LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > Fedora
User Name
Password
Fedora This forum is for the discussion of the Fedora Project.

Notices



Reply
 
Search this Thread
Old 08-04-2009, 07:33 PM   #1
kir2u
LQ Newbie
 
Registered: Aug 2009
Posts: 3

Rep: Reputation: 0

Hello,
I've had this fedora box setup for me to use as a mailserver. It's running sendmail and i'm using pop3d in order to allow users to check their email.

The problem is now that for the past 3-4 days the server keeps crashing at around 10am. I wanted to know how i would go about troubleshooting this. Where is the logs i can look out? /var/logs doesn't seem to have the proper logs.

Thank you

just an update.

i checked the "messages" and "secure" files in /var/log and all i see is just someone running a brute force on my SSH port and trying different users and failing.

Last edited by unSpawn; 08-04-2009 at 08:31 PM. Reason: //Merge posts to retain 0-reply status
 
Old 08-04-2009, 08:55 PM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 27,744
Blog Entries: 54

Rep: Reputation: 2973Reputation: 2973Reputation: 2973Reputation: 2973Reputation: 2973Reputation: 2973Reputation: 2973Reputation: 2973Reputation: 2973Reputation: 2973Reputation: 2973
Quote:
Originally Posted by kir2u View Post
The problem is now that for the past 3-4 days the server keeps crashing at around 10am. I wanted to know how i would go about troubleshooting this. Where is the logs i can look out? /var/logs doesn't seem to have the proper logs.
Crashing how? Does it reboot spontaneously? Or do you have to reboot it? Does it show errors on the console or when you log in? When a machine reboots unintendedly, reading back /var/log/messages lines from the approximate time of reboot might reveal information about processes that ran or errored out. Also check at which time logrotate kicks in (/etc/crontab) and with what configuration (/etc/logrotate.d/syslog) so you know if you also need to read back archived copies of /var/log/messages. Since 10AM sounds too regular I'd check (copies of) /var/log/cron and root crontab (/var/spool/cron/root) as well. If none of the logs reveal clues at the approximate time of reboot then you might want to start logging more information by tweaking what gets logged in /etc/syslog.conf (e.g.: '*.debug -/var/log/debug'), running SMART checks and collect system statistics with Atop, Dstat or Collectl.
 
Old 08-04-2009, 11:11 PM   #3
kir2u
LQ Newbie
 
Registered: Aug 2009
Posts: 3

Original Poster
Rep: Reputation: 0
Quote:
Originally Posted by unSpawn View Post
Crashing how? Does it reboot spontaneously? Or do you have to reboot it? Does it show errors on the console or when you log in? When a machine reboots unintendedly, reading back /var/log/messages lines from the approximate time of reboot might reveal information about processes that ran or errored out. Also check at which time logrotate kicks in (/etc/crontab) and with what configuration (/etc/logrotate.d/syslog) so you know if you also need to read back archived copies of /var/log/messages. Since 10AM sounds too regular I'd check (copies of) /var/log/cron and root crontab (/var/spool/cron/root) as well. If none of the logs reveal clues at the approximate time of reboot then you might want to start logging more information by tweaking what gets logged in /etc/syslog.conf (e.g.: '*.debug -/var/log/debug'), running SMART checks and collect system statistics with Atop, Dstat or Collectl.
i dont think it's an actual reboot. It just hangs of some sort because i stop getting my mails and can't SSH to the box so have to manually restart the server to get back into it.
 
Old 08-04-2009, 11:18 PM   #4
kir2u
LQ Newbie
 
Registered: Aug 2009
Posts: 3

Original Poster
Rep: Reputation: 0
another thing i see is:

error: stat of /var/log/ppp/connect-errors failed: No such file or directory

when i do : logrotate /etc/logrotate.conf

could this be it? it's in the daily cron tab folder.
 
Old 08-05-2009, 01:46 AM   #5
chrism01
Guru
 
Registered: Aug 2004
Location: Sydney
Distribution: Centos 6.6, Centos 5.10
Posts: 16,324

Rep: Reputation: 2041Reputation: 2041Reputation: 2041Reputation: 2041Reputation: 2041Reputation: 2041Reputation: 2041Reputation: 2041Reputation: 2041Reputation: 2041Reputation: 2041
That probably(??) shouldn't cause as much trouble as you're having, but it's definitely worth fixing.
Have a good look through your logfiles for anything at that time of day or just before.
 
Old 08-05-2009, 06:18 AM   #6
unSpawn
Moderator
 
Registered: May 2001
Posts: 27,744
Blog Entries: 54

Rep: Reputation: 2973Reputation: 2973Reputation: 2973Reputation: 2973Reputation: 2973Reputation: 2973Reputation: 2973Reputation: 2973Reputation: 2973Reputation: 2973Reputation: 2973
Quote:
Originally Posted by kir2u View Post
i dont think it's an actual reboot. It just hangs of some sort because i stop getting my mails and can't SSH to the box so have to manually restart the server to get back into it.
Depending on hardware specs and load a machine may appear to hang for some period of time, but since you did not post details to show it actually crashed that's just speculation. If "manually restart the server" means hard resetting the machine then you may expect all sorts of problems. Filesystems are quite robust but they were not intended to suffer continuous and survive deliberate power cuts like that. Like Chrism01 said the missing /var/log/ppp/connect-errors is not going to make the machine hang. I think I gave you enough pointers to get started so do get back to us in more detail about what logs you looked at and what you did find.
 
Old 08-06-2009, 08:49 AM   #7
markseger
Member
 
Registered: Jul 2003
Posts: 241

Rep: Reputation: 25
One thing I've seen on rare occasions is systems hangs caused by flaky hardware or a high process which takes over the system and both show up as gaps in collectl data. In other words, when collectl is run as a daemon and taking samples every 10 seconds, each sample is exactly 10 seconds apart within a msec of each other with virtually no missed samples. If some piece of hardware misbehaves or some very high priority process such as the 'oom killer' takes over the system, no other process will get any run time until it finishes. This will show up as a few missing collectl samples and sometimes as many as several minutes worth.
-mark
 
Old 08-06-2009, 09:13 PM   #8
chrism01
Guru
 
Registered: Aug 2004
Location: Sydney
Distribution: Centos 6.6, Centos 5.10
Posts: 16,324

Rep: Reputation: 2041Reputation: 2041Reputation: 2041Reputation: 2041Reputation: 2041Reputation: 2041Reputation: 2041Reputation: 2041Reputation: 2041Reputation: 2041Reputation: 2041
If its always around 10am I'd start by looking at all the crontabs... and also look through any logfiles at about that time (start from 09:45).
 
Old 08-06-2009, 10:00 PM   #9
unSpawn
Moderator
 
Registered: May 2001
Posts: 27,744
Blog Entries: 54

Rep: Reputation: 2973Reputation: 2973Reputation: 2973Reputation: 2973Reputation: 2973Reputation: 2973Reputation: 2973Reputation: 2973Reputation: 2973Reputation: 2973Reputation: 2973
I already mentioned all of that in post #2.
 
  


Reply

Tags
fedora


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Troubleshooting Display Galaxy_Stranger Fedora 2 01-12-2009 05:55 AM
Help with Printer Troubleshooting Malacandra Linux - Hardware 4 02-20-2007 08:58 PM
disk troubleshooting jalla Linux - Newbie 5 10-23-2006 01:39 PM
Troubleshooting Sound carlosinfl Linux - General 6 09-06-2006 10:48 AM
troubleshooting how-to? chilehead Linux - Hardware 2 02-06-2005 05:58 PM


All times are GMT -5. The time now is 12:16 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration