Just wondering if anyone has ever seen something like this before. I
have a Debian Etch system running a custom kernel based off of stock
kernels from kernel.org. The system was upgraded from Sarge to Etch and
because of the custom kernel wasn't rebooted. That upgrade took place
months ago and every was running smoothly.
Today I noticed when running the 'uptime' command that the uptime was
listed as 2 days 6 hours and some change. I was expecting to see
something close to 500 days. I investigated all of the logs and could
find absolutely no evidence of a reboot. The system is fairly heavily
monitored so I would've seen at least one or two e-mails from the
reboot. I also have no reason to believe, based on the initial
investigation, that there is anything malicious involved.
Running ps, it looked like init and related processes all had a
timestamp of Jan 4, two days ago. A few other processes had a timestamp
of just '2009' while most had a 'correct' (or sane) timestamp.
I'm trying to think of logical reasons for this to have happened. Was
there possibly an update that did something to init or related? Could
there have been a problem with the hardware clock on the server
temporarily? Could something have gone wrong with ntpd that asjusted
the time and then corrected itself? Was the uptime just sufficiently
long enough that something rolled over? (It's a fairly heavily used
server.)
Anyone else seen something similar or have other thoughts?