Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am running a Ubuntu 10.04 LTS in an Amazon EC2 instance.

The system suddenly became unresponsive. When I checked the log files I found the following errors in /var/log/syslog

Feb 22 04:10:01 ip-10-0-1-12 CRON[16153]: (root) CMD (/usr/sbin/cm-sysmon) ^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@ ^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@ ^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@Feb 22 04:29:47 ip-10-0-1-12 kernel: imklog 4.2.0, log source = /proc/kmsg started. Feb 22 04:29:47 ip-10-0-1-12 rsyslogd: [origin software="rsyslogd" swVersion="4.2.0" x-pid="656" x-info="http://www.rsyslog.com"] (re)start Feb 22 04:29:47 ip-10-0-1-12 rsyslogd: rsyslogd's groupid changed to 103 Feb 22 04:29:47 ip-10-0-1-12 rsyslogd: rsyslogd's userid changed to 101 Feb 22 04:29:47 ip-10-0-1-12 rsyslogd-2039: Could no open output file '/dev/xconsole' [try http://www.rsyslog.com/e/2039 ] Feb 22 04:29:47 ip-10-0-1-12 kernel: [ 0.000000] Initializing cgroup subsys cpuset Feb 22 04:29:47 ip-10-0-1-12 kernel: [ 0.000000] Initializing cgroup subsys cpu

We had to reboot the system to bring it live.

I am surprised to see the garbage values in the syslog.

Nothing suspicious in the /var/log/kern.log or in /var/log/messages.

How do I find out what went wrong during that time ?

share|improve this question
add comment

1 Answer

This looks like /usr/sbin/cm-sysmon was the last command at 04:10:01 before the reboot.

At 04:29:47 the system was up and running again, but had problems connecting to the console.

I guess the latter is a EC2 problem caused by the sudden reboot.

Best guess is to have a look at /usr/sbin/cm-sysmon - but that could be completely innocent.

The garbage looks like a couple of 0-values that got written to the syslog - maybe an attack or trojan could cause this.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.