Server ausgerastet ?

Chaoshh · 11 Juni 2010

Grüsst euch. Ich habe gerade ein Problem an einem Suse 11.0 Server erlebt, da kräuseln sich die Haare.

Der Server verwaltet ein Netzwerk, es läuft darauf hauptsächlich der Samba Dienst. An dem Netzwerk gibt es 8-11 Rechner, alle auf wXP pro oder wXP homo. Ich sollte neue Benutzer auf den Clients und in Samba einrichten, damit sie alle auf die Freigaben zugreifen können. Natürlich nicht auf alle für alle, sondern nach Gruppen. Ich habe es geschafft und es lief ein paar Tage wunderbar. Ohne jegliche Einschränkungen. Inzwischen berichtet mir der Auftraggeber, daß der Server hin und wieder einfriert und neugestartet werden muss. Zuletzt vor einigen Tagen.

Heute nun, sollte ich einige Sachen noch verbessern, Benuter zu anderen Gruppen hinzufügen, den FTP Dienst konfigurieren, Mailserver überprüfen, neue Drucker einbinden und einiges auf den Clients in Ordnung bringen etc.

Plötzlich gingen auf allen Rechnern die Netzlaufwerke - SMB Freigaben - nicht, obwohl ich am Server nur mit Yast vsftp installierte und sonst noch garnix am Server getan habe. Ab diesem Momment aber passierten kuriose Sachen:
- die Benutzer konnten nicht mehr auf alle Freigaben zugreifen
- die Benutzer konnten nicht gleichzeitig auf den gleichen SMB Freigabeordner zugreifen (!?)
- die /etc/passwd, /etc/shadow und /etc/group wurden auf den Stand von vor meinem ersten Besuch zurückgesetzt (!?), alle benutzer die ich vor 1 Woche angelegt hatte, waren plötzlich aus diesen Dateien verschwunden
- Datenbanken auf den Server bzw. in den Freigaben wurden nicht erreicht
- und die absolute Krönung - ich konnte mit Putty nicht mehr arbeiten, ich musste an den Server direkt ran. Gab ich bei Putty einen befehl ein, dann hatten sich plötzlich die ersten Zeichen des Befehls verstellt.

Beispiel:

Code:

server:~# cp -r /home/username/Verzeichnis

Nach dem ich Return drückte kam unter anderem raus:

Code:

server:~# c-pr /home/username/Verzeichnis
oder 
server:~# p-cr/home/username/Verzeichnis

Und dann passierte nocht, daß beim Prompt von Putty ein "p" erschien und sich nicht wegmachen ließ. Somit war es nicht möglich einen korrekten Befehl einzutippen.

Ich habe das Problem eher umgangen als gelöst - ich habe die menu.lst editiert und den Failsafe Modus gewählt. Erst da lief alles wieder richtig. Sowohl Samba wie die Konsole. Von nun an gab es keinerlei Probleme mehr - zumindest bisher. Das ich das so lösen konnte war allerdings eher Glück.

Ich wüsste gerne was Ihr von diesen Mist haltet, ich persönlich tippe, daß es der Kernel war. Der Kernel ist übrigens: 2.6.27.7-9-default.

Ich habe Zugriff auf die Logfiles, bin aber in dem Stress nicht dazu gekommen sie auszuwerten und bin auch nicht so der Adler daran. Ich bin mira uch nich sicher wo ich suchen sollte, ist jetzt spät und bin echt ausgelaugt dadurch.
Hat noch wer von euch liebe linuxer das mal erlebt?

marce · 11 Juni 2010

Hardwarefehler?

whois · 11 Juni 2010

Chaoshh schrieb:
Ich habe Zugriff auf die Logfiles, bin aber in dem Stress nicht dazu gekommen sie auszuwerten und bin auch nicht so der Adler daran. Ich bin mira uch nich sicher wo ich suchen sollte, ist jetzt spät und bin echt ausgelaugt dadurch.
Hat noch wer von euch liebe linuxer das mal erlebt?

Nee sowas ist mir noch nicht passiert.

Bin echt mal gespannt ob die logs was hergeben.
Poste bitte das Ergebnis.

Geier0815 · 11 Juni 2010

Als Erstes: Nimm den Server vom Netz! Dann darfst Du mal in /bin und /usr/bin gucken ob irgendwelche Dateien das Datum von gestern bzw heute tragen. Nimm die Suse DVD von der Du auch installiert hast und laß eine Reparatur laufen, achte besonders auf die Paketüberprüfung.

Wenn sich das Datum der binär-Dateien geändert hat oder etliche Pakete nicht mehr den Stand der DVD haben, kannst Du davon ausgehen das deine Kiste aufgemacht wurde. Habe ich selbst einmal erlebt, war gottseidank "nur" ein reiner Mail-Server und wie wir anhand der Backups sehen konnten "nur" für drei Tage gekapert. Wichtigste Regel: Trau keiner Datei dieses Rechners! Keine Reparatur, kein "diese Datei brauchen wir noch"! Mach die Kiste platt und setze sie komplett neu auf. Bring die Antivirenlösung der Clients auf den neuesten Stand! Verwende andere, sichere Passworte. Halte die Software auf dem neuesten Stand, sprich spiele sämtliche Updates ein. Wenn es kein SLES oder SLED ist, nimm eine aktuelle Suse-Version, 11.0 ist veraltet!

Chaoshh · 11 Juni 2010

Ein Hardwarefehler ist natürlich möglich, das hatte ich auch schon gedacht. Der müsste dann aber den Kernel zerschossen haben, denn die Failsafe Version läuft jetzt auch noch. Noch weiß ich aber nicht was es sein könnte.

Also es wurde keine Binärdatei im /bin bzw. in dem /usr/bin Verzeichnis verändert.

Gerade eben hatte ich yast gestartet und als ich Yast wieder verließ sah ich diese Fehlermeldung auf der Konsole:

Code:

server:~ # yast
cat: write error: Broken pipe
server:~ #

Die muss erschienen sein, während ich im yast einige Ports der Firewall freischaltete damit ich die FW dann einschalten kann. Recherche im Netz ergab nur, dass der Fehler in verschiedenen Situationen auftreten kann.Nichts vergleichbaresmit dieser.

