Re: RAM fuellt sich
Reinhold Plew schrieb:
Hi Chris,
Chris K. wrote:
Reinhold Plew schrieb:
Ein Server schaltet sich nicht einfach ab.
Es wäre schön, wenn Du uns erklären könntest, was Du unter 'abschalten'
verstehst.
Er ist nicht mehr erreichbar von aussen. Weder per http, noch SSH, noch
sonst irgendwie.
da würde ich ja eher vermuten, dass der Server so mit anderen Dingen
beschäftigt ist, das Clientanwendungen auf ein Timeout laufen, bevor der
Server antwortet. Jochen hat da ja auch schon etwas dazu geschrieben,
normalerweise wird nur der entsprechende Prozess beendet.
Es bleibt dass nur noch eine Benutzeroberflaeche des Providers ueber die
man den Server resetten kann. Das ist das einzige was dann noch hilft.
Aus dem Output von top ist ja zu sehen, dass sehr viele apaches
gestartet sind. Wie schaut es denn mit der Anzahl der User/Surfer aus,
welche gerade Deinen Server nutzen?
Hast Du evt. ein überschaubares Zeitfenster, in welchem der Server
'aussteigt'?
Wenn ja, verbinde Dich per ssh mit dem Server und beobachte ihn 'live'.
Was erzählt denn syslog, authlog usw.?
Gruss
Reinhold
Hallo Reinhold,
ich habe schonmal versucht ein ueberschaubares Fenster zu finden und ihn
zu beobachten, aber leider klappt das absolut nicht.
Aber im Anhang findest Du Auszuege aus der syslog und der authlog im
Zeitrahmen von 60 Minuten.
Gruss Chris
Aug 26 23:05:33 h1252586 imaplogin: Connection, ip=[::ffff:127.0.0.1]
Aug 26 23:05:33 h1252586 courierpop3login: Connection,
ip=[::ffff:127.0.0.1]
Aug 26 23:05:33 h1252586 proftpd[5258]: h1252586.stratoserver.net
(127.0.0.1[127.0.0.1]) - FTP session closed.
Aug 26 23:05:33 h1252586 proftpd[5258]: h1252586.stratoserver.net
(127.0.0.1[127.0.0.1]) - FTP session opened.
Aug 26 23:05:01 h1252586 /USR/SBIN/CRON[5250]: (root) CMD
(/usr/local/sa24/sa24d3/sa24d3 --server-stats >>/dev/null 2>&1)
Aug 26 23:03:28 h1252586 courierpop3login: LOGOUT, user=spam@***.de,
ip=[::ffff:85.182.1.***], top=0, retr=0, time=0
Aug 26 23:03:28 h1252586 courierpop3login: LOGIN, user=spam@***.de,
ip=[::ffff:85.182.1.***]
Aug 26 23:03:28 h1252586 courierpop3login: Connection,
ip=[::ffff:85.182.1.***]
Aug 26 23:03:28 h1252586 courierpop3login: LOGOUT, user=inse@***.eu,
ip=[::ffff:85.182.1.***], top=0, retr=0, time=0
Aug 26 23:03:28 h1252586 courierpop3login: LOGOUT, user=info@***.de,
ip=[::ffff:85.182.1.***], top=0, retr=0, time=0
Aug 26 23:03:28 h1252586 courierpop3login: LOGIN, user=inse@***.eu,
ip=[::ffff:85.182.1.***]
Aug 26 23:03:28 h1252586 courierpop3login: LOGIN, user=info@***.de,
ip=[::ffff:85.182.1.***]
Aug 26 23:03:28 h1252586 courierpop3login: Connection,
ip=[::ffff:85.182.1.***]
Aug 26 23:03:28 h1252586 courierpop3login: Connection,
ip=[::ffff:85.182.1.***]
Aug 26 23:03:28 h1252586 courierpop3login: LOGOUT, user=inse@***.de,
ip=[::ffff:85.182.1.***], top=0, retr=0, time=0
Aug 26 23:03:28 h1252586 courierpop3login: LOGIN, user=inse@***.de,
ip=[::ffff:85.182.1.***]
Aug 26 23:03:28 h1252586 courierpop3login: Connection,
ip=[::ffff:85.182.1.***]
Aug 26 23:00:01 h1252586 /USR/SBIN/CRON[5239]: (root) CMD
(/usr/local/sa24/sa24d3/sa24d3 --server-stats >>/dev/null 2>&1)
auth.log:
Aug 26 22:00:01 h1252586 CRON[5103]: (pam_unix) session opened for user
root by (uid=0)
Aug 26 22:00:01 h1252586 CRON[5103]: (pam_unix) session closed for user root
Aug 26 22:05:01 h1252586 CRON[5114]: (pam_unix) session opened for user
