Control Web Panel

WebPanel => CentOS 6 Problems => Topic started by: johnny09 on February 09, 2017, 07:03:19 AM

Title: Centos server restarts, would like to know why?
Post by: johnny09 on February 09, 2017, 07:03:19 AM

Hello,

so to understand what cause the shutdown here are the logs:

Feb  5 05:11:39 host rsyslogd-2177: imuxsock begins to drop messages from pid 11580 due to rate-limiting
Feb  5 05:11:41 host rsyslogd-2177: imuxsock begins to drop messages from pid 11583 due to rate-limiting
Feb  5 05:11:42 host rsyslogd-2177: imuxsock begins to drop messages from pid 11587 due to rate-limiting
Feb  5 05:11:46 host rsyslogd-2177: imuxsock lost 40 messages from pid 11587 due to rate-limiting
Feb  5 05:12:39 host rsyslogd-2177: imuxsock begins to drop messages from pid 11590 due to rate-limiting
Feb  5 05:31:13 host kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=00:19:b9:fa:24:b8:d4:ca:6d:07:36:55:08:00 SRC=115.28.39.26 DST=192.168.11.250 LEN=48 TOS=0x00 PREC=0x20 TTL=106 ID=4508 DF PROTO=TCP SPT=2357 DPT=3389 WINDOW=65535 RES=0x00 SYN URGP=0
Feb  5 05:31:16 host kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=00:19:b9:fa:24:b8:d4:ca:6d:07:36:55:08:00 SRC=115.28.39.26 DST=192.168.11.250 LEN=48 TOS=0x00 PREC=0x20 TTL=106 ID=32012 DF PROTO=TCP SPT=2357 DPT=3389 WINDOW=65535 RES=0x00 SYN URGP=0
Feb  5 05:31:22 host kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=00:19:b9:fa:24:b8:d4:ca:6d:07:36:55:08:00 SRC=115.28.39.26 DST=192.168.11.250 LEN=48 TOS=0x00 PREC=0x20 TTL=106 ID=22392 DF PROTO=TCP SPT=2357 DPT=3389 WINDOW=65535 RES=0x00 SYN URGP=0
Feb  5 05:33:39 host rsyslogd-2177: imuxsock begins to drop messages from pid 13329 due to rate-limiting
Feb  5 05:34:38 host rsyslogd-2177: imuxsock lost 214 messages from pid 13329 due to rate-limiting
Feb  5 05:34:39 host rsyslogd-2177: imuxsock begins to drop messages from pid 13329 due to rate-limiting
Feb  5 05:36:39 host rsyslogd-2177: imuxsock begins to drop messages from pid 13576 due to rate-limiting
Feb  5 05:37:39 host rsyslogd-2177: imuxsock lost 215 messages from pid 13576 due to rate-limiting
Feb  5 05:37:39 host rsyslogd-2177: imuxsock begins to drop messages from pid 13576 due to rate-limiting
Feb  5 05:39:02 host named[1902]: error (network unreachable) resolving 'dlv.isc.org/DNSKEY/IN': 2001:500:71::30#53
Feb  5 05:39:02 host named[1902]: error (network unreachable) resolving 'dlv.isc.org/DNSKEY/IN': 2001:4f8:0:2::19#53
Feb  5 05:39:02 host named[1902]: error (network unreachable) resolving 'dlv.isc.org/DNSKEY/IN': 2001:500:60::29#53
Feb  5 05:39:39 host rsyslogd-2177: imuxsock begins to drop messages from pid 13621 due to rate-limiting
Feb  5 05:40:38 host rsyslogd-2177: imuxsock lost 215 messages from pid 13621 due to rate-limiting
Feb  5 05:40:39 host rsyslogd-2177: imuxsock begins to drop messages from pid 13621 due to rate-limiting
Feb  5 10:32:46 host kernel: imklog 5.8.10, log source = /proc/kmsg started.
Feb  5 10:32:46 host rsyslogd: [origin software="rsyslogd" swVersion="5.8.10" x-pid="1504" x-info="http://www.rsyslog.com"] start
Feb  5 10:32:46 host kernel: Initializing cgroup subsys cpuset
Feb  5 10:32:46 host kernel: Initializing cgroup subsys cpu

