[cobalt-users] Re: Strange Server went down but syslog still running

[Chae <chae@xxxxxxxxxxxx>]

Hi Yah,

Sorry for not getting back sooner was out most of the morning...

To answer everyone's questions:

Yes in the GUI all the services were ticked Web, Email, FTP & DNS

Yes went through all of the logs looking for something obvious and nothing 
- did a grep for eth0 etc and the only thing that comes up is when the 
server was rebooted and snort kicked in and also when chkrootkit did it's thing

The reboot switch was provided through my Colo and it's from APC, works 
from a separate IP and via a web interface. The switch allows me to do the 
following...

1. Immediate switch off
2. Immediate switch on
3. Immediate reboot
4. Delayed off
5. Delayed on
6. Delayed reboot

Hence the reason I said "reboot"

/etc/cobalt/swatch/services/
ahttp = on
dns = on
ftp = on
http = on
imap = on (though disabled as per Carrie B's suggestions)
mgmt-httpd = off
pop3 = on
smtp = on (though not used)
snmp = off
telnet = off

Now I have snort running and if the network interface was lost then this 
would have shown up in the logchecks - weird.

I also contacted the colo and they said there were no outages or anything 
wrong with the network during the time the server was down.

So basically I'm still none the wiser :( It's up and running okay but it 
would be nice if I knew what it was or how to prevent it from happening again.

Regards

Chae