root by (uid=0)
Aug 26 22:05:01 h1252586 CRON[5114]: (pam_unix) session closed for user root
Aug 26 22:09:01 h1252586 CRON[5117]: (pam_unix) session opened for user
root by (uid=0)
Aug 26 22:09:01 h1252586 CRON[5117]: (pam_unix) session closed for user root
Aug 26 22:10:01 h1252586 CRON[5131]: (pam_unix) session opened for user
root by (uid=0)
Aug 26 22:10:01 h1252586 CRON[5133]: (pam_unix) session opened for user
root by (uid=0)
Aug 26 22:10:01 h1252586 CRON[5133]: (pam_unix) session closed for user root
Aug 26 22:10:01 h1252586 CRON[5131]: (pam_unix) session closed for user root
Aug 26 22:15:01 h1252586 CRON[5145]: (pam_unix) session opened for user
root by (uid=0)
Aug 26 22:15:01 h1252586 CRON[5145]: (pam_unix) session closed for user root
Aug 26 22:17:02 h1252586 CRON[5148]: (pam_unix) session opened for user
root by (uid=0)
Aug 26 22:17:02 h1252586 CRON[5148]: (pam_unix) session closed for user root
Aug 26 22:20:01 h1252586 CRON[5150]: (pam_unix) session opened for user
root by (uid=0)
Aug 26 22:20:01 h1252586 CRON[5150]: (pam_unix) session closed for user root
Aug 26 22:25:01 h1252586 CRON[5161]: (pam_unix) session opened for user
root by (uid=0)
Aug 26 22:25:01 h1252586 CRON[5163]: (pam_unix) session opened for user
root by (uid=0)
Aug 26 22:25:02 h1252586 CRON[5163]: (pam_unix) session closed for user root
Aug 26 22:25:02 h1252586 CRON[5161]: (pam_unix) session closed for user root
Aug 26 22:30:01 h1252586 CRON[5167]: (pam_unix) session opened for user
root by (uid=0)
Aug 26 22:30:01 h1252586 CRON[5167]: (pam_unix) session closed for user root
Aug 26 22:35:01 h1252586 CRON[5178]: (pam_unix) session opened for user
root by (uid=0)
Aug 26 22:35:01 h1252586 CRON[5178]: (pam_unix) session closed for user root
Aug 26 22:39:01 h1252586 CRON[5181]: (pam_unix) session opened for user
root by (uid=0)
Aug 26 22:39:02 h1252586 CRON[5181]: (pam_unix) session closed for user root
Aug 26 22:40:01 h1252586 CRON[5195]: (pam_unix) session opened for user
root by (uid=0)
Aug 26 22:40:01 h1252586 CRON[5197]: (pam_unix) session opened for user
root by (uid=0)
Aug 26 22:40:01 h1252586 CRON[5197]: (pam_unix) session closed for user root
Aug 26 22:40:01 h1252586 CRON[5195]: (pam_unix) session closed for user root
Aug 26 22:45:02 h1252586 CRON[5209]: (pam_unix) session opened for user
root by (uid=0)
Aug 26 22:45:02 h1252586 CRON[5209]: (pam_unix) session closed for user root
Aug 26 22:46:14 h1252586 sshd[5212]: Accepted keyboard-interactive/pam
for inselkobi from ::ffff:85.182.1.139 port 62053 ssh2
Aug 26 22:46:14 h1252586 sshd[5215]: (pam_unix) session opened for user
inselkobi by (uid=0)
Aug 26 22:46:33 h1252586 sshd[5215]: (pam_unix) session closed for user
inselkobi
Aug 26 22:50:01 h1252586 CRON[5221]: (pam_unix) session opened for user
root by (uid=0)
Aug 26 22:50:01 h1252586 CRON[5221]: (pam_unix) session closed for user root
Aug 26 22:55:01 h1252586 CRON[5232]: (pam_unix) session opened for user
root by (uid=0)
Aug 26 22:55:01 h1252586 CRON[5235]: (pam_unix) session opened for user
root by (uid=0)
Aug 26 22:55:02 h1252586 CRON[5232]: (pam_unix) session closed for user root
Aug 26 22:55:02 h1252586 CRON[5235]: (pam_unix) session closed for user root
Aug 26 23:00:01 h1252586 CRON[5238]: (pam_unix) session opened for user
root by (uid=0)
Aug 26 23:00:01 h1252586 CRON[5238]: (pam_unix) session closed for user root
Reply to: