig zu erreichen wie jetzt.

Was kostet der Rechner im Monat?
 
der kostet 35 euro im monat mit 500 GB traffic.

er meinte zu mir das ich das ding hätte viritualisieren sollen, aber warum?

Ein Teamspeak2 server n Apache2 (kein MySQL) wo nur ne index ist und sonst nix und der Gameserver wo 2% von der CPU braucht + 1-2kb/sek pro Client.

Absolut lächerlich, der Traffic war gestern auch bei 1 GB am Tag gleichmäßig verteilt.

Letzter Server Restart war vor zwei tagen am abend, weil ich was probiert hatte.

Er möchte mir wirklich 39,90 ein HandOn an Sonn- und Feiertags berechnen...
 
Hands-On für 39.95 EUR am Wochenende ist für 15 Minuten der normale Tarif und etwas anderes als ein Reboot. Also völlig ok die Ansage. Zumal es ja durchklingt, dass Du u. U. durch das "Probieren" etwas so verändert hast, dass die Kiste gestern Abend down gegangen ist.

Ist wahrscheinlich nicht das, was Du hören möchtest, aber halt der marktübliche Rahmen. Ein Tip: Manche Anbieter bieten standardmäßig eine KVM-over-IP Lösung mit an (Hosteurope, Serverloft, Hetzner kostenlos für 2 Stunden) - damit kann man die eigenen Fehler gut wieder geradebiegen ohne Remote Hands in Anspruch nehmen zu müssen. Allerdings gibt es die Server dort nicht ab 35 EUR.
 
Last edited by a moderator:
Das mit dem probieren war ob ich ein /etc/init.d/ts2 start hin bringe, und ob der beim reboot automatisch mit startet.

ich bin eh dabei, mir fehlt nurnoch das Geld auf Hetzner umzusteigen.
 
Das Setzen der Symlinks in die Runlevel-Verzeichnisse geht mit

Code: 
sysv-rc-conf

ganz komfortabel.
 
dev said:
Ein Tip: Manche Anbieter bieten standardmäßig eine KVM-over-IP Lösung mit an (Hosteurope, Serverloft, Hetzner kostenlos für 2 Stunden)
Click to expand...

Andere auch, zwar kein KVMoverIP, aber serielle Konsole tuts locker auch.
 
So das ding is wieder online, wei der teufel warum er einfach verreckt.

Wie kann ich das jetz rausfinden? hab schon alles nach abgesucht.

aus meinem syslog sind das die letzen Zeilen.

Code: 
Jun  5 19:55:01 setup /USR/SBIN/CRON[21322]: (root) CMD (/usr/share/vzctl/scripts/vpsreboot)
Jun  5 19:55:01 setup /USR/SBIN/CRON[21324]: (root) CMD (if [ -x /usr/bin/vnstat ] && [ `ls /var/lib/vnstat/ | wc -l` -ge 1 ]; then /usr/bin/vnstat -u; fi)
Jun  5 19:55:01 setup /USR/SBIN/CRON[21326]: (root) CMD (/usr/share/vzctl/scripts/vpsnetclean)
Jun  5 20:00:01 setup /USR/SBIN/CRON[21379]: (root) CMD (/usr/share/vzctl/scripts/vpsreboot)
Jun  5 20:00:01 setup /USR/SBIN/CRON[21381]: (root) CMD (if [ -x /usr/bin/vnstat ] && [ `ls /var/lib/vnstat/ | wc -l` -ge 1 ]; then /usr/bin/vnstat -u; fi)
Jun  5 20:00:01 setup /USR/SBIN/CRON[21383]: (root) CMD (/usr/share/vzctl/scripts/vpsnetclean)
Jun  5 20:05:01 setup /USR/SBIN/CRON[21437]: (root) CMD (/usr/share/vzctl/scripts/vpsreboot)
Jun  5 20:05:01 setup /USR/SBIN/CRON[21438]: (root) CMD (if [ -x /usr/bin/vnstat ] && [ `ls /var/lib/vnstat/ | wc -l` -ge 1 ]; then /usr/bin/vnstat -u; fi)
Jun  5 20:05:01 setup /USR/SBIN/CRON[21440]: (root) CMD (/usr/share/vzctl/scripts/vpsnetclean)
Jun  5 20:09:01 setup /USR/SBIN/CRON[21488]: (root) CMD (  [ -d /var/lib/php5 ] && find /var/lib/php5/ -type f -cmin +$(/usr/lib/php5/maxlifetime) -print0 | xargs -r -0 rm)
Jun  5 20:10:01 setup /USR/SBIN/CRON[21501]: (root) CMD (/usr/share/vzctl/scripts/vpsreboot)
Jun  5 20:10:01 setup /USR/SBIN/CRON[21505]: (root) CMD (if [ -x /usr/bin/vnstat ] && [ `ls /var/lib/vnstat/ | wc -l` -ge 1 ]; then /usr/bin/vnstat -u; fi)
Jun  5 20:10:01 setup /USR/SBIN/CRON[21504]: (root) CMD (/usr/share/vzctl/scripts/vpsnetclean)
Jun  5 20:15:01 setup /USR/SBIN/CRON[21560]: (root) CMD (if [ -x /usr/bin/vnstat ] && [ `ls /var/lib/vnstat/ | wc -l` -ge 1 ]; then /usr/bin/vnstat -u; fi)
Jun  5 20:15:01 setup /USR/SBIN/CRON[21562]: (root) CMD (/usr/share/vzctl/scripts/vpsnetclean)
Jun  5 20:15:01 setup /USR/SBIN/CRON[21563]: (root) CMD (/usr/share/vzctl/scripts/vpsreboot)
Jun  5 20:17:01 setup /USR/SBIN/CRON[21571]: (root) CMD (   cd / && run-parts --report /etc/cron.hourly)
Jun  5 20:20:01 setup /USR/SBIN/CRON[21620]: (root) CMD (if [ -x /usr/bin/vnstat ] && [ `ls /var/lib/vnstat/ | wc -l` -ge 1 ]; then /usr/bin/vnstat -u; fi)
Jun  5 20:20:01 setup /USR/SBIN/CRON[21622]: (root) CMD (/usr/share/vzctl/scripts/vpsreboot)
Jun  5 20:20:01 setup /USR/SBIN/CRON[21623]: (root) CMD (/usr/share/vzctl/scripts/vpsnetclean)
Jun  5 20:25:01 setup /USR/SBIN/CRON[21675]: (root) CMD (/usr/share/vzctl/scripts/vpsreboot)
Jun  5 20:25:01 setup /USR/SBIN/CRON[21677]: (root) CMD (if [ -x /usr/bin/vnstat ] && [ `ls /var/lib/vnstat/ | wc -l` -ge 1 ]; then /usr/bin/vnstat -u; fi)
Jun  5 20:25:01 setup /USR/SBIN/CRON[21679]: (root) CMD (/usr/share/vzctl/scripts/vpsnetclean)
Jun  5 20:30:01 setup /USR/SBIN/CRON[21732]: (root) CMD (/usr/share/vzctl/scripts/vpsreboot)
Jun  5 20:30:01 setup /USR/SBIN/CRON[21736]: (root) CMD (/usr/share/vzctl/scripts/vpsnetclean)
Jun  5 20:35:01 setup /USR/SBIN/CRON[21791]: (root) CMD (if [ -x /usr/bin/vnstat ] && [ `ls /var/lib/vnstat/ | wc -l` -ge 1 ]; then /usr/bin/vnstat -u; fi)
Jun  5 20:35:01 setup /USR/SBIN/CRON[21793]: (root) CMD (/usr/share/vzctl/scripts/vpsnetclean)