Eine interessante Ausgabe:

Code:

server:~ # cat /var/log/messages | head -120
Jun  8 09:30:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 09:30:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 09:30:38 server888 kernel: klogd 1.4.1, ---------- state change ----------
Jun  8 09:31:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 09:31:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 09:32:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 09:32:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 09:33:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 09:33:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 09:34:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 09:30:13 server888 syslog-ng[1906]: Configuration reload request received, reloading configuration;
Jun  8 09:34:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 09:35:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 09:50:11 server888 avahi-daemon[3346]: Invalid query packet.
Jun  8 12:31:56 server888 smartd[3971]: Device: /dev/sda [SAT], SMART Usage Attribute: 194 Temperature_Celsius changed from 146 to 142
Jun  8 13:47:26 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 13:47:26 server888 avahi-daemon[3346]: Invalid query packet.
Jun  8 13:47:27 server888 avahi-daemon[3346]: Invalid query packet.
Jun  8 13:47:27 server888 avahi-daemon[3346]: Invalid query packet.
Jun  8 13:47:27 server888 avahi-daemon[3346]: Invalid query packet.
Jun  8 13:47:27 server888 avahi-daemon[3346]: Invalid query packet.
Jun  8 13:47:26 server888 syslog-ng[1906]: New configuration initialized;
Jun  8 13:47:27 server888 avahi-daemon[3346]: Invalid query packet.
Jun  8 13:47:27 server888 avahi-daemon[3346]: Invalid query packet.
Jun  8 13:47:27 server888 kernel:  event=4 ????
Jun  8 13:47:27 server888 avahi-daemon[3346]: Invalid query packet.
Jun  8 13:47:27 server888 kernel: capidrv-1: listen_change_state state=2 event=4 ????
Jun  8 13:47:27 server888 avahi-daemon[3346]: Invalid query packet.
Jun  8 13:47:27 server888 kernel: capidrv-1: listen_change_state state=2 event=4 ????
Jun  8 13:47:27 server888 avahi-daemon[3346]: Invalid query packet.
Jun  8 13:47:27 server888 kernel: capidrv-1: listen_change_state state=2 event=4 ????
Jun  8 13:47:27 server888 avahi-daemon[3346]: Invalid query packet.
Jun  8 13:47:27 server888 kernel: capidrv-1: listen_change_state state=2 event=4 ????
Jun  8 13:47:27 server888 avahi-daemon[3346]: Invalid query packet.
Jun  8 13:47:28 server888 avahi-daemon[3346]: Invalid query packet.
Jun  8 13:47:28 server888 avahi-daemon[3346]: Invalid query packet.
Jun  8 13:47:27 server888 kernel: capidrv-1: listen_change_state state=2 event=4 ????
Jun  8 13:47:28 server888 kernel: capidrv-1: listen_change_state state=2 event=4 ????
Jun  8 13:47:28 server888 kernel: capidrv-1: listen_change_state state=2 event=4 ????
Jun  8 13:47:28 server888 kernel: capidrv-1: listen_change_state state=2 event=4 ????
Jun  8 13:47:28 server888 kernel: capidrv-1: listen_change_state state=2 event=4 ????
Jun  8 13:47:28 server888 kernel: capidrv-1: listen_change_state state=2 event=4 ????
Jun  8 13:47:28 server888 kernel: capidrv-1: listen_change_state state=2 event=4 ????
Jun  8 13:47:28 server888 kernel: capidrv-1: listen_change_state state=2 event=4 ????
Jun  8 13:47:28 server888 kernel: capidrv-1: listen_change_state state=2 event=4 ????
Jun  8 13:47:28 server888 kernel: capidrv-1: listen_change_state state=2 event=4 ????
........

Der ISDN Controller oder Capi scheint nicht zu funktionieren...

Dann geht das so 6000-7000 Zeilen genauso weiter und dann kommen solche Fehlermeldungen wie unten. Mit den

Code:

....
..
.

habe ich das ganze verkürzt weil zig oder gar hunderte dieser gleichen Zeilen wären sinnfrei. Überall wo das zu sehen ist, wiederholt sich die vorherige Zeile also sehr oft.

Code:

