my server crashed

inteltechs · 11-02-2003, 07:56 AM

anyone knows why it crashed?

Code:

2.27 2.56 2.53 2/276 32018
        total:    used:    free:  shared: buffers:  cached:
Mem:  1055412224 1041707008 13705216        0 77062144 737656832
Swap: 2056310784 210935808 1845374976
MemTotal:      1030676 kB
MemFree:         13384 kB
MemShared:           0 kB
Buffers:         75256 kB
Cached:         602176 kB
SwapCached:     118192 kB
Active:         700400 kB
ActiveAnon:     237696 kB
ActiveCache:    462704 kB
Inact_dirty:     95696 kB
Inact_laundry:   11792 kB
Inact_clean:    113596 kB
Inact_target:   184296 kB
HighTotal:      131008 kB
HighFree:         1024 kB
LowTotal:       899668 kB
LowFree:         12360 kB
SwapTotal:     2008116 kB
SwapFree:      1802124 kB
   procs                      memory    swap          io     system         cpu
 r  b  w   swpd   free   buff  cache  si  so    bi    bo   in    cs  us  sy  id
 1  0  0 205992  13384  75256 601984   3  15    22    25   48    42   7   5  40
 1  0  0 205992  54812  75264 558644   0   0   160   148  330  1861  24  13  64
 0  0  0 205992  54708  75276 558804   4   0   164   324  411   134  10   1  90
 0  0  2 205992  54640  75292 559148   0   0   316  8912  499   271   1   2  97
 0  1  0 205992  54336  75436 559744  88   0   756  2108  608   672   3   1  96
 0  1  0 205992  57156  75528 560060   4   0   384     0  491   511   4   6  89
 1  0  0 205992  52712  75768 565212   4   0  3052   672  927   951   3   1  96
 0  0  0 205992  51280  75776 564500  24   0   496   404  477  1753  20   3  78
 0  0  0 205992  51272  75840 564984   0   0   476  1736  548   252   1   2  97
 0  0  2 205992  51024  75860 565364  16   0   388   348  495   771   7   3  91

david_ross · 11-02-2003, 08:05 AM

What do you mean by crashed:
a) Turned off
b) Hung
c) Just one service died
d) other

You are more likely to find information in your log files.

Aditional information would be useful - eg
1) server use
2) kernel
3) distro

What was the system doing at the time - were you working on it?

inteltechs · 11-02-2003, 08:14 AM

Quote:

Originally posted by david_ross
What do you mean by crashed:
a) Turned off
b) Hung
c) Just one service died
d) other

You are more likely to find information in your log files.

Aditional information would be useful - eg
1) server use
2) kernel
3) distro

What was the system doing at the time - were you working on it?

it is a dual xeon 2.0 ghz, hyperthreading 2*73gig scsi drive, 1 gig ram, running redhat 7.3 with 2.4.20-20.7smp. This server is used for dns, email, web, and a few other services. I don't have console access but I believe server was hung. I did a port scan and found those services were still open

Code:

21/tcp open ftp 
22/tcp open ssh 
25/tcp open smtp 
53/tcp open domain 
110/tcp open pop-3 
143/tcp open imap2 
443/tcp open https 
465/tcp open smtps 
993/tcp open imaps 
995/tcp open pop3s 
3306/tcp open mysql

unfortunately, i got this error when ssh to it "ssh_exchange_identification: Connection closed by remote host" even though I don't have hosts.deny setup for ssh.

david_ross · 11-02-2003, 08:30 AM

Well I doubt if there is much you can do unless you get to the console or are able to reboot the server.

inteltechs · 11-02-2003, 08:33 AM

Quote:

Originally posted by david_ross
Well I doubt if there is much you can do unless you get to the console or are able to reboot the server.

you are right, the server is okay now, i am trying to figure out why it's been crashed.

david_ross · 11-02-2003, 08:37 AM

Take a look at your logs - eg "/var/log/messages" about the time that it appeared and see if there is any information. If you have able to access the machine without a reboot then try running "dmesg". You may also want to check if there has been anyone login to your system too.

inteltechs · 11-02-2003, 08:44 AM

Quote:

Originally posted by david_ross
Take a look at your logs - eg "/var/log/messages" about the time that it appeared and see if there is any information. If you have able to access the machine without a reboot then try running "dmesg". You may also want to check if there has been anyone login to your system too.

the server is secure, btw, dmesg, messages, secure, syslog won't help. There are something abnormal called "SI" in my first message, or vmstat. I think that is the reason wh it crashed but I can't find much information about it. Anyone knows exactly what "si" is and how it works?

david_ross · 11-02-2003, 08:55 AM

man vmstat

horlix · 11-02-2003, 08:58 AM

taken from vmstat manual

si: Amount of memory swapped in from disk (kB/s)