Das läuft aber immer, weil ja openvz noch mit drauf ist.


im Debug.log fehlt ein ganzer Tag obwohl alle ich nichts an dem geändert hatte.

Code: 
Jun  4 23:12:45 setup kernel: ACPI: IRQ2 used by override.
Jun  4 23:12:45 setup kernel: ACPI: IRQ9 used by override.
Jun  4 23:12:45 setup kernel: PCI: Probing PCI hardware (bus 00)
Jun  4 23:12:45 setup kernel: Boot video device is 0000:01:00.0
Jun  4 23:12:45 setup kernel: ACPI: PCI Interrupt Routing Table [\_SB_.PCI0._PRT]
Jun  4 23:12:45 setup kernel: pnp: ACPI device : hid PNP0C01
Jun  4 23:12:45 setup kernel: pnp: ACPI device : hid PNP0A03
Jun  4 23:12:45 setup kernel: pnp: ACPI device : hid PNP0C02
Jun  4 23:12:45 setup kernel: pnp: ACPI device : hid PNP0C02
Jun  4 23:12:45 setup kernel: pnp: ACPI device : hid PNP0200
Jun  4 23:12:45 setup kernel: pnp: ACPI device : hid PNP0B00
Jun  4 23:12:45 setup kernel: pnp: ACPI device : hid PNP0800
Jun  4 23:12:45 setup kernel: pnp: ACPI device : hid PNP0C04
Jun  4 23:12:45 setup kernel: pnp: ACPI device : hid PNP0700
Jun  4 23:12:45 setup kernel: pnp: ACPI device : hid PNP0501
Jun  4 23:12:45 setup kernel: pnp: ACPI device : hid PNP0501
Jun  4 23:12:45 setup kernel: pnp: ACPI device : hid PNP0400
Jun  4 23:12:45 setup kernel: pnp: the driver 'system' has been registered
Jun  4 23:12:45 setup kernel: pnp: match found with the PnP device '00:00' and the driver 'system'
Jun  4 23:12:45 setup kernel: pnp: match found with the PnP device '00:02' and the driver 'system'
Jun  4 23:12:45 setup kernel: pnp: match found with the PnP device '00:03' and the driver 'system'
Jun  4 23:12:45 setup kernel: PCI: Setting latency timer of device 0000:00:01.0 to 64
Jun  4 23:12:45 setup kernel: pnp: the driver 'serial' has been registered
Jun  4 23:12:45 setup kernel: pnp: match found with the PnP device '00:09' and the driver 'serial'
Jun  4 23:12:45 setup kernel: pnp: match found with the PnP device '00:0a' and the driver 'serial'
Jun  4 23:12:45 setup kernel: pnp: the driver 'i8042 kbd' has been registered
Jun  4 23:12:45 setup kernel: pnp: the driver 'i8042 aux' has been registered
Jun  4 23:12:45 setup kernel: pnp: the driver 'i8042 kbd' has been unregistered
Jun  4 23:12:45 setup kernel: pnp: the driver 'i8042 aux' has been unregistered
Jun  4 23:12:45 setup kernel: libata version 2.00 loaded.
Jun  4 23:12:45 setup kernel: sata_via 0000:00:0f.0: version 2.0
Jun  4 23:12:45 setup kernel: sda: Mode Sense: 00 3a 00 00
Jun  4 23:12:45 setup kernel: sda: Mode Sense: 00 3a 00 00
Jun  4 23:12:45 setup kernel: sdb: Mode Sense: 00 3a 00 00
Jun  4 23:12:45 setup kernel: sdb: Mode Sense: 00 3a 00 00
Jun  4 23:12:45 setup kernel: Probing IDE interface ide0...
Jun  4 23:12:45 setup kernel: Probing IDE interface ide1...
Jun  4 23:12:45 setup kernel: Probing IDE interface ide0...
Jun  4 23:12:45 setup kernel: Probing IDE interface ide1...
Jun  4 23:12:45 setup kernel: pnp: the driver 'parport_pc' has been registered
Jun  4 23:12:45 setup kernel: pnp: match found with the PnP device '00:0b' and the driver 'parport_pc'
Jun  4 23:12:45 setup kernel: PCI: Setting latency timer of device 0000:00:11.5 to 64
Jun  4 23:12:58 setup kernel: eth0: no IPv6 routers present
Jun  6 16:48:57 setup kernel: ACPI: RSDP (v000 VIAK8M                                ) @ 0x00000000000f78c0
Jun  6 16:48:57 setup kernel: ACPI: RSDT (v001 VIAK8M AWRDACPI 0x42302e31 AWRD 0x00000000) @ 0x000000007bef3040