Jun  8 13:49:21 server888 kernel: capidrv-1: listen_change_state state=2 event=4 ????
Jun  8 13:49:21 server888 kernel: capidrv-1: listen_change_state state=2 event=4 ????
Jun  8 13:49:21 server888 kernel: capidrv-1: listen_change_state state=2 event=4 ????
Jun  8 13:49:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 13:49:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 13:50:17 server888 kernel: capidrv-1: listen_change_state state=2 event=4 ????
Jun  8 14:07:35 server888 avahi-daemon[3346]: Invalid query packet.
Jun  8 14:07:36 server888 avahi-daemon[3346]: Invalid query packet.
Jun  8 14:07:36 server888 avahi-daemon[3346]: Invalid query packet.
Jun  8 14:08:38 server888 avahi-daemon[3346]: Invalid query packet.
Jun  8 14:08:38 server888 avahi-daemon[3346]: Invalid query packet.
Jun  8 14:08:39 server888 avahi-daemon[3346]: Invalid query packet.
Jun  8 14:17:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 14:17:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 14:18:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 14:18:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
....
..
.
Jun  8 14:44:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 14:45:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 14:45:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 14:46:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 14:46:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 14:47:26 server888 syslog-ng[1906]: Log statistics; dropped='pipe(/dev/xconsole)=15159', dropped='pipe(/dev/tty10)=0', processed='center(queued)=19411', processed='center(received)=4867', processed='destination(newsnotice)=0', processed='destination(acpid)=0', processed='destination(firewall)=0', processed='destination(null)=0', processed='destination(mail)=0', processed='destination(mailinfo)=0', processed='destination(console)=4841', processed='destination(newserr)=0', processed='destination(newscrit)=0', processed='destination(messages)=4867', processed='destination(mailwarn)=0', processed='destination(localmessages)=0', processed='destination(netmgm)=0', processed='destination(mailerr)=0', processed='destination(xconsole)=4841', processed='destination(warn)=4862', processed='source(src)=4867'
Jun  8 14:47:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 14:47:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 14:48:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 14:48:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
....
..
.
Jun  8 15:09:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 15:10:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 15:10:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 15:11:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 15:11:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 15:12:18 server888 kernel: capidrv-1: listen_change_state state=2 event=4 ????
Jun  8 15:12:18 server888 kernel: capidrv-1: listen_change_state state=2 event=4 ????
Jun  8 15:12:18 server888 kernel: capidrv-1: listen_change_state state=2 event=4 ????
Jun  8 15:12:18 server888 kernel: capidrv-1: listen_change_state state=2 event=4 ????
....
..
.
Jun  8 15:12:18 server888 kernel: capidrv-1: listen_change_state state=2 event=4 ????
Jun  8 15:12:18 server888 kernel: capidrv-1: listen_change_state state=2 event=4 ????
Jun  8 15:12:18 server888 kernel: capidrv-1: listen_change_state state=2 event=4 ????
Jun  8 15:12:18 server888 kernel: capidrv-1: listen_change_state state=2 event=4 ????
Jun  8 15:14:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 15:14:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 15:15:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 15:15:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 15:16:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 15:16:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 15:16:58 server888 kernel: capidrv-1: listen_change_state state=2 event=4 ????
Jun  8 15:16:58 server888 kernel: capidrv-1: listen_change_state state=2 event=4 ????
Jun  8 15:16:58 server888 kernel: capidrv-1: listen_change_state state=2 event=4 ????
Jun  8 15:18:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 15:18:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 15:19:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 15:19:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 15:20:38 server888 kernel: capidrv-1: controller dead ??
....
..
.
Jun  8 15:45:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 15:46:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 15:46:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 15:47:26 server888 syslog-ng[1906]: Log statistics; dropped='pipe(/dev/xconsole)=15331', dropped='pipe(/dev/tty10)=0', processed='center(queued)=20100', processed='center(received)=5040', processed='destination(newsnotice)=0', processed='destination(acpid)=0', processed='destination(firewall)=0', processed='destination(null)=0', processed='destination(mail)=0', processed='destination(mailinfo)=0', processed='destination(console)=5013', processed='destination(newserr)=0', processed='destination(newscrit)=0', processed='destination(messages)=5040', processed='destination(mailwarn)=0', processed='destination(localmessages)=0', processed='destination(netmgm)=0', processed='destination(mailerr)=0', processed='destination(xconsole)=5013', processed='destination(warn)=5034', processed='source(src)=5040'
Jun  8 15:47:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 15:47:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 15:48:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 15:48:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 15:49:38 server888 kernel: capidrv-1: controller dead ??
....
..
.
Jun  8 15:59:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 16:00:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 16:00:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 16:01:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 16:01:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 16:01:55 server888 smartd[3971]: Device: /dev/sda [SAT], SMART Usage Attribute: 194 Temperature_Celsius changed from 142 to 139
Jun  8 16:02:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 16:02:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 16:03:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 16:03:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 16:04:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 16:04:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 16:05:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 16:05:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 16:06:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 16:06:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 16:07:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 16:07:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 16:08:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 16:08:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 16:08:41 server888 avahi-daemon[3346]: Invalid query packet.
Jun  8 16:08:41 server888 avahi-daemon[3346]: Invalid query packet.
Jun  8 16:08:41 server888 avahi-daemon[3346]: Invalid query packet.
Jun  8 16:09:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 16:09:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 16:10:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 16:10:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 16:11:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 16:11:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
....
..
.
Jun  8 16:43:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 16:44:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 16:44:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 16:45:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 16:45:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 16:46:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 16:46:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 16:47:26 server888 syslog-ng[1906]: Log statistics; dropped='pipe(/dev/xconsole)=15451', dropped='pipe(/dev/tty10)=0', processed='center(queued)=20588', processed='center(received)=5165', processed='destination(newsnotice)=0', processed='destination(acpid)=0', processed='destination(firewall)=0', processed='destination(null)=0', processed='destination(mail)=0', processed='destination(mailinfo)=0', processed='destination(console)=5133', processed='destination(newserr)=0', processed='destination(newscrit)=0', processed='destination(messages)=5165', processed='destination(mailwarn)=0', processed='destination(localmessages)=0', processed='destination(netmgm)=0', processed='destination(mailerr)=0', processed='destination(xconsole)=5133', processed='destination(warn)=5157', processed='source(src)=5165'
Jun  8 16:47:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 16:47:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 16:48:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 16:48:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 16:49:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 16:49:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 16:50:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 16:50:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 16:51:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 16:51:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 16:52:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 16:52:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 16:53:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 16:53:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 16:54:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 16:54:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 16:55:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 16:55:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 16:56:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 16:56:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 16:57:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 16:57:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 16:57:40 server888 kernel: capidrv-1: listen_change_state state=2 event=4 ????
Jun  8 16:57:40 server888 kernel: capidrv-1: listen_change_state state=2 event=4 ????
Jun  8 16:57:40 server888 kernel: capidrv-1: listen_change_state state=2 event=4 ????
