RE: [cobalt-users] dmesg

["Andy Brown" <andy.brown@xxxxxxxxxxxxx>]

<snip>
> raq3:
> flooding on port 80. Sending cookies.
> possible SYN flooding on port 80. Sending cookies.
> VM: do_try_to_free_pages failed for index.cgi...
> Unable to load interpreter /lib/ld-linux.so.2
</snip>

I only noticed this the other day, but our Qube3 died, and that was the last thing it said. From what I can tell, something exhausted all system resources and the machine just hung. Its interesting here that the VM call was to index.cgi are there any scripts that are called that in your sites??
Looks like somebody might have been trying a brute-force to crack your admin password, or something that causes the resources to get used up. Keep a close eye on your logs, and watch for security alerts from portsentry (You've got it installed... right?) also might be worth running a chkroot check just in case.

<snip>
> raq4:
> portmap: RPC call returned error 111
> RPC: task of released request still queued!
> RPC: (task is on xprt_pending)
> portmap: RPC call returned error 111
> RPC: task of released request still queued!
> RPC: (task is on xprt_pending)
> lockd_up: makesock failed, error=-111
> portmap: RPC call returned error 111
> RPC: task of released request still queued!
> RPC: (task is on xprt_pending)
</snip>

This is normal (!) its a call that is included on all the RaQs that i've found (3's and 4's here) and nothing to worry about.

<snip>
> possible SYN flooding on port 80. Sending cookies.
> possible SYN flooding on port 80. Sending cookies.
> ......
</snip>

Hmmz, i'd be keeping an eye on your servers, relating to hacks, etc...


Regards,

Andy
andy@xxxxxxxxxx
http://www.raqpak.com/ <-- Raq/Qube unofficial PKGs and support advice