Jun  6 16:48:57 setup kernel: ACPI: FADT (v001 VIAK8M AWRDACPI 0x42302e31 AWRD 0x00000000) @ 0x000000007bef30c0
Jun  6 16:48:57 setup kernel: ACPI: MADT (v001 VIAK8M AWRDACPI 0x42302e31 AWRD 0x00000000) @ 0x000000007bef8580
Jun  6 16:48:57 setup kernel: ACPI: DSDT (v001 VIAK8M AWRDACPI 0x00001000 MSFT 0x0100000e) @ 0x0000000000000000
Jun  6 16:48:57 setup kernel: NUMA: Using 63 for the hash shift.
Jun  6 16:48:57 setup kernel: On node 0 totalpages: 499693
Jun  6 16:48:57 setup kernel:   DMA zone: 3041 pages, LIFO batch:0
Jun  6 16:48:57 setup kernel:   DMA32 zone: 496652 pages, LIFO batch:31
Jun  6 16:48:57 setup kernel: ACPI: Local APIC address 0xfee00000
Jun  6 16:48:57 setup kernel: ACPI: IRQ0 used by override.
Jun  6 16:48:57 setup kernel: ACPI: IRQ2 used by override.
Jun  6 16:48:57 setup kernel: ACPI: IRQ9 used by override.
Jun  6 16:48:57 setup kernel: PCI: Probing PCI hardware (bus 00)
Jun  6 16:48:57 setup kernel: Boot video device is 0000:01:00.0
Jun  6 16:48:57 setup kernel: ACPI: PCI Interrupt Routing Table [\_SB_.PCI0._PRT]
Jun  6 16:48:57 setup kernel: pnp: ACPI device : hid PNP0C01
Jun  6 16:48:57 setup kernel: pnp: ACPI device : hid PNP0A03
Jun  6 16:48:57 setup kernel: pnp: ACPI device : hid PNP0C02
Jun  6 16:48:57 setup kernel: pnp: ACPI device : hid PNP0C02
Jun  6 16:48:57 setup kernel: pnp: ACPI device : hid PNP0200
Jun  6 16:48:57 setup kernel: pnp: ACPI device : hid PNP0B00
Jun  6 16:48:57 setup kernel: pnp: ACPI device : hid PNP0800
Jun  6 16:48:57 setup kernel: pnp: ACPI device : hid PNP0C04
Jun  6 16:48:57 setup kernel: pnp: ACPI device : hid PNP0700

Der Access Log is ganz interessant:

Code: 
Jun  6 19:23:34 setup proftpd: (pam_unix) session opened for user alex by (uid=0)
Jun  6 19:23:46 setup proftpd: (pam_unix) session closed for user alex
Jun  6 19:25:01 setup CRON[3013]: (pam_unix) session opened for user root by (uid=0)
Jun  6 19:25:01 setup CRON[3015]: (pam_unix) session opened for user root by (uid=0)
Jun  6 19:25:01 setup CRON[3017]: (pam_unix) session opened for user root by (uid=0)
Jun  6 19:25:01 setup CRON[3013]: (pam_unix) session closed for user root
Jun  6 19:25:01 setup CRON[3015]: (pam_unix) session closed for user root
Jun  6 19:25:01 setup CRON[3017]: (pam_unix) session closed for user root
Jun  6 19:30:01 setup CRON[3023]: (pam_unix) session opened for user root by (uid=0)
Jun  6 19:30:01 setup CRON[3025]: (pam_unix) session opened for user root by (uid=0)
Jun  6 19:30:01 setup CRON[3027]: (pam_unix) session opened for user root by (uid=0)
Jun  6 19:30:01 setup CRON[3023]: (pam_unix) session closed for user root
Jun  6 19:30:01 setup CRON[3027]: (pam_unix) session closed for user root
Jun  6 19:30:01 setup CRON[3025]: (pam_unix) session closed for user root
[COLOR="Red"]Jun  6 19:30:13 setup sshd[3033]: Address 85.8.67.203 maps to mietserver-hosting.de, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT![/COLOR]
Jun  6 19:30:13 setup sshd[3033]: Accepted password for root from 85.8.67.203 port 1952 ssh2
Jun  6 19:30:14 setup sshd[3033]: subsystem request for sftp
Jun  6 19:30:14 setup sshd[3035]: (pam_unix) session opened for user root by (uid=0)
Jun  6 19:35:01 setup CRON[3036]: (pam_unix) session opened for user root by (uid=0)
Jun  6 19:35:02 setup CRON[3038]: (pam_unix) session opened for user root by (uid=0)

und

Ab dem Zeitpunkt war der root unerreichbar, trotzdem steht ein fehlerhafter Loginversuch von mir in der auth.log.