Jun  8 16:57:40 server888 kernel: capidrv-1: listen_change_state state=2 event=4 ????
....
..
.
Jun  8 16:57:42 server888 kernel: capidrv-1: listen_change_state state=2 event=4 ????
Jun  8 16:57:42 server888 kernel: capidrv-1: listen_change_state state=2 event=4 ????
Jun  8 16:57:42 server888 kernel: capidrv-1: listen_change_state state=2 event=4 ????
Jun  8 16:57:42 server888 kernel: capidrv-1: listen_change_state state=2 event=4 ????
Jun  8 16:57:42 server888 kernel: capidrv-1: listen_change_state state=2 event=4 ????
Jun  8 16:57:42 server888 kernel: capidrv-1: listen_change_state state=2 event=4 ????
Jun  8 17:12:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 17:12:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 17:13:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 17:13:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 17:14:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 17:14:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 17:15:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 17:15:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 17:16:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 17:16:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 17:17:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 17:17:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 17:18:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 17:18:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 17:19:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 17:19:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 17:19:55 server888 kernel: capidrv-1: listen_change_state state=2 event=4 ????
Jun  8 17:19:55 server888 kernel: capidrv-1: listen_change_state state=2 event=4 ????
Jun  8 17:19:55 server888 kernel: capidrv-1: listen_change_state state=2 event=4 ????
Jun  8 17:19:55 server888 kernel: capidrv-1: listen_change_state state=2 event=4 ????
Jun  8 17:19:55 server888 kernel: capidrv-1: listen_change_state state=2 event=4 ????
Jun  8 17:19:55 server888 kernel: capidrv-1: listen_change_state state=2 event=4 ????
Jun  8 17:19:55 server888 kernel: capidrv-1: listen_change_state state=2 event=4 ????
Jun  8 17:19:55 server888 kernel: capidrv-1: listen_change_state state=2 event=4 ????
Jun  8 17:33:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 17:33:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 17:34:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 17:34:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 17:35:38 server888 kernel: capidrv-1: controller dead ??
....
..
.
Jun  8 17:45:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 17:45:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 17:46:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 17:46:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 17:47:26 server888 syslog-ng[1906]: Log statistics; dropped='pipe(/dev/xconsole)=15625', dropped='pipe(/dev/tty10)=0', processed='center(queued)=21285', processed='center(received)=5340', processed='destination(newsnotice)=0', processed='destination(acpid)=0', processed='destination(firewall)=0', processed='destination(null)=0', processed='destination(mail)=0', processed='destination(mailinfo)=0', processed='destination(console)=5307', processed='destination(newserr)=0', processed='destination(newscrit)=0', processed='destination(messages)=5340', processed='destination(mailwarn)=0', processed='destination(localmessages)=0', processed='destination(netmgm)=0', processed='destination(mailerr)=0', processed='destination(xconsole)=5307', processed='destination(warn)=5331', processed='source(src)=5340'
Jun  8 17:47:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 17:47:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 17:48:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 17:48:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
....
..
.
Jun  8 17:55:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 17:56:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 17:56:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 17:57:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 17:57:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 17:58:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 17:58:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 17:59:00 server888 kernel: capidrv-1: listen_change_state state=2 event=4 ????
Jun  8 17:59:00 server888 kernel: capidrv-1: listen_change_state state=2 event=4 ????
....
..
.
Jun  8 17:59:01 server888 kernel: capidrv-1: listen_change_state state=2 event=4 ????
Jun  8 17:59:01 server888 kernel: capidrv-1: listen_change_state state=2 event=4 ????
Jun  8 17:59:01 server888 kernel: capidrv-1: listen_change_state state=2 event=4 ????
Jun  8 18:00:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 18:00:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 18:01:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 18:01:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 18:02:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 18:02:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 18:03:38 server888 kernel: capidrv-1: controller dead ??
....
..
.
Jun  8 18:44:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 18:45:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 18:45:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 18:46:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 18:46:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 18:47:26 server888 syslog-ng[1906]: Log statistics; dropped='pipe(/dev/xconsole)=15769', dropped='pipe(/dev/tty10)=0', processed='center(queued)=21862', processed='center(received)=5485', processed='destination(newsnotice)=0', processed='destination(acpid)=0', processed='destination(firewall)=0', processed='destination(null)=0', processed='destination(mail)=0', processed='destination(mailinfo)=0', processed='destination(console)=5451', processed='destination(newserr)=0', processed='destination(newscrit)=0', processed='destination(messages)=5485', processed='destination(mailwarn)=0', processed='destination(localmessages)=0', processed='destination(netmgm)=0', processed='destination(mailerr)=0', processed='destination(xconsole)=5451', processed='destination(warn)=5475', processed='source(src)=5485'
Jun  8 18:47:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 18:47:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 18:48:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 18:48:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 18:49:38 server888 kernel: capidrv-1: controller dead ??
....
..
.
Jun  8 19:07:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 19:08:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 19:08:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 19:09:25 server888 avahi-daemon[3346]: Invalid query packet.
Jun  8 19:09:25 server888 avahi-daemon[3346]: Invalid query packet.
Jun  8 19:09:25 server888 avahi-daemon[3346]: Invalid query packet.
Jun  8 19:09:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 19:09:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 19:10:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 19:10:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
....
..
.
Jun  8 19:41:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 19:41:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 19:42:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 19:42:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 19:42:39 server888 avahi-daemon[3346]: Invalid query packet.
Jun  8 19:42:39 server888 avahi-daemon[3346]: Invalid query packet.
Jun  8 19:42:39 server888 avahi-daemon[3346]: Invalid query packet.
Jun  8 19:43:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 19:43:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 19:44:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 19:44:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 19:45:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 19:45:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 19:46:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 19:46:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 19:47:26 server888 syslog-ng[1906]: Log statistics; dropped='pipe(/dev/xconsole)=15889', dropped='pipe(/dev/tty10)=0', processed='center(queued)=22355', processed='center(received)=5612', processed='destination(newsnotice)=0', processed='destination(acpid)=0', processed='destination(firewall)=0', processed='destination(null)=0', processed='destination(mail)=0', processed='destination(mailinfo)=0', processed='destination(console)=5571', processed='destination(newserr)=0', processed='destination(newscrit)=0', processed='destination(messages)=5612', processed='destination(mailwarn)=0', processed='destination(localmessages)=0', processed='destination(netmgm)=0', processed='destination(mailerr)=0', processed='destination(xconsole)=5571', processed='destination(warn)=5601', processed='source(src)=5612'
Jun  8 19:47:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 19:47:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 19:48:38 server888 kernel: capidrv-1: controller dead ??
....
..
.
Jun  8 19:57:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 19:57:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 19:58:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 19:58:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 19:58:59 server888 avahi-daemon[3346]: Invalid query packet.
Jun  8 19:58:59 server888 avahi-daemon[3346]: Invalid query packet.
Jun  8 19:59:00 server888 avahi-daemon[3346]: Invalid query packet.
Jun  8 19:59:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 19:59:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 20:00:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 20:00:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 20:01:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 20:01:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 20:02:38 server888 kernel: capidrv-1: controller dead ??
....
..
.
Jun  8 20:29:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 20:29:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 20:30:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 20:30:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 20:31:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 20:31:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 20:32:34 server888 avahi-daemon[3346]: Invalid query packet.
