-3 
Jan  6 22:43:27 HOSTkernel: [34400.406538] Firewall: *Port Flood* IN=eth0 OUT= MAC=00:25:90:33:2c:d4:00:12:7f:34:7d:bf:08:00 SRC=141.0.9.77 DST=SERVER IP LEN=60 TOS=0x00 PREC=0x00 TTL=59 ID=2055 DF PROTO=TCP SPT=39403 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0
Jan  6 22:43:27 HOSTkernel: [34400.407073] Firewall: *Port Flood* IN=eth0 OUT= MAC=00:25:90:33:2c:d4:00:12:7f:34:7d:bf:08:00 SRC=141.0.9.77 DST=SERVER IP LEN=60 TOS=0x00 PREC=0x00 TTL=59 ID=37445 DF PROTO=TCP SPT=39404 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0
Jan  6 22:44:43 HOSTpure-ftpd: (?@127.0.0.1) [INFO] New connection from 127.0.0.1
Jan  6 22:44:44 HOSTpure-ftpd: (?@127.0.0.1) [INFO] __cpanel__service__auth__ftpd__CAWArGbwUe_gSaVFaB3LcPVXMtxsvsPLH5aO5Ps5aTHj1G7UbWKZwETT5mjV46YP is now logged in
Jan  6 22:44:44 HOSTpure-ftpd: (__cpanel__service__auth__ftpd__CAWArGbwUe_gSaVFaB3LcPVXMtxsvsPLH5aO5Ps5aTHj1G7UbWKZwETT5mjV46YP@127.0.0.1) [INFO] Logout.
Jan  6 22:45:52 HOSTkernel: [34545.899779] Firewall: *ICMP_IN Blocked* IN=eth0 OUT= MAC=00:25:90:33:2c:d4:00:12:7f:34:7d:bf:08:00 SRC=183.23.22.109 DST=SERVER IP LEN=28 TOS=0x00 PREC=0x00 TTL=113 ID=9188 PROTO=ICMP TYPE=8 CODE=0 ID=299 SEQ=45619
Jan  6 18:00:55 HOSTkernel: imklog 5.8.10, log source = /proc/kmsg started.
Jan  6 18:00:55 HOSTrsyslogd: [origin software="rsyslogd" swVersion="5.8.10" x-pid="1779" x-info="http://www.rsyslog.com"] start
Jan  6 18:00:55 HOSTkernel: [    0.000000] Initializing cgroup subsys cpuset
Jan  6 18:00:55 HOSTkernel: [    0.000000] Initializing cgroup subsys cpu
Jan  6 18:00:55 HOSTkernel: [    0.000000] Linux version 2.6.32-379.14.1.lve1.1.9.9.el6.x86_64 (mockbuild@koji.cloudlinux.com) (gcc version 4.4.6 20120305 (Red Hat 4.4.6-4) (GCC) ) #1 SMP Thu Dec 6 07:12:24 EST 2012
Jan  6 18:00:55 HOSTkernel: [    0.000000] Command line: ro root=UUID=f5be9b96-da41-49fd-a8e2-dbbf37f5cd7d rd_NO_LUKS rd_NO_LVM LANG=en_US.UTF-8 rd_NO_MD quiet SYSFONT=latarcyrheb-sun16 rhgb crashkernel=auto  KEYBOARDTYPE=pc KEYTABLE=us rd_NO_DM panic=5 processor.max_cstate=0 nohz=off
Jan  6 18:00:55 HOSTkernel: [    0.000000] KERNEL supported cpus:
Jan  6 18:00:55 HOSTkernel: [    0.000000]   Intel GenuineIntel
Jan  6 18:00:55 HOSTkernel: [    0.000000]   AMD AuthenticAMD
Jan  6 18:00:55 HOSTkernel: [    0.000000]   Centaur CentaurHauls
Jan  6 18:00:55 HOSTkernel: [    0.000000] BIOS-provided physical RAM map:
Jan  6 18:00:55 HOSTkernel: [    0.000000]  BIOS-e820: 0000000000000000 - 000000000009d800 (usable)
Jan  6 18:00:55 HOSTkernel: [    0.000000]  BIOS-e820: 000000000009d800 - 00000000000a0000 (reserved)
Jan  6 18:00:55 HOSTkernel: [    0.000000]  BIOS-e820: 00000000000e0000 - 0000000000100000 (reserved)
Jan  6 18:00:55 HOSTkernel: [    0.000000]  BIOS-e820: 0000000000100000 - 00000000bf7a0000 (usable)
Jan  6 18:00:55 HOSTkernel: [    0.000000]  BIOS-e820: 00000000bf7a0000 - 00000000bf7ae000 (ACPI data)
Jan  6 18:00:55 HOSTkernel: [    0.000000]  BIOS-e820: 00000000bf7ae000 - 00000000bf7d0000 (ACPI NVS)
Jan  6 18:00:55 HOSTkernel: [    0.000000]  BIOS-e820: 00000000bf7d0000 - 00000000bf7e0000 (reserved)

then at the end it picks back up at the right time. weird?

...

On a real note, the server has rebooted twice now today randomly, out of the blue. I've not had any problems in weeks. Recently, had the drive DDRescue cloned to a new drive, ran fsck everything came out fine and that was when all this started.

ideas?

uname -a Linux SERVER 2.6.32-379.14.1.lve1.1.9.9.el6.x86_64 #1 SMP Thu Dec 6 07:12:24 EST 2012 x86_64 x86_64 x86_64 GNU/Linux

Improve this question
3
  • How are you thinking that we are to help you troubleshoot this when you're not even telling us what kind of hardware it is running on?
    – pauska
    Jan 7, 2013 at 4:29
  • 1
    Dropping a log message on us which just shows your system rebooting with no other substantial anomalies and asking us to cast the runes and come up with a diagnosis is somewhat poor form - You've received a good suggestion (test your RAM), but really you need to do some more in-depth troubleshooting before we can even begin to help you. In addition to the RAM test you should run down the list of everything that changed recently (e.g. what else besides the ddrescue cloning has happened? Presumably you needed that tool for a reason - that context is probably important).
    – voretaq7
    Jan 7, 2013 at 4:45
  • What else should I try for diagnosis? Did not think about the RAM.
    – Mike Janson
    Jan 7, 2013 at 4:47

2 Answers 2

Reset to default
2

You've already fscked, presumably it's not the drive. This is the exact behavior to expect when memory is failing. You can use memtest86 or memtest86+ (loaded on UBCD?) and run through a few cycles of memory. Obviously, for a production server, it's nice to swap memory and run this on a test machine.

Improve this answer
2
  • Agree on the RAM check, but remember that fsck just ensures the filesystem is in a "consistent" state - there could be underlying corruption (from the ddrescue, or from bad RAM causing nasty things to happen). I've even seen really wonky RAM cause fsck to mark a filesystem clean, when in reality the superblock information written out is gibberish. (That was NOT a fun weekend.)
    – voretaq7
    Jan 7, 2013 at 4:49
  • how to use memtest86+ to test ?
    – user4234
    Jul 25, 2013 at 4:43
1

Your server may have a bad RAM. test it using memtest. Also look at this post.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.