Code: 
Jun  6 20:09:01 setup CRON[3138]: (pam_unix) session opened for user root by (uid=0)
Jun  6 20:09:01 setup CRON[3138]: (pam_unix) session closed for user root
Jun  6 20:10:01 setup CRON[3146]: (pam_unix) session opened for user root by (uid=0)
Jun  6 20:10:01 setup CRON[3148]: (pam_unix) session opened for user root by (uid=0)
Jun  6 20:10:01 setup CRON[3150]: (pam_unix) session opened for user root by (uid=0)
Jun  6 20:10:01 setup CRON[3148]: (pam_unix) session closed for user root
Jun  6 20:10:01 setup CRON[3146]: (pam_unix) session closed for user root
Jun  6 20:10:01 setup CRON[3150]: (pam_unix) session closed for user root
Jun  6 20:12:32 setup sshd[3158]: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.158.205.224  user=root
Jun  6 20:12:35 setup sshd[3158]: Failed password for root from 61.158.205.224 port 53978 ssh2
Jun  6 20:12:38 setup sshd[3160]: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.158.205.224  user=root
Jun  6 20:12:40 setup sshd[3160]: Failed password for root from 61.158.205.224 port 57455 ssh2
Jun  6 20:12:43 setup sshd[3162]: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.158.205.224  user=root
Jun  6 20:12:45 setup sshd[3162]: Failed password for root from 61.158.205.224 port 60050 ssh2
Jun  6 20:12:50 setup sshd[3164]: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.158.205.224  user=root
Jun  6 20:12:52 setup sshd[3164]: Failed password for root from 61.158.205.224 port 34271 ssh2
Jun  6 20:12:57 setup sshd[3166]: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.158.205.224  user=root
Jun  6 20:12:59 setup sshd[3166]: Failed password for root from 61.158.205.224 port 37324 ssh2
Jun  6 20:13:04 setup sshd[3168]: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.158.205.224  user=root
Jun  6 20:13:06 setup sshd[3168]: Failed password for root from 61.158.205.224 port 40275 ssh2
Jun  6 20:15:01 setup CRON[3185]: (pam_unix) session opened for user root by (uid=0)
Jun  6 20:15:01 setup CRON[3187]: (pam_unix) session opened for user root by (uid=0)
Jun  6 20:15:01 setup CRON[3189]: (pam_unix) session opened for user root by (uid=0)
Jun  6 20:15:01 setup CRON[3185]: (pam_unix) session closed for user root
Jun  6 20:15:01 setup CRON[3187]: (pam_unix) session closed for user root
Jun  6 20:15:01 setup CRON[3189]: (pam_unix) session closed for user root
Jun  6 20:17:01 setup CRON[3197]: (pam_unix) session opened for user root by (uid=0)
Jun  6 20:17:01 setup CRON[3197]: (pam_unix) session closed for user root
Jun  6 20:20:01 setup CRON[3201]: (pam_unix) session opened for user root by (uid=0)
Jun  6 20:20:01 setup CRON[3203]: (pam_unix) session opened for user root by (uid=0)
Jun  6 20:20:01 setup CRON[3205]: (pam_unix) session opened for user root by (uid=0)
Jun  6 20:20:01 setup CRON[3201]: (pam_unix) session closed for user root
Jun  6 20:20:01 setup CRON[3205]: (pam_unix) session closed for user root
Jun  6 20:20:01 setup CRON[3203]: (pam_unix) session closed for user root
Jun  6 20:25:01 setup CRON[3217]: (pam_unix) session opened for user root by (uid=0)
Jun  6 20:25:01 setup CRON[3219]: (pam_unix) session opened for user root by (uid=0)
Jun  6 20:25:01 setup CRON[3221]: (pam_unix) session opened for user root by (uid=0)
Jun  6 20:25:01 setup CRON[3217]: (pam_unix) session closed for user root
Jun  6 20:25:01 setup CRON[3219]: (pam_unix) session closed for user root
Jun  6 20:25:01 setup CRON[3221]: (pam_unix) session closed for user root
Jun  6 20:26:22 setup proftpd: (pam_unix) session opened for user badboy by (uid=0)
Jun  6 20:26:30 setup proftpd: (pam_unix) session opened for user badboy by (uid=0)
Jun  6 20:27:30 setup proftpd: (pam_unix) session closed for user badboy
Jun  6 20:29:25 setup proftpd: (pam_unix) session opened for user badboy by (uid=0)
Jun  6 20:30:01 setup CRON[3234]: (pam_unix) session opened for user root by (uid=0)
Jun  6 20:30:01 setup CRON[3236]: (pam_unix) session opened for user root by (uid=0)
Jun  6 20:30:01 setup CRON[3238]: (pam_unix) session opened for user root by (uid=0)
Jun  6 20:35:01 setup CRON[3293]: (pam_unix) session closed for user root
Jun  6 20:35:01 setup CRON[3295]: (pam_unix) session closed for user root
Jun  6 20:35:01 setup CRON[3297]: (pam_unix) session closed for user root
Jun  6 20:36:32 setup sshd[3318]: Did not receive identification string from UNKNOWN
Jun  6 20:37:26 setup proftpd: (pam_unix) session opened for user badboy by (uid=0)
Jun  6 20:39:01 setup CRON[3331]: (pam_unix) session opened for user root by (uid=0)
Jun  6 20:39:01 setup CRON[3331]: (pam_unix) session closed for user root
Jun  6 20:39:35 setup proftpd: (pam_unix) session closed for user badboy
Jun  6 20:40:01 setup CRON[3346]: (pam_unix) session opened for user root by (uid=0)