Feb  6 10:08:59 host kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=00:19:b9:fa:24:b8:d4:ca:6d:07:36:55:08:00 SRC=74.82.47.56 DST=192.168.11.250 LEN=40 TOS=0x00 PREC=0x20 TTL=247 ID=54321 PROTO=TCP SPT=39035 DPT=3389 WINDOW=65535 RES=0x00 SYN URGP=0
Feb  6 10:12:15 host rsyslogd-2177: imuxsock begins to drop messages from pid 2594 due to rate-limiting
Feb  6 10:13:14 host rsyslogd-2177: imuxsock lost 214 messages from pid 2594 due to rate-limiting
Feb  6 10:13:15 host rsyslogd-2177: imuxsock begins to drop messages from pid 2594 due to rate-limiting
Feb  6 10:15:15 host rsyslogd-2177: imuxsock begins to drop messages from pid 3412 due to rate-limiting
Feb  6 10:16:14 host rsyslogd-2177: imuxsock lost 215 messages from pid 3412 due to rate-limiting
Feb  6 10:16:15 host rsyslogd-2177: imuxsock begins to drop messages from pid 3412 due to rate-limiting
Feb  6 10:18:16 host rsyslogd-2177: imuxsock begins to drop messages from pid 3649 due to rate-limiting
Feb  6 10:19:14 host rsyslogd-2177: imuxsock lost 215 messages from pid 3649 due to rate-limiting
Feb  6 10:19:15 host rsyslogd-2177: imuxsock begins to drop messages from pid 3649 due to rate-limiting
Feb  6 10:20:32 host rsyslogd-2177: imuxsock lost 218 messages from pid 3649 due to rate-limiting
Feb  6 10:21:15 host rsyslogd-2177: imuxsock begins to drop messages from pid 3649 due to rate-limiting
Feb  6 10:22:14 host rsyslogd-2177: imuxsock lost 218 messages from pid 3649 due to rate-limiting
Feb  6 10:22:15 host rsyslogd-2177: imuxsock begins to drop messages from pid 3649 due to rate-limiting
Feb  6 10:24:15 host rsyslogd-2177: imuxsock begins to drop messages from pid 4058 due to rate-limiting
Feb  6 10:25:14 host rsyslogd-2177: imuxsock lost 215 messages from pid 4058 due to rate-limiting
Feb  6 10:25:15 host rsyslogd-2177: imuxsock begins to drop messages from pid 4058 due to rate-limiting
Feb  6 10:27:15 host rsyslogd-2177: imuxsock begins to drop messages from pid 4195 due to rate-limiting
Feb  6 10:27:44 host rsyslogd-2177: imuxsock lost 215 messages from pid 4195 due to rate-limiting
Feb  6 10:33:00 host named[1905]: error (network unreachable) resolving 'dlv.isc.org/DNSKEY/IN': 2001:500:c::1#53
Feb  6 10:33:00 host named[1905]: error (network unreachable) resolving 'ns.isc.afilias-nst.info/A/IN': 2001:500:41::1#53
Feb  6 10:33:00 host named[1905]: error (network unreachable) resolving 'ns.isc.afilias-nst.info/AAAA/IN': 2001:500:41::1#53
Feb  6 10:33:00 host named[1905]: error (network unreachable) resolving 'ns.isc.afilias-nst.info/A/IN': 2001:500:19::1#53
Feb  6 10:33:00 host named[1905]: error (network unreachable) resolving 'ns.isc.afilias-nst.info/AAAA/IN': 2001:500:19::1#53
Feb  6 10:33:00 host named[1905]: error (network unreachable) resolving 'ns.isc.afilias-nst.info/A/IN': 2001:500:49::1#53
Feb  6 10:33:00 host named[1905]: error (network unreachable) resolving 'ns.isc.afilias-nst.info/AAAA/IN': 2001:500:49::1#53
Feb  6 10:33:00 host named[1905]: error (network unreachable) resolving 'dlv.isc.org/DNSKEY/IN': 2001:4f8:0:2::20#53
Feb  6 10:33:00 host named[1905]: error (network unreachable) resolving 'dlv.isc.org/DNSKEY/IN': 2001:500:60::29#53
Feb  6 10:40:14 host kernel: imklog 5.8.10, log source = /proc/kmsg started.
Feb  6 10:40:14 host rsyslogd: [origin software="rsyslogd" swVersion="5.8.10" x-pid="1505" x-info="http://www.rsyslog.com"] start
Feb  6 10:40:14 host kernel: Initializing cgroup subsys cpuset

