RE: [cobalt-users] Re: Strange Server went down but syslog still running

["Jolley, Carl" <Carl.Jolley@xxxxxxx>]

-----Original Message-----
From: Chae
To: cobalt-users@xxxxxxxxxxxxxxx
Sent: 7/31/02 11:18 PM
Subject: [cobalt-users] Re: Strange Server went down but syslog still
running

Hi Yah,

Sorry for not getting back sooner was out most of the morning...

To answer everyone's questions:

Yes in the GUI all the services were ticked Web, Email, FTP & DNS

Yes went through all of the logs looking for something obvious and
nothing 
- did a grep for eth0 etc and the only thing that comes up is when the 
server was rebooted and snort kicked in and also when chkrootkit did
it's thing

The reboot switch was provided through my Colo and it's from APC, works 
from a separate IP and via a web interface. The switch allows me to do
the 
following...

1. Immediate switch off
2. Immediate switch on
3. Immediate reboot
4. Delayed off
5. Delayed on
6. Delayed reboot

Hence the reason I said "reboot"

/etc/cobalt/swatch/services/
ahttp = on
dns = on
ftp = on
http = on
imap = on (though disabled as per Carrie B's suggestions)
mgmt-httpd = off
pop3 = on
smtp = on (though not used)
snmp = off
telnet = off

Now I have snort running and if the network interface was lost then this

would have shown up in the logchecks - weird.

I also contacted the colo and they said there were no outages or
anything 
wrong with the network during the time the server was down.

So basically I'm still none the wiser :( It's up and running okay but it

would be nice if I knew what it was or how to prevent it from happening
again.

---------------------

What the GUI or even /etc/cobalt/swatch/services/
thinks _may_ be different from what a: ps -aux tells you.
The info from the ps command is what I use when I want
to know for sure what's running (and what's not).