Jun  6 20:40:01 setup CRON[3348]: (pam_unix) session opened for user root by (uid=0)
Jun  6 20:40:01 setup CRON[3350]: (pam_unix) session opened for user root by (uid=0)
Jun  6 20:40:01 setup CRON[3346]: (pam_unix) session closed for user root
Jun  6 20:40:01 setup CRON[3350]: (pam_unix) session closed for user root
Jun  6 20:40:01 setup CRON[3348]: (pam_unix) session closed for user root
Jun  6 20:41:21 setup proftpd: (pam_unix) session opened for user badboy by (uid=0)
Jun  6 20:41:37 setup proftpd: (pam_unix) session opened for user badboy by (uid=0)
Jun  6 20:43:01 setup proftpd: (pam_unix) session closed for user badboy
Jun  6 20:45:01 setup CRON[3364]: (pam_unix) session opened for user root by (uid=0)
Jun  6 20:45:01 setup CRON[3366]: (pam_unix) session opened for user root by (uid=0)
Jun  6 20:45:01 setup CRON[3368]: (pam_unix) session opened for user root by (uid=0)
Jun  6 20:45:01 setup CRON[3364]: (pam_unix) session closed for user root
Jun  6 20:45:01 setup CRON[3368]: (pam_unix) session closed for user root
Jun  6 20:45:01 setup CRON[3366]: (pam_unix) session closed for user root
Jun  6 20:46:17 setup proftpd: (pam_unix) session closed for user badboy
Jun  6 20:48:42 setup proftpd: (pam_unix) session closed for user badboy
Jun  6 20:49:26 setup proftpd: (pam_unix) session opened for user badboy by (uid=0)
Jun  6 20:49:39 setup proftpd: (pam_unix) session opened for user badboy by (uid=0)
Jun  6 20:50:01 setup CRON[3383]: (pam_unix) session opened for user root by (uid=0)
Jun  6 20:50:01 setup CRON[3385]: (pam_unix) session opened for user root by (uid=0)
Jun  6 20:50:01 setup CRON[3387]: (pam_unix) session opened for user root by (uid=0)
Jun  6 20:50:01 setup CRON[3383]: (pam_unix) session closed for user root
Jun  6 20:50:01 setup CRON[3385]: (pam_unix) session closed for user root
Jun  6 20:50:01 setup CRON[3387]: (pam_unix) session closed for user root
Jun  6 20:51:20 setup proftpd: (pam_unix) session closed for user badboy
Jun  6 20:51:38 setup proftpd: (pam_unix) session opened for user badboy by (uid=0)
Jun  6 20:52:39 setup proftpd: (pam_unix) session closed for user badboy
Jun  6 20:55:01 setup CRON[3440]: (pam_unix) session opened for user root by (uid=0)
Jun  6 20:55:01 setup CRON[3442]: (pam_unix) session opened for user root by (uid=0)
Jun  6 20:55:01 setup CRON[3444]: (pam_unix) session opened for user root by (uid=0)
Jun  6 20:55:01 setup CRON[3440]: (pam_unix) session closed for user root
Jun  6 20:55:01 setup CRON[3442]: (pam_unix) session closed for user root
Jun  6 20:55:01 setup CRON[3444]: (pam_unix) session closed for user root
Jun  6 21:00:01 setup CRON[3456]: (pam_unix) session opened for user root by (uid=0)
Jun  6 21:00:01 setup CRON[3458]: (pam_unix) session opened for user root by (uid=0)
Jun  6 21:00:01 setup CRON[3460]: (pam_unix) session opened for user root by (uid=0)
Jun  6 21:00:01 setup CRON[3456]: (pam_unix) session closed for user root
Jun  6 21:00:01 setup CRON[3460]: (pam_unix) session closed for user root
Jun  6 21:00:01 setup CRON[3458]: (pam_unix) session closed for user root
Jun  6 21:00:45 setup proftpd: (pam_unix) session opened for user badboy by (uid=0)
Jun  6 21:01:52 setup proftpd: (pam_unix) session closed for user badboy
Jun  6 21:02:14 setup proftpd: (pam_unix) session opened for user badboy by (uid=0)
Jun  6 21:03:14 setup proftpd: (pam_unix) session closed for user badboy
Jun  6 21:03:44 setup proftpd: (pam_unix) session opened for user badboy by (uid=0)
Jun  6 21:04:08 setup proftpd: (pam_unix) session closed for user badboy
Jun  6 21:04:08 setup proftpd: (pam_unix) session opened for user badboy by (uid=0)
Jun  6 21:05:01 setup CRON[3487]: (pam_unix) session opened for user root by (uid=0)
Jun  6 21:05:01 setup CRON[3489]: (pam_unix) session opened for user root by (uid=0)
Jun  6 21:05:01 setup CRON[3491]: (pam_unix) session opened for user root by (uid=0)
Jun  6 21:05:01 setup CRON[3487]: (pam_unix) session closed for user root
Jun  6 21:05:01 setup CRON[3491]: (pam_unix) session closed for user root
Jun  6 21:05:01 setup CRON[3489]: (pam_unix) session closed for user root
Jun  6 21:05:12 setup proftpd: (pam_unix) session closed for user badboy
Jun  6 21:05:16 setup proftpd: (pam_unix) session closed for user badboy
Jun  6 21:05:16 setup proftpd: (pam_unix) session opened for user badboy by (uid=0)
Jun  6 21:05:29 setup proftpd: (pam_unix) session opened for user badboy by (uid=0)
Jun  6 21:06:22 setup proftpd: (pam_unix) session closed for user badboy
Jun  6 21:06:22 setup proftpd: (pam_unix) session opened for user badboy by (uid=0)
Jun  6 21:07:25 setup proftpd: (pam_unix) session closed for user badboy
Jun  6 21:09:01 setup CRON[3506]: (pam_unix) session opened for user root by (uid=0)
