Re: Interesting Server Issue
On Wed, Jul 17, 2002 at 12:16:56PM -0700, nate wrote:
> <quote who="Matthew Sackman">
> > Hay all.
> >
>
> > I rebooted the machine yesterday morning, yet this morning it was
> > showing an uptime of 9 hours. I know for a fact it hasn't been turned
> > off.
>
> so there is a UPS on the machine and your not aware of any
> power issues i guess.
No, I've asked around, I've checked. Besides, if it had been turned off
then it would have had to be turned off at about 11pm for it to have an
uptime of 9 hours at 8am. I do know for a fact that no one was in the
shop at 11pm last night.
> I have never heard of a network card putting a machine asleep
> by itself. I don't think it is possible without something
> actually sending a command to the NIC.
Possibly the other win2k machines on the network?
> ? This is based on the idea that the one remaining other machine on
> > the network would have been turned off at about 17:50 last night and
> > would have been turned on at about 08:24 this morning.
>
> and if a person turned off that system could they not of
> turned off yours too? (or put it into sleep mode, since some
> power switches can be configured to go to sleep when
> pressed while the system is up ..)
The power switch is not so configured. And the people who work there are
honest, friends, and would not have done that.
> > Between these
> > times, other machines would have had power and other machines all have
> > 3Com Cards which are still 'on' even though the machine is off
> > (soft-off) - the switch shows the nics are actually still on.
>
> IMO it is not likely, very very very remote chance. it wouldn't
> be on a list i would consider. to turn any such behavior off,
> find the cable that connects from the NIC to a special connector
> on the MB and remove it. if there is no cable, then i would say
> it is impossible for this to have happened in the manor you
> described. can you scroll up on the console and se anything?
> check the other log files for possible evidence of a system
> boot.
Believe me, I checked. Everywhere. There is no evidence of a break in
and no evidence of logs being deleted. If someone really did break in
then why edit the cacti and mrtg logs aswell: it really is a big dumb as
it's just massively caught my attention and made me concerned.
It's been suggested that I check the win2k machines for nic power
configurations. But I agree: even if they are sending the commands to
the server to go to sleep then how can that actually happen if there is
no WOL connector to the mobo? Could the NIC driver detect the commands
and kinda shut linux down? I know I'm clutching at straws here, I just
really don't know what's causing this.
> if someone were tob reak into a system i would find it stupid
> that they would just erase the logs going back since you
> last booted up, that would be quite obvious. more likely
> there is something else going on.
Agreed, but what?
> i run many many systems with 3com 3c905 cards, and have
> never ever ever had a single machine go to sleep.
I want to leave another machine on over night and see whether that means
the server says 'awake'. Dunno what else to try.
Matthew
--
Matthew Sackman
Nottingham
England
BOFH Excuse Board:
knot in cables caused data stream to become twisted and kinked
--
To UNSUBSCRIBE, email to debian-user-request@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Reply to: