RE: [cobalt-users] [RAQ4] Server Stops Responding everyday - unknown cause!

["Stephan Whelan" <stephan.whelan@xxxxxxxxxxxxxx>]

Jens,

>Did you check, that you do not have some very resource-consuming
>cronjob running at that hour of the day? (it could be for example the
>logrotation and analog stats generation that happens at that time of
>day).

As far as I can tell, the log rotation and webalizer scripts seem to run at
that time of day.  But since log rotation is built in I'm surprised that
would cause the system to hang?  As far a webalizer is concerned it could be
that?

>It's a bit hard diagnosing such a problem with no login access to the
>server. When something happens "by itself" and "nothing have been
>changed", you have to give a lot more info on the error messages you
>see, what is in the logs, etc. before anyone can give a good guess on
>the cause.

I understand that, but no error messages are given - it literally just hangs
(and since it is in the early hours of the morning I find it difficult to be
watching it at the time it all happens).  As far as logs are concerned, I am
attaching details of several of the key log entries in the 30 mins or so
before the server hangs...

FROM MESSAGES

Dec 25 03:00:01 ns proftpd[21810]: ns.deeperblue.net
(localhost[127.0.0.1]) - FTP session closed.
Dec 25 03:00:04 ns telnetd[21818]: ttloop: read: Broken pipe
Dec 25 03:09:20 ns named[405]: Cleaned cache of 26 RRsets
Dec 25 03:09:20 ns named[405]: USAGE 977713760 977648960 CPU=3.68u/1.72s
CHILDCPU=0u/0s
Dec 25 03:09:20 ns named[405]: NSTATS 977713760 977648960 A=2633 SOA=9
PTR=1617 MX=1411 AAAA=1 ANY=2625
Dec 25 03:09:20 ns named[405]: XSTATS 977713760 977648960 RR=3098 RNXD=158
RFwdR=2145 RDupR=2 RFail=10 RFErr=0 RErr=1 RAXFR=0 RLame=25 ROpts=0
SSysQ=831 SAns=6417 SFwdQ=1808 SDupQ=505 SErr=1 RQ=8303 RIQ=0 RFwdQ=0
RDupQ=86 RTCP=0 SFwdR=2145 SFail=0 SFErr=0 SNaAns=3020 SNXD=12
Dec 25 03:15:00 ns proftpd[22554]: ns.deeperblue.net
(localhost[127.0.0.1]) - FTP session closed.
Dec 25 03:15:03 ns telnetd[22562]: ttloop: read: Broken pipe
Dec 25 03:30:01 ns proftpd[23063]: ns.deeperblue.net
(localhost[127.0.0.1]) - FTP session closed.

FROM CRON

root (12/25-03:00:00-21805) CMD (/usr/local/sbin/swatch
>>/var/cobalt/adm.log 2>&1)
root (12/25-03:00:00-21807) CMD (   /sbin/rmmod -as)
root (12/25-03:01:01-21863) CMD (run-parts /etc/cron.hourly)
root (12/25-03:10:00-22338) CMD (   /sbin/rmmod -as)
root (12/25-03:15:00-22550) CMD (/usr/local/sbin/swatch
>>/var/cobalt/adm.log 2>&1)
root (12/25-03:20:00-22776) CMD (   /sbin/rmmod -as)

Any other stuff i'm willing to post for informational purposes.  My concern
was not to post a huge series of log entries to the list!

Thanks,


Stephan Whelan     [ICQ: 11970266]    Tel. +44 777 590 0401 (UK)
Publisher/Director [Firetalk: 859159] Fax. +44 870 164 1037 (UK)
                                           +1  530-684-7553 (US)

Deeper Blue [http://www.deeperblue.net]
The Online Resource for the Underwater World