Feb  6 10:08:59 host kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=00:19:b9:fa:24:b8:d4:ca:6d:07:36:55:08:00 SRC=74.82.47.56 DST=192.168.11.250 LEN=40 TOS=0x00 PREC=0x20 TTL=247 ID=54321 PROTO=TCP SPT=39035 DPT=3389 WINDOW=65535 RES=0x00 SYN URGP=0
Feb  6 10:12:15 host rsyslogd-2177: imuxsock begins to drop messages from pid 2594 due to rate-limiting
Feb  6 10:13:14 host rsyslogd-2177: imuxsock lost 214 messages from pid 2594 due to rate-limiting
Feb  6 10:13:15 host rsyslogd-2177: imuxsock begins to drop messages from pid 2594 due to rate-limiting
Feb  6 10:15:15 host rsyslogd-2177: imuxsock begins to drop messages from pid 3412 due to rate-limiting
Feb  6 10:16:14 host rsyslogd-2177: imuxsock lost 215 messages from pid 3412 due to rate-limiting
Feb  6 10:16:15 host rsyslogd-2177: imuxsock begins to drop messages from pid 3412 due to rate-limiting
Feb  6 10:18:16 host rsyslogd-2177: imuxsock begins to drop messages from pid 3649 due to rate-limiting
Feb  6 10:19:14 host rsyslogd-2177: imuxsock lost 215 messages from pid 3649 due to rate-limiting
Feb  6 10:19:15 host rsyslogd-2177: imuxsock begins to drop messages from pid 3649 due to rate-limiting
Feb  6 10:20:32 host rsyslogd-2177: imuxsock lost 218 messages from pid 3649 due to rate-limiting
Feb  6 10:21:15 host rsyslogd-2177: imuxsock begins to drop messages from pid 3649 due to rate-limiting
Feb  6 10:22:14 host rsyslogd-2177: imuxsock lost 218 messages from pid 3649 due to rate-limiting
Feb  6 10:22:15 host rsyslogd-2177: imuxsock begins to drop messages from pid 3649 due to rate-limiting
Feb  6 10:24:15 host rsyslogd-2177: imuxsock begins to drop messages from pid 4058 due to rate-limiting
Feb  6 10:25:14 host rsyslogd-2177: imuxsock lost 215 messages from pid 4058 due to rate-limiting
Feb  6 10:25:15 host rsyslogd-2177: imuxsock begins to drop messages from pid 4058 due to rate-limiting
Feb  6 10:27:15 host rsyslogd-2177: imuxsock begins to drop messages from pid 4195 due to rate-limiting
Feb  6 10:27:44 host rsyslogd-2177: imuxsock lost 215 messages from pid 4195 due to rate-limiting
Feb  6 10:33:00 host named[1905]: error (network unreachable) resolving 'dlv.isc.org/DNSKEY/IN': 2001:500:c::1#53
Feb  6 10:33:00 host named[1905]: error (network unreachable) resolving 'ns.isc.afilias-nst.info/A/IN': 2001:500:41::1#53
Feb  6 10:33:00 host named[1905]: error (network unreachable) resolving 'ns.isc.afilias-nst.info/AAAA/IN': 2001:500:41::1#53
Feb  6 10:33:00 host named[1905]: error (network unreachable) resolving 'ns.isc.afilias-nst.info/A/IN': 2001:500:19::1#53
Feb  6 10:33:00 host named[1905]: error (network unreachable) resolving 'ns.isc.afilias-nst.info/AAAA/IN': 2001:500:19::1#53
Feb  6 10:33:00 host named[1905]: error (network unreachable) resolving 'ns.isc.afilias-nst.info/A/IN': 2001:500:49::1#53
Feb  6 10:33:00 host named[1905]: error (network unreachable) resolving 'ns.isc.afilias-nst.info/AAAA/IN': 2001:500:49::1#53
Feb  6 10:33:00 host named[1905]: error (network unreachable) resolving 'dlv.isc.org/DNSKEY/IN': 2001:4f8:0:2::20#53
Feb  6 10:33:00 host named[1905]: error (network unreachable) resolving 'dlv.isc.org/DNSKEY/IN': 2001:500:60::29#53
Feb  6 10:40:14 host kernel: imklog 5.8.10, log source = /proc/kmsg started.
Feb  6 10:40:14 host rsyslogd: [origin software="rsyslogd" swVersion="5.8.10" x-pid="1505" x-info="http://www.rsyslog.com"] start
Feb  6 10:40:14 host kernel: Initializing cgroup subsys cpuset