Jun  6 21:09:01 setup CRON[3506]: (pam_unix) session closed for user root
Jun  6 21:10:01 setup CRON[3516]: (pam_unix) session opened for user root by (uid=0)
Jun  6 21:10:01 setup CRON[3518]: (pam_unix) session opened for user root by (uid=0)
Jun  6 21:10:01 setup CRON[3520]: (pam_unix) session opened for user root by (uid=0)
Jun  6 21:10:01 setup CRON[3516]: (pam_unix) session closed for user root
Jun  6 21:10:01 setup CRON[3520]: (pam_unix) session closed for user root
Jun  6 21:10:01 setup CRON[3518]: (pam_unix) session closed for user root
Jun  6 21:15:01 setup CRON[3534]: (pam_unix) session opened for user root by (uid=0)
Jun  6 21:15:01 setup CRON[3536]: (pam_unix) session opened for user root by (uid=0)
Jun  6 21:15:01 setup CRON[3538]: (pam_unix) session opened for user root by (uid=0)
Jun  6 21:15:01 setup CRON[3534]: (pam_unix) session closed for user root
Jun  6 21:15:01 setup CRON[3536]: (pam_unix) session closed for user root
Jun  6 21:15:01 setup CRON[3538]: (pam_unix) session closed for user root
Jun  6 21:16:32 setup proftpd: (pam_unix) session closed for user badboy
Jun  6 21:17:01 setup CRON[3546]: (pam_unix) session opened for user root by (uid=0)
Jun  6 21:17:01 setup CRON[3546]: (pam_unix) session closed for user root
Jun  6 21:20:01 setup CRON[3556]: (pam_unix) session opened for user root by (uid=0)
Jun  6 21:20:01 setup CRON[3558]: (pam_unix) session opened for user root by (uid=0)
Jun  6 21:20:01 setup CRON[3560]: (pam_unix) session opened for user root by (uid=0)
Jun  6 21:20:01 setup CRON[3556]: (pam_unix) session closed for user root
Jun  6 21:20:01 setup CRON[3560]: (pam_unix) session closed for user root
Jun  6 21:20:01 setup CRON[3558]: (pam_unix) session closed for user root
Jun  6 21:25:01 setup CRON[3574]: (pam_unix) session opened for user root by (uid=0)
Jun  6 21:25:01 setup CRON[3576]: (pam_unix) session opened for user root by (uid=0)
Jun  6 21:25:01 setup CRON[3578]: (pam_unix) session opened for user root by (uid=0)
Jun  6 21:25:01 setup CRON[3578]: (pam_unix) session closed for user root
Jun  6 21:25:01 setup CRON[3574]: (pam_unix) session closed for user root
Jun  6 21:25:01 setup CRON[3576]: (pam_unix) session closed for user root
Jun  6 21:30:01 setup CRON[3592]: (pam_unix) session opened for user root by (uid=0)
Jun  6 21:30:01 setup CRON[3594]: (pam_unix) session opened for user root by (uid=0)
Jun  6 21:30:01 setup CRON[3596]: (pam_unix) session opened for user root by (uid=0)
Jun  6 21:30:01 setup CRON[3592]: (pam_unix) session closed for user root
Jun  6 21:30:01 setup CRON[3596]: (pam_unix) session closed for user root
Jun  6 21:30:01 setup CRON[3594]: (pam_unix) session closed for user root
Jun  6 21:35:01 setup CRON[3610]: (pam_unix) session opened for user root by (uid=0)
Jun  6 21:35:01 setup CRON[3612]: (pam_unix) session opened for user root by (uid=0)
Jun  6 21:35:01 setup CRON[3614]: (pam_unix) session opened for user root by (uid=0)
Jun  6 21:35:01 setup CRON[3610]: (pam_unix) session closed for user root
Jun  6 21:35:01 setup CRON[3614]: (pam_unix) session closed for user root
Jun  6 21:35:01 setup CRON[3612]: (pam_unix) session closed for user root
Jun  6 21:39:01 setup CRON[3626]: (pam_unix) session opened for user root by (uid=0)
Jun  6 21:39:01 setup CRON[3626]: (pam_unix) session closed for user root
Jun  6 21:40:01 setup CRON[3636]: (pam_unix) session opened for user root by (uid=0)
Jun  6 21:40:02 setup CRON[3638]: (pam_unix) session opened for user root by (uid=0)
Jun  6 21:40:02 setup CRON[3640]: (pam_unix) session opened for user root by (uid=0)
Jun  6 21:40:02 setup CRON[3636]: (pam_unix) session closed for user root
Jun  6 21:40:02 setup CRON[3640]: (pam_unix) session closed for user root
Jun  6 21:40:02 setup CRON[3638]: (pam_unix) session closed for user root
Jun  6 21:45:01 setup CRON[3654]: (pam_unix) session opened for user root by (uid=0)
Jun  6 21:45:01 setup CRON[3656]: (pam_unix) session opened for user root by (uid=0)
Jun  6 21:45:01 setup CRON[3658]: (pam_unix) session opened for user root by (uid=0)
Jun  6 21:45:01 setup CRON[3658]: (pam_unix) session closed for user root
Jun  6 21:45:01 setup CRON[3654]: (pam_unix) session closed for user root
Jun  6 21:45:01 setup CRON[3656]: (pam_unix) session closed for user root
Jun  6 21:50:01 setup CRON[3673]: (pam_unix) session opened for user root by (uid=0)
Jun  6 21:50:01 setup CRON[3675]: (pam_unix) session opened for user root by (uid=0)
Jun  6 21:50:01 setup CRON[3677]: (pam_unix) session opened for user root by (uid=0)
Jun  6 21:50:01 setup CRON[3673]: (pam_unix) session closed for user root
Jun  6 21:50:01 setup CRON[3677]: (pam_unix) session closed for user root