Jun  8 20:32:34 server888 avahi-daemon[3346]: Invalid query packet.
Jun  8 20:32:34 server888 avahi-daemon[3346]: Invalid query packet.
Jun  8 20:32:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 20:32:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 20:33:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 20:33:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 20:34:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 20:34:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 20:35:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 20:35:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 20:36:11 server888 avahi-daemon[3346]: Invalid query packet.
Jun  8 20:36:11 server888 avahi-daemon[3346]: Invalid query packet.
Jun  8 20:36:12 server888 avahi-daemon[3346]: Invalid query packet.
Jun  8 20:36:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 20:36:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 20:37:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 20:37:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 20:38:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 20:38:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 20:39:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 20:39:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 20:40:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 20:40:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 20:41:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 20:41:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 20:42:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 20:42:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 20:43:30 server888 avahi-daemon[3346]: Invalid query packet.
Jun  8 20:43:31 server888 avahi-daemon[3346]: Invalid query packet.
Jun  8 20:43:31 server888 avahi-daemon[3346]: Invalid query packet.
Jun  8 20:43:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 20:43:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 20:44:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 20:44:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 20:45:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 20:45:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 20:46:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 20:46:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 20:47:26 server888 syslog-ng[1906]: Log statistics; dropped='pipe(/dev/xconsole)=16009', dropped='pipe(/dev/tty10)=0', processed='center(queued)=22860', processed='center(received)=5745', processed='destination(newsnotice)=0', processed='destination(acpid)=0', processed='destination(firewall)=0', processed='destination(null)=0', processed='destination(mail)=0', processed='destination(mailinfo)=0', processed='destination(console)=5691', processed='destination(newserr)=0', processed='destination(newscrit)=0', processed='destination(messages)=5745', processed='destination(mailwarn)=0', processed='destination(localmessages)=0', processed='destination(netmgm)=0', processed='destination(mailerr)=0', processed='destination(xconsole)=5691', processed='destination(warn)=5733', processed='source(src)=5745'
Jun  8 20:47:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 20:47:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 20:48:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 20:48:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
....
..
.
Jun  8 21:03:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 21:04:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 21:04:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 21:05:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 21:05:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 21:06:04 server888 avahi-daemon[3346]: Invalid query packet.
Jun  8 21:06:04 server888 avahi-daemon[3346]: Invalid query packet.
Jun  8 21:06:05 server888 avahi-daemon[3346]: Invalid query packet.
Jun  8 21:06:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 21:06:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 21:07:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 21:07:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 21:08:38 server888 kernel: capidrv-1: controller dead ??
....
..
.
Jun  8 21:38:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 21:38:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 21:39:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 21:39:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 21:39:40 server888 avahi-daemon[3346]: Invalid query packet.
Jun  8 21:39:40 server888 avahi-daemon[3346]: Invalid query packet.
Jun  8 21:39:40 server888 avahi-daemon[3346]: Invalid query packet.
Jun  8 21:40:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 21:40:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 21:41:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 21:41:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 21:42:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 21:42:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 21:43:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 21:43:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 21:44:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 21:44:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 21:45:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 21:45:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 21:46:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 21:46:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 21:47:27 server888 syslog-ng[1906]: Log statistics; dropped='pipe(/dev/xconsole)=16129', dropped='pipe(/dev/tty10)=0', processed='center(queued)=23353', processed='center(received)=5872', processed='destination(newsnotice)=0', processed='destination(acpid)=0', processed='destination(firewall)=0', processed='destination(null)=0', processed='destination(mail)=0', processed='destination(mailinfo)=0', processed='destination(console)=5811', processed='destination(newserr)=0', processed='destination(newscrit)=0', processed='destination(messages)=5872', processed='destination(mailwarn)=0', processed='destination(localmessages)=0', processed='destination(netmgm)=0', processed='destination(mailerr)=0', processed='destination(xconsole)=5811', processed='destination(warn)=5859', processed='source(src)=5872'
Jun  8 21:47:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 21:47:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 21:48:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 21:48:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 21:49:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 21:49:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 21:50:38 server888 kernel: capidrv-1: controller dead ??
....
..
.
Jun  8 22:11:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 22:11:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 22:12:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 22:12:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 22:13:11 server888 avahi-daemon[3346]: Invalid query packet.
Jun  8 22:13:11 server888 avahi-daemon[3346]: Invalid query packet.
Jun  8 22:13:12 server888 avahi-daemon[3346]: Invalid query packet.
Jun  8 22:13:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 22:13:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 22:14:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 22:14:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 22:15:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 22:15:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 22:16:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 22:16:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 22:16:50 server888 avahi-daemon[3346]: Invalid legacy unicast query packet.
Jun  8 22:16:50 server888 avahi-daemon[3346]: Received response with invalid source port 2911 on interface 'eth0.0'
Jun  8 22:16:50 server888 avahi-daemon[3346]: Invalid legacy unicast query packet.
Jun  8 22:16:50 server888 avahi-daemon[3346]: Invalid legacy unicast query packet.
Jun  8 22:16:52 server888 avahi-daemon[3346]: Invalid legacy unicast query packet.
Jun  8 22:16:52 server888 avahi-daemon[3346]: Received response with invalid source port 2911 on interface 'eth0.0'
Jun  8 22:16:52 server888 avahi-daemon[3346]: Invalid legacy unicast query packet.
Jun  8 22:16:53 server888 avahi-daemon[3346]: Invalid legacy unicast query packet.
Jun  8 22:16:53 server888 avahi-daemon[3346]: Received response with invalid source port 2911 on interface 'eth0.0'
Jun  8 22:16:53 server888 avahi-daemon[3346]: Received response with invalid source port 2911 on interface 'eth0.0'
Jun  8 22:16:54 server888 avahi-daemon[3346]: Received response with invalid source port 2911 on interface 'eth0.0'
Jun  8 22:16:55 server888 avahi-daemon[3346]: Received response with invalid source port 2911 on interface 'eth0.0'
Jun  8 22:16:59 server888 avahi-daemon[3346]: Received response with invalid source port 2911 on interface 'eth0.0'
Jun  8 22:17:07 server888 avahi-daemon[3346]: Received response with invalid source port 2911 on interface 'eth0.0'
Jun  8 22:17:23 server888 avahi-daemon[3346]: Received response with invalid source port 2911 on interface 'eth0.0'
Jun  8 22:17:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 22:17:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 22:17:55 server888 avahi-daemon[3346]: Received response with invalid source port 2911 on interface 'eth0.0'
Jun  8 22:18:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 22:18:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 22:19:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 22:19:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 22:20:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 22:20:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
....
..
.
Jun  8 22:37:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 22:37:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 22:38:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 22:38:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 22:39:38 server888 kernel: capidrv-1: controller dead ??
Jun  8 22:39:38 server888 kernel: capidrv-1: listen_change_state state=3 event=1 ????
Jun  8 22:40:34 server888 avahi-daemon[3346]: Invalid legacy unicast query packet.
Jun  8 22:40:34 server888 avahi-daemon[3346]: Invalid legacy unicast query packet.

