Hi Joe!
First of all I don't know if this is a bug! Today our server stoped responding, server was running and there was some activity on the network. No respond from httpd, ssh, mail, Webmin or Usermin! We hade to call our support to manual restart the box. The server started up ok, and when looking at some log file it looks like it "hanged" after this message in "/var/log/maillog":
>>> Nov 13 18:00:22 server postfix/sendmail[8274]: fatal: usage: sendmail [options]
Restart >>> Nov 13 18:28:03 server postfix/postfix-script: stopping the Postfix mail system
Nov 13 18:28:03 server postfix/master[4213]: terminating on signal 15
Nov 13 18:28:03 server dovecot: Killed with signal 15
Nov 13 18:29:34 server dovecot: Dovecot starting up
Nov 13 18:29:37 server postfix/postfix-script: starting the Postfix mail system
Nov 13 18:29:37 server postfix/master[1916]: daemon started -- version 2.2.2, configuration /etc/postfix
I often get the same error in Logwatch:
**Unmatched Entries**
fatal: usage: sendmail [options]
What is the cause of this error. I dont know if this have something to do with the "hang" today but there NEVER is 30min of nothing happening in the maillog.
There are also two similar processes running :
4578 root 0.0 % /usr/bin/perl /usr/libexec/webmin/miniserv.pl /etc/webmin/miniserv.conf
4579 root 0.0 % /usr/bin/perl /usr/libexec/webmin/miniserv.pl /etc/webmin/miniserv.conf
Is this ok?
Here is also a part of "/var/log/messages" from the same time:
Nov 13 17:13:35 server dovecot(pam_unix)[7902]: check pass; user unknown
Nov 13 17:13:35 server dovecot(pam_unix)[7902]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=
Nov 13 17:20:42 server dovecot(pam_unix)[7991]: check pass; user unknown
Nov 13 17:20:42 server dovecot(pam_unix)[7991]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=
Nov 13 18:21:25 server kernel: input: AT Translated Set 2 keyboard as /class/input/input0
Nov 13 18:27:55 server shutdown: shutting down for system reboot
Nov 13 18:27:55 server init: Switching to runlevel: 6
Nov 13 18:27:57 server dbus: avc: 2 AV entries and 2/512 buckets used, longest chain length 1
Nov 13 18:27:58 server saslauthd[1991]: server_exit : master exited: 1991
Nov 13 18:27:58 server xfs[1962]: terminating
Nov 13 18:28:08 server rpc.statd[1472]: Caught signal 15, un-registering and exiting.
Nov 13 18:28:08 server auditd[1484]: The audit daemon is exiting.
And there are always lots of these lines that I don't know the cause of:
Nov 13 23:20:01 server dovecot(pam_unix)[13307]: check pass; user unknown
Nov 13 23:20:01 server dovecot(pam_unix)[13307]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=
Nov 13 23:27:09 server dovecot(pam_unix)[13408]: check pass; user unknown
Nov 13 23:27:09 server dovecot(pam_unix)[13408]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=
Nov 13 23:34:17 server dovecot(pam_unix)[13510]: check pass; user unknown
Nov 13 23:34:17 server dovecot(pam_unix)[13510]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=
Nov 13 23:41:25 server dovecot(pam_unix)[13722]: check pass; user unknown
Nov 13 23:41:25 server dovecot(pam_unix)[13722]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=
Do you have any ideas or sugestions where to look for the cause to the server not responding earlier today! Fortunately I was in the office and did notice this after about 30min server downtime. It would be nice to know what the cause was so we can try to avoid this happening again.
Regards,
Leif