Jun  6 21:50:01 setup CRON[3675]: (pam_unix) session closed for user root
Jun  6 21:55:01 setup CRON[3691]: (pam_unix) session opened for user root by (uid=0)
Jun  6 21:55:01 setup CRON[3693]: (pam_unix) session opened for user root by (uid=0)
Jun  6 21:55:01 setup CRON[3695]: (pam_unix) session opened for user root by (uid=0)
Jun  6 21:55:01 setup CRON[3691]: (pam_unix) session closed for user root
Jun  6 21:55:01 setup CRON[3695]: (pam_unix) session closed for user root
Jun  6 21:55:01 setup CRON[3693]: (pam_unix) session closed for user root
Jun  6 22:00:01 setup CRON[3709]: (pam_unix) session opened for user root by (uid=0)
Jun  6 22:00:01 setup CRON[3711]: (pam_unix) session opened for user root by (uid=0)
Jun  6 22:00:01 setup CRON[3713]: (pam_unix) session opened for user root by (uid=0)
Jun  6 22:00:01 setup CRON[3709]: (pam_unix) session closed for user root
Jun  6 22:00:01 setup CRON[3713]: (pam_unix) session closed for user root
Jun  6 22:00:01 setup CRON[3711]: (pam_unix) session closed for user root
Jun  6 22:00:38 setup sshd[3719]: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.103.95.221  user=root
Jun  6 22:00:40 setup sshd[3719]: Failed password for root from 202.103.95.221 port 60665 ssh2
Jun  6 22:00:42 setup sshd[3721]: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.103.95.221  user=root
Jun  6 22:00:45 setup sshd[3721]: Failed password for root from 202.103.95.221 port 2892 ssh2
Jun  6 22:00:48 setup sshd[3723]: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.103.95.221  user=root
Jun  6 22:00:50 setup sshd[3723]: Failed password for root from 202.103.95.221 port 56849 ssh2
Jun  6 22:00:53 setup sshd[3725]: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.103.95.221  user=root
Jun  6 22:00:56 setup sshd[3725]: Failed password for root from 202.103.95.221 port 50900 ssh2
Jun  6 22:00:59 setup sshd[3727]: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.103.95.221  user=root
Jun  6 22:01:01 setup sshd[3727]: Failed password for root from 202.103.95.221 port 65385 ssh2
Jun  6 22:01:04 setup sshd[3729]: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.103.95.221  user=root
Jun  6 22:01:06 setup sshd[3729]: Failed password for root from 202.103.95.221 port 35639 ssh2
Jun  6 22:05:01 setup CRON[3743]: (pam_unix) session opened for user root by (uid=0)
Jun  6 22:05:01 setup CRON[3745]: (pam_unix) session opened for user root by (uid=0)
Jun  6 22:05:01 setup CRON[3747]: (pam_unix) session opened for user root by (uid=0)
Jun  6 22:05:01 setup CRON[3743]: (pam_unix) session closed for user root
Jun  6 22:05:01 setup CRON[3747]: (pam_unix) session closed for user root
Jun  6 22:05:01 setup CRON[3745]: (pam_unix) session closed for user root
Jun  6 22:09:01 setup CRON[3759]: (pam_unix) session opened for user root by (uid=0)
Jun  6 22:09:01 setup CRON[3759]: (pam_unix) session closed for user root
Jun  6 22:10:01 setup CRON[3769]: (pam_unix) session opened for user root by (uid=0)
Jun  6 22:10:01 setup CRON[3771]: (pam_unix) session opened for user root by (uid=0)
Jun  6 22:10:01 setup CRON[3773]: (pam_unix) session opened for user root by (uid=0)
Jun  6 22:10:01 setup CRON[3769]: (pam_unix) session closed for user root
Jun  6 22:10:01 setup CRON[3771]: (pam_unix) session closed for user root
Jun  6 22:10:01 setup CRON[3773]: (pam_unix) session closed for user root
Jun  6 22:15:01 setup CRON[3791]: (pam_unix) session opened for user root by (uid=0)
Jun  6 22:15:01 setup CRON[3793]: (pam_unix) session opened for user root by (uid=0)
Jun  6 22:15:01 setup CRON[3795]: (pam_unix) session opened for user root by (uid=0)
Jun  6 22:20:01 setup CRON[3815]: (pam_unix) session opened for user root by (uid=0)
Jun  6 22:20:01 setup CRON[3817]: (pam_unix) session opened for user root by (uid=0)
Jun  6 22:20:01 setup CRON[3813]: (pam_unix) session closed for user root
Jun  6 22:20:01 setup CRON[3817]: (pam_unix) session closed for user root
Jun  6 22:20:01 setup CRON[3815]: (pam_unix) session closed for user root
Jun  6 22:22:26 setup sshd[3827]: Accepted password for root from 84.145.231.16 port 1045 ssh2
Jun  6 22:22:26 setup sshd[3827]: subsystem request for sftp
Jun  6 22:25:01 setup CRON[3834]: (pam_unix) session closed for user root
Jun  6 22:25:01 setup CRON[3838]: (pam_unix) session closed for user root
Jun  6 22:25:01 setup CRON[3836]: (pam_unix) session closed for user root
[COLOR="Red"][COLOR="Red"]Jun  6 22:26:57 setup sshd[3844]: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=p5491e710.dip.t-dialin.net  user=root[/COLOR][/COLOR]
Jun  6 22:26:59 setup sshd[3844]: Failed password for root from 84.145.231.16 port 1058 ssh2
Jun  6 22:27:12 setup sshd[3844]: Accepted password for root from 84.145.231.16 port 1058 ssh2
 