TOS=0x00 PREC=0x20 TTL=106 ID=30772 DF PROTO=TCP SPT=1299 DPT=3389 WINDOW=65535 RES=0x00 SYN URGP=0
Feb  6 10:02:14 host rsyslogd-2177: imuxsock begins to drop messages from pid 1723 due to rate-limiting
Feb  6 10:03:14 host rsyslogd-2177: imuxsock lost 12 messages from pid 1723 due to rate-limiting
Feb  6 10:04:15 host rsyslogd-2177: imuxsock begins to drop messages from pid 1723 due to rate-limiting
Feb  6 10:08:59 host kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=00:19:b9:fa:24:b8:d4:ca:6d:07:36:55:08:00 SRC=74.82.47.56 DST=192.168.11.250 LEN=40 TOS=0x00 PREC=0x20 TTL=247 ID=54321 PROTO=TCP SPT=39035 DPT=3389 WINDOW=65535 RES=0x00 SYN URGP=0
Feb  6 10:12:15 host rsyslogd-2177: imuxsock begins to drop messages from pid 2594 due to rate-limiting
Feb  6 10:13:14 host rsyslogd-2177: imuxsock lost 214 messages from pid 2594 due to rate-limiting
Feb  6 10:13:15 host rsyslogd-2177: imuxsock begins to drop messages from pid 2594 due to rate-limiting
Feb  6 10:15:15 host rsyslogd-2177: imuxsock begins to drop messages from pid 3412 due to rate-limiting
Feb  6 10:16:14 host rsyslogd-2177: imuxsock lost 215 messages from pid 3412 due to rate-limiting
Feb  6 10:16:15 host rsyslogd-2177: imuxsock begins to drop messages from pid 3412 due to rate-limiting
Feb  6 10:18:16 host rsyslogd-2177: imuxsock begins to drop messages from pid 3649 due to rate-limiting
Feb  6 10:19:14 host rsyslogd-2177: imuxsock lost 215 messages from pid 3649 due to rate-limiting
Feb  6 10:19:15 host rsyslogd-2177: imuxsock begins to drop messages from pid 3649 due to rate-limiting
Feb  6 10:20:32 host rsyslogd-2177: imuxsock lost 218 messages from pid 3649 due to rate-limiting
Feb  6 10:21:15 host rsyslogd-2177: imuxsock begins to drop messages from pid 3649 due to rate-limiting
Feb  6 10:22:14 host rsyslogd-2177: imuxsock lost 218 messages from pid 3649 due to rate-limiting
Feb  6 10:22:15 host rsyslogd-2177: imuxsock begins to drop messages from pid 3649 due to rate-limiting
Feb  6 10:24:15 host rsyslogd-2177: imuxsock begins to drop messages from pid 4058 due to rate-limiting
Feb  6 10:25:14 host rsyslogd-2177: imuxsock lost 215 messages from pid 4058 due to rate-limiting
Feb  6 10:25:15 host rsyslogd-2177: imuxsock begins to drop messages from pid 4058 due to rate-limiting
Feb  6 10:27:15 host rsyslogd-2177: imuxsock begins to drop messages from pid 4195 due to rate-limiting
