SuSE 8.0 system crash; strange characters in access_log

Jan Pieter Kunst

15 Dec 2003 15 Dec '03

09:01

Dear people, I'm only an amateurish part-time sysadmin, so please bear with me. This weekend our web server (SuSE 8.0) crashed. The machine could be pinged, but did not respond to http or ssh requests. When I came in this morning, I could not get the screen to wake up, so I had to forcibly reboot the machine. After rebooting, I checked the logfiles (at least those that I know about) and the only one in which something strange appeared was Apaches access_log: right after the last (innocent) request before the crash must have happened, there was a string of 762 \x00 characters, and then nothing until the time I rebooted the machine this morning. Does anyone have an idea what this could be? Thanks, Jan Pieter Kunst

Show replies by date

Lars Ellenberg

15 Dec 15 Dec

14:39

New subject: [suse-security] SuSE 8.0 system crash; strange characters in access_log

/ 2003-12-15 10:01:34 +0100 \ Jan Pieter Kunst:

...

Dear people,

I'm only an amateurish part-time sysadmin, so please bear with me.

This weekend our web server (SuSE 8.0) crashed. The machine could be pinged, but did not respond to http or ssh requests.

When I came in this morning, I could not get the screen to wake up, so I had to forcibly reboot the machine.

After rebooting, I checked the logfiles (at least those that I know about) and the only one in which something strange appeared was Apaches access_log: right after the last (innocent) request before the crash must have happened, there was a string of 762 \x00 characters, and then nothing until the time I rebooted the machine this morning.

Does anyone have an idea what this could be?

normal filesystem "corruption" after hard crash: unflushed, but allocated, blocks are zeroed out by journal replay or fsck. so related to you switching off the box, but no hint whatsoever to the cause of the hang. Lars Ellenberg

Roman Drahtmueller

14:57

New subject: [suse-security] SuSE 8.0 system crash; strange characters in access_log

...

...
Does anyone have an idea what this could be?

normal filesystem "corruption" after hard crash: unflushed, but allocated, blocks are zeroed out by journal replay or fsck. so related to you switching off the box, but no hint whatsoever to the cause of the hang.

Good analysis. And right, there is no indication about the origin of the hang. This is not nice, yes, but it could remain unanswered unless more specifics are known.

...

Lars Ellenberg

Thanks, Roman. -- - - | Roman Drahtmüller // Nail here | SUSE Linux AG - Security Phone: // for a new | Nürnberg, Germany +49-911-740530 // monitor! --> [x] | - -

Jan Pieter Kunst

15:17

New subject: [suse-security] SuSE 8.0 system crash; strange characters in access_log

...

...
normal filesystem "corruption" after hard crash: unflushed, but allocated, blocks are zeroed out by journal replay or fsck. so related to you switching off the box, but no hint whatsoever to the cause of the hang.

Good analysis. And right, there is no indication about the origin of the hang. This is not nice, yes, but it could remain unanswered unless more specifics are known.

...
Lars Ellenberg

Thanks, Roman.

The problem is I'm not sure where to look for more specifics. Are there other logfiles that could be relevant? Jan Pieter Kunst

mjt

16:02

New subject: [suse-security] SuSE 8.0 system crash; strange characters in access_log

On Mon, 15 Dec 2003 10:01:34 +0100, Jan Pieter Kunst wrote:

...

Apaches access_log: right after the last (innocent) request before the crash must have happened, there was a string of 762 \x00

... what about in 'error_log' ??? anything? -- << http://michaeljtobler.homelinux.com/ >> Trying to define yourself is like trying to bite your own teeth.

Jan Pieter Kunst

17:30

New subject: [suse-security] SuSE 8.0 system crash; strange characters in access_log

...

On Mon, 15 Dec 2003 10:01:34 +0100, Jan Pieter Kunst wrote:

...
Apaches access_log: right after the last (innocent) request before the crash must have happened, there was a string of 762 \x00

... what about in 'error_log' ??? anything?

No, nothing interesting. The last message in error_log before the crash is [Fri Dec 12 19:59:44 2003] [error] [client xx.xxx.xx.xx] client denied by server configuration: /path/to/directory ... where /path/to/directory is protected with a 'Deny,allow' directive in a .htaccess file. Jan Pieter Kunst

7442

Age (days ago)

7442

Last active (days ago)

List overview

Download

5 comments

4 participants

participants (4)

Jan Pieter Kunst
Lars Ellenberg
mjt
Roman Drahtmueller