Hi,

Code: 
Ab dem Zeitpunkt war der root unerreichbar
Du meinst sicher, dass er ab dann wieder erreichbar war... bzw. kurz davor schon, wie den anderen Log-Auszügen zu entnehmen ist.
crond nach syslog schreiben zu lassen, halte ich für Chaosstiftung ;)
Wenn nur kern.* nach debug.log geschrieben wird, kann es durchaus sein, dass auch mal einen Tag nichts passiert.

Code: 
Jun  6 19:30:13 setup sshd[3033]: Address 85.8.67.203 maps to mietserver-hosting.de, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
Jun  6 19:30:13 setup sshd[3033]: Accepted password for root from 85.8.67.203 port 1952 ssh2
Jun  6 19:30:14 setup sshd[3033]: subsystem request for sftp

Das war laut timestamp nachdem der Server wieder lief. Ich vermute, dass du das per SCP/SFTP warst, um die Log-Dateien zu sichern, bzw. irgendein Remote-Login, sofern Du bei Osnatel bist. Anderenfalls hat irgendjemand Dein Root-Passwort.

Bei Deinem fehlerhaften Login um 22:26 Uhr hast Du Dich vermutlich beim PW vertippt und 13s später das richtige PW eingegeben.

Alles in allem: nicht wirklich Aufschlußreich, außer der Osnatel-Login.


-W
 
Der Server war laut meinen Zocker Kollegen ab 20 Uhr down, deswegen wundern mich diese ganzen Zugriffe auf den Server, wenn er einfach offline ist wie kann dann irgendwas ausgeführt werden, wenn er erst heute um 16:48 online ging.

Hab mich vertan, ausschnitt:

Jun 5 20:30:01 setup CRON[21731]: (pam_unix) session opened for user root by (uid=0)
Jun 5 20:30:01 setup CRON[21733]: (pam_unix) session opened for user root by (uid=0)
Jun 5 20:30:01 setup CRON[21731]: (pam_unix) session closed for user root
Jun 5 20:30:01 setup CRON[21735]: (pam_unix) session opened for user root by (uid=0)
Jun 5 20:30:01 setup CRON[21735]: (pam_unix) session closed for user root
Jun 5 20:30:01 setup CRON[21733]: (pam_unix) session closed for user root
Jun 5 20:35:01 setup CRON[21788]: (pam_unix) session opened for user root by (uid=0)
Jun 5 20:35:01 setup CRON[21790]: (pam_unix) session opened for user root by (uid=0)
Jun 5 20:35:01 setup CRON[21792]: (pam_unix) session opened for user root by (uid=0)
Jun 5 20:35:01 setup CRON[21792]: (pam_unix) session closed for user root
Jun 5 20:35:01 setup CRON[21790]: (pam_unix) session closed for user root
Jun 5 20:35:01 setup CRON[21788]: (pam_unix) session closed for user root
Jun 6 16:48:59 setup sshd[2427]: Server listening on :: port 22.
Jun 6 16:50:01 setup CRON[2637]: (pam_unix) session opened for user root by (uid=0)
Jun 6 16:50:01 setup CRON[2638]: (pam_unix) session opened for user root by (uid=0)
Jun 6 16:50:01 setup CRON[2639]: (pam_unix) session opened for user root by (uid=0)
Jun 6 16:50:01 setup CRON[2637]: (pam_unix) session closed for user root
Jun 6 16:50:01 setup CRON[2638]: (pam_unix) session closed for user root
Jun 6 16:50:01 setup CRON[2639]: (pam_unix) session closed for user root
Jun 6 16:55:01 setup CRON[2647]: (pam_unix) session opened for user root by (uid=0)
Click to expand...
 
Hi,

ok. Nun sehe ich, was Du meinst. Eventuell lag einfach nur ein netzwerktechnisches Problem vor? Defektes Kabel, Mainboard, NIC o.ä. Das würde die weiterlaufenden Cronjobs erklären.
Prüfen wirst Du das jetzt vermutlich nicht mehr können, da der Server ja wieder online ist.

Du kannst ja beim Hoster nochmal nachhaken was denn genau war. Eventuell bekommst da ja noch Hinweise über den Ausfall.


-W
 
You must log in or register to reply here.
Back
Top