Ich möchte daran erinnern, dass ursprünglich nicht ich diesen Server aufgesetzt habe.

spoensche · 11 Juni 2010

Wer oder was versucht den auf den Controller zuzugreifen?

Chaoshh · 12 Juni 2010

Das kann entweder der Faxserver Hylafax oder Asterisk sein. Diese Dienste sind nämlich auch aktiv.

spoensche · 12 Juni 2010

Chaoshh schrieb:
Das kann entweder der Faxserver Hylafax oder Asterisk sein. Diese Dienste sind nämlich auch aktiv.

Das solltest du wissen, auch wenn du den Server nicht konfiguriert hast. Deaktviere mal alles, was die ISDN- Karte verwenden will. Wie alt ist die ISDN- Karte?

Chaoshh · 18 Juni 2010

Das ist Asterisk. Hylafax ist aus. Ich fand noch andere Meldungen von avahi-daemon. Insgesamt macht das einen ziemlich überlasteten und fehlerbehafteten Eindruck. Zudem bin ich persönlich der Meinung, daß Asterisk auf einem Fileserver nichts zu suchen hat, sollte schon eine zusätzliche Kiste dafür halten.

Chaoshh · 19 Juni 2010

Ok, ich habe mir das Log weiter angeschaut und ich fand etwas beunruhigendes. Also habe ich mir den interessanten Teil "rausgegrept". Interessant und erschreckend sind vor allem die IP Adressen - die kommen des öfteren aus China:

Code:

Server:~ # cat /var/log/messages | grep "Invalid user"
Jun 12 01:42:15 server sshd[18700]: Invalid user radu123 from 221.149.95.249
Jun 12 01:42:19 server sshd[18702]: Invalid user rahela from 221.149.95.249
Jun 12 01:42:22 server sshd[18704]: Invalid user rahela123 from 221.149.95.249
Jun 12 01:42:26 server sshd[18706]: Invalid user raisa from 221.149.95.249
Jun 12 01:42:30 server sshd[18708]: Invalid user raisa123 from 221.149.95.249
Jun 12 01:42:33 server sshd[18710]: Invalid user raluca from 221.149.95.249
Jun 12 01:42:37 server sshd[18712]: Invalid user raluca123 from 221.149.95.249
Jun 12 01:42:40 server sshd[18714]: Invalid user ramona from 221.149.95.249
Jun 12 01:42:44 server sshd[18716]: Invalid user ramona123 from 221.149.95.249
Jun 12 01:42:48 server sshd[18718]: Invalid user rares from 221.149.95.249
Jun 12 01:42:51 server sshd[18720]: Invalid user rares123 from 221.149.95.249
Jun 12 01:42:55 server sshd[18722]: Invalid user razvan from 221.149.95.249
Jun 12 01:42:58 server sshd[18724]: Invalid user razvan123 from 221.149.95.249
Jun 12 01:43:02 server sshd[18726]: Invalid user rebeca from 221.149.95.249
Jun 12 01:43:06 server sshd[18728]: Invalid user rebeca123 from 221.149.95.249
Jun 12 01:43:09 server sshd[18730]: Invalid user remi from 221.149.95.249
Jun 12 01:43:13 server sshd[18732]: Invalid user remi123 from 221.149.95.249
Jun 12 01:43:16 server sshd[18734]: Invalid user remus from 221.149.95.249
Jun 12 01:43:20 server sshd[18736]: Invalid user remus123 from 221.149.95.249
Jun 12 01:43:24 server sshd[18738]: Invalid user retea from 221.149.95.249
Jun 12 01:43:27 server sshd[18740]: Invalid user retea123 from 221.149.95.249
Jun 12 01:43:31 server sshd[18742]: Invalid user rica from 221.149.95.249
Jun 12 01:43:34 server sshd[18744]: Invalid user rica123 from 221.149.95.249
Jun 12 01:43:38 server sshd[18746]: Invalid user roberta from 221.149.95.249
Jun 12 01:43:42 server sshd[18748]: Invalid user roberta123 from 221.149.95.249
Jun 12 01:43:45 server sshd[18750]: Invalid user roberto from 221.149.95.249
Jun 12 01:43:49 server sshd[18752]: Invalid user roberto123 from 221.149.95.249
Jun 12 01:43:52 server sshd[18754]: Invalid user robert from 221.149.95.249
Jun 12 01:43:56 server sshd[18756]: Invalid user robert123 from 221.149.95.249
Jun 12 01:44:00 server sshd[18758]: Invalid user rodica from 221.149.95.249
Jun 12 01:44:03 server sshd[18760]: Invalid user rodica123 from 221.149.95.249
Jun 12 01:44:07 server sshd[18762]: Invalid user romeo from 221.149.95.249
Jun 12 01:44:10 server sshd[18764]: Invalid user romeo123 from 221.149.95.249
Jun 12 01:44:14 server sshd[18766]: Invalid user acasa from 221.149.95.249
Jun 12 01:44:18 server sshd[18768]: Invalid user acasa123 from 221.149.95.249
Jun 12 01:44:21 server sshd[18770]: Invalid user admin from 221.149.95.249
Jun 12 01:44:25 server sshd[18772]: Invalid user administrare from 221.149.95.249
Jun 12 01:44:28 server sshd[18774]: Invalid user administrare123 from 221.149.95.249
Jun 12 01:44:32 server sshd[18776]: Invalid user administrator from 221.149.95.249
Jun 12 01:44:36 server sshd[18778]: Invalid user administrator123 from 221.149.95.249
Jun 12 01:44:39 server sshd[18780]: Invalid user alexandra from 221.149.95.249
Jun 12 01:44:43 server sshd[18782]: Invalid user alexandru from 221.149.95.249
Jun 12 01:44:46 server sshd[18784]: Invalid user alexandru123 from 221.149.95.249
Jun 12 01:44:50 server sshd[18786]: Invalid user bogdan from 221.149.95.249
Jun 12 01:44:54 server sshd[18788]: Invalid user bogdan123 from 221.149.95.249
Jun 12 01:44:57 server sshd[18790]: Invalid user bucuresti from 221.149.95.249
Jun 12 01:45:01 server sshd[18792]: Invalid user constanta from 221.149.95.249
Jun 12 01:45:04 server sshd[18817]: Invalid user contabilitate from 221.149.95.249
Jun 12 01:45:08 server sshd[18819]: Invalid user fifa2005 from 221.149.95.249
Jun 12 01:45:12 server sshd[18821]: Invalid user fifa2006 from 221.149.95.249
Jun 12 04:11:47 server sshd[19071]: Invalid user teamspeak from 189.106.87.24
Jun 12 04:11:49 server sshd[19073]: Invalid user teamspeak from 189.106.87.24
Jun 12 04:11:50 server sshd[19075]: Invalid user oracle from 189.106.87.24
Jun 12 04:11:51 server sshd[19077]: Invalid user teamspeak from 189.106.87.24
Jun 12 04:11:52 server sshd[19079]: Invalid user oracle from 189.106.87.24
Jun 12 04:11:54 server sshd[19083]: Invalid user teamspeak from 189.106.87.24
Jun 12 04:11:54 server sshd[19085]: Invalid user oracle from 189.106.87.24
Jun 12 04:11:56 server sshd[19089]: Invalid user postgres from 189.106.87.24
Jun 12 04:11:56 server sshd[19091]: Invalid user teamspeak from 189.106.87.24
Jun 12 04:11:57 server sshd[19093]: Invalid user oracle from 189.106.87.24
Jun 12 04:11:58 server sshd[19097]: Invalid user postgres from 189.106.87.24
Jun 12 04:11:58 server sshd[19098]: Invalid user teamspeak from 189.106.87.24
Jun 12 04:11:59 server sshd[19101]: Invalid user nagios from 189.106.87.24
Jun 12 04:11:59 server sshd[19102]: Invalid user oracle from 189.106.87.24
Jun 12 04:12:01 server sshd[19108]: Invalid user teamspeak from 189.106.87.24
Jun 12 04:12:02 server sshd[19107]: Invalid user postgres from 189.106.87.24
Jun 12 04:12:02 server sshd[19111]: Invalid user nagios from 189.106.87.24
Jun 12 04:12:03 server sshd[19115]: Invalid user teamspeak from 189.106.87.24
Jun 12 04:12:04 server sshd[19118]: Invalid user postgres from 189.106.87.24
Jun 12 04:12:04 server sshd[19121]: Invalid user oracle from 189.106.87.24
Jun 12 04:12:05 server sshd[19124]: Invalid user vmail from 189.106.87.24
Jun 12 04:12:05 server sshd[19123]: Invalid user ubuntu from 189.106.87.24
Jun 12 04:12:05 server sshd[19122]: Invalid user nagios from 189.106.87.24
Jun 12 04:12:06 server sshd[19129]: Invalid user teamspeak from 189.106.87.24
Jun 12 04:12:07 server sshd[19132]: Invalid user postgres from 189.106.87.24
Jun 12 04:12:07 server sshd[19133]: Invalid user oracle from 189.106.87.24
Jun 12 04:12:08 server sshd[19141]: Invalid user teamspeak from 189.106.87.24
Jun 12 04:12:08 server sshd[19139]: Invalid user nagios from 189.106.87.24
Jun 12 04:12:08 server sshd[19137]: Invalid user ubuntu from 189.106.87.24