Feb  6 10:27:44 host rsyslogd-2177: imuxsock lost 215 messages from pid 4195 due to rate-limiting
Feb  6 10:33:00 host named[1905]: error (network unreachable) resolving 'dlv.isc.org/DNSKEY/IN': 2001:500:c::1#53
Feb  6 10:33:00 host named[1905]: error (network unreachable) resolving 'ns.isc.afilias-nst.info/A/IN': 2001:500:41::1#53
Feb  6 10:33:00 host named[1905]: error (network unreachable) resolving 'ns.isc.afilias-nst.info/AAAA/IN': 2001:500:41::1#53
Feb  6 10:33:00 host named[1905]: error (network unreachable) resolving 'ns.isc.afilias-nst.info/A/IN': 2001:500:19::1#53
Feb  6 10:33:00 host named[1905]: error (network unreachable) resolving 'ns.isc.afilias-nst.info/AAAA/IN': 2001:500:19::1#53
Feb  6 10:33:00 host named[1905]: error (network unreachable) resolving 'ns.isc.afilias-nst.info/A/IN': 2001:500:49::1#53
Feb  6 10:33:00 host named[1905]: error (network unreachable) resolving 'ns.isc.afilias-nst.info/AAAA/IN': 2001:500:49::1#53
Feb  6 10:33:00 host named[1905]: error (network unreachable) resolving 'dlv.isc.org/DNSKEY/IN': 2001:4f8:0:2::20#53
Feb  6 10:33:00 host named[1905]: error (network unreachable) resolving 'dlv.isc.org/DNSKEY/IN': 2001:500:60::29#53
Feb  6 10:40:14 host kernel: imklog 5.8.10, log source = /proc/kmsg started.
Feb  6 10:40:14 host rsyslogd: [origin software="rsyslogd" swVersion="5.8.10" x-pid="1505" x-info="http://www.rsyslog.com"] start
Feb  6 10:40:14 host kernel: Initializing cgroup subsys cpuset

if you need more, I can send it to you!

Please give me a hint - to worry or it is not anything bad...

Title: Re: Centos server restarts, would like to know why?
Post by: botonakis on February 24, 2017, 09:44:20 AM

are you sure the server restarts by itself?

Title: Re: Centos server restarts, would like to know why?
Post by: johnny09 on February 24, 2017, 10:01:31 AM

Thats what I am trying to find out.
Reconfigured my router, added mod security, now it looks better....

But how to know if someone else restarted my server??? Were and what to look at???

Title: Re: Centos server restarts, would like to know why?
Post by: darkness on March 18, 2017, 07:58:19 AM

Did you checked your history? Just write "history" and check if somewhere there is "shutdown -r ***" or "reboot".

Title: Re: Centos server restarts, would like to know why?
Post by: shashikant on March 22, 2017, 02:15:50 PM

Hi,

Please run last reboot command and check cron log, messages log, ssh secure log.

[root@ ~]# last reboot

Regards,
Shashikant Sutar