Jun 12 04:12:09 server sshd[19138]: Invalid user administrator from 189.106.87.24
Jun 12 04:12:10 server sshd[19149]: Invalid user oracle from 189.106.87.24
Jun 12 04:12:10 server sshd[19146]: Invalid user postgres from 189.106.87.24
Jun 12 04:12:10 server sshd[19153]: Invalid user ubuntu from 189.106.87.24
Jun 12 04:12:11 server sshd[19152]: Invalid user nagios from 189.106.87.24
Jun 12 04:12:12 server sshd[19151]: Invalid user teamspeak from 189.106.87.24
Jun 12 04:12:12 server sshd[19161]: Invalid user postgres from 189.106.87.24
Jun 12 04:12:13 server sshd[19158]: Invalid user oracle from 189.106.87.24
Jun 12 04:12:13 server sshd[19164]: Invalid user nagios from 189.106.87.24
Jun 12 04:12:13 server sshd[19163]: Invalid user ubuntu from 189.106.87.24
Jun 12 04:12:15 server sshd[19176]: Invalid user nagios from 189.106.87.24
Jun 12 04:12:15 server sshd[19170]: Invalid user teamspeak from 189.106.87.24
Jun 12 04:12:15 server sshd[19173]: Invalid user postgres from 189.106.87.24
Jun 12 04:12:15 server sshd[19167]: Invalid user secure from 189.106.87.24
Jun 12 04:12:16 server sshd[19175]: Invalid user oracle from 189.106.87.24
Jun 12 04:12:17 server sshd[19181]: Invalid user nagios from 189.106.87.24
Jun 12 04:12:18 server sshd[19179]: Invalid user secure from 189.106.87.24
Jun 12 04:12:18 server sshd[19182]: Invalid user teamspeak from 189.106.87.24
Jun 12 04:12:18 server sshd[19184]: Invalid user postgres from 189.106.87.24
Jun 12 04:12:19 server sshd[19185]: Invalid user secure from 189.106.87.24
Jun 12 04:12:20 server sshd[19190]: Invalid user secure from 189.106.87.24
Jun 12 04:12:20 server sshd[19189]: Invalid user nagios from 189.106.87.24
Jun 12 04:12:21 server sshd[19192]: Invalid user admin from 189.106.87.24
Jun 12 04:12:22 server sshd[19197]: Invalid user secure from 189.106.87.24
Jun 12 04:12:22 server sshd[19199]: Invalid user oracle from 189.106.87.24
Jun 12 04:12:23 server sshd[19203]: Invalid user nagios from 189.106.87.24
Jun 12 04:12:23 server sshd[19206]: Invalid user secure from 189.106.87.24
Jun 12 04:12:23 server sshd[19202]: Invalid user backup from 189.106.87.24
Jun 12 04:12:24 server sshd[19210]: Invalid user postgres from 189.106.87.24
Jun 12 04:12:24 server sshd[19213]: Invalid user oracle from 189.106.87.24
Jun 12 04:12:25 server sshd[19209]: Invalid user secure from 189.106.87.24
Jun 12 04:12:25 server sshd[19218]: Invalid user spam from 189.106.87.24
Jun 12 04:12:26 server sshd[19216]: Invalid user nagios from 189.106.87.24
Jun 12 04:12:27 server sshd[19223]: Invalid user postgres from 189.106.87.24
Jun 12 04:12:27 server sshd[19225]: Invalid user oracle from 189.106.87.24
Jun 12 04:12:28 server sshd[19221]: Invalid user secure from 189.106.87.24
Jun 12 04:12:29 server sshd[19231]: Invalid user spam from 189.106.87.24
Jun 12 04:12:29 server sshd[19233]: Invalid user nagios from 189.106.87.24
Jun 12 04:12:29 server sshd[19234]: Invalid user secure from 189.106.87.24
Jun 12 04:12:29 server sshd[19236]: Invalid user postgres from 189.106.87.24
Jun 12 04:12:30 server sshd[19239]: Invalid user oracle from 189.106.87.24
Jun 12 04:12:31 server sshd[19226]: Invalid user secure from 189.106.87.24
Jun 12 04:12:32 server sshd[19241]: Invalid user spam from 189.106.87.24
Jun 12 04:12:32 server sshd[19243]: Invalid user vsifax from 189.106.87.24
Jun 12 04:12:32 server sshd[19246]: Invalid user postgres from 189.106.87.24
Jun 12 04:12:32 server sshd[19249]: Invalid user oracle from 189.106.87.24
Jun 12 04:12:33 server sshd[19242]: Invalid user nagios from 189.106.87.24
Jun 12 04:12:34 server sshd[19251]: Invalid user secure from 189.106.87.24
Jun 12 04:12:35 server sshd[19255]: Invalid user postgres from 189.106.87.24
Jun 12 04:12:35 server sshd[19259]: Invalid user secure from 189.106.87.24
Jun 12 04:12:35 server sshd[19254]: Invalid user vsifax from 189.106.87.24
Jun 12 04:12:36 server sshd[19261]: Invalid user nagios from 189.106.87.24
Jun 12 04:12:37 server sshd[19265]: Invalid user postgres from 189.106.87.24
Jun 12 04:12:37 server sshd[19253]: Invalid user spam from 189.106.87.24
Jun 12 04:12:37 server sshd[19263]: Invalid user secure from 189.106.87.24
Jun 12 04:12:38 server sshd[19267]: Invalid user test from 189.106.87.24
Jun 12 04:12:39 server sshd[19269]: Invalid user secure from 189.106.87.24
Jun 12 04:12:39 server sshd[19271]: Invalid user nagios from 189.106.87.24
Jun 12 04:12:40 server sshd[19274]: Invalid user spam from 189.106.87.24
Jun 12 04:12:40 server sshd[19275]: Invalid user secure from 189.106.87.24
Jun 12 04:12:40 server sshd[19273]: Invalid user postgres from 189.106.87.24
Jun 12 04:12:41 server sshd[19280]: Invalid user test from 189.106.87.24
Jun 12 04:12:41 server sshd[19283]: Invalid user guest from 189.106.87.24
Jun 12 04:12:42 server sshd[19279]: Invalid user secure from 189.106.87.24
Jun 12 04:12:42 server sshd[19284]: Invalid user vsifax from 189.106.87.24
Jun 12 04:12:42 server sshd[19288]: Invalid user secure from 189.106.87.24
Jun 12 04:12:42 server sshd[19287]: Invalid user spam from 189.106.87.24
Jun 12 04:12:44 server sshd[19291]: Invalid user test from 189.106.87.24
Jun 12 04:12:44 server sshd[19293]: Invalid user guest from 189.106.87.24
Jun 12 04:12:44 server sshd[19294]: Invalid user secure from 189.106.87.24
Jun 12 04:12:44 server sshd[19298]: Invalid user nagios from 189.106.87.24
Jun 12 04:12:45 server sshd[19301]: Invalid user secure from 189.106.87.24
Jun 12 04:12:45 server sshd[19297]: Invalid user jboss from 189.106.87.24
Jun 12 04:12:46 server sshd[19303]: Invalid user test from 189.106.87.24
Jun 12 04:12:47 server sshd[19305]: Invalid user guest from 189.106.87.24
Jun 12 04:12:47 server sshd[19309]: Invalid user nagios from 189.106.87.24
Jun 12 04:12:47 server sshd[19310]: Invalid user secure from 189.106.87.24
Jun 12 04:12:47 server sshd[19313]: Invalid user secure from 189.106.87.24
Jun 12 04:12:48 server sshd[19315]: Invalid user jboss from 189.106.87.24
Jun 12 04:12:49 server sshd[19317]: Invalid user test from 189.106.87.24
Jun 12 04:12:50 server sshd[19322]: Invalid user tomcat from 189.106.87.24
Jun 12 04:12:51 server sshd[19320]: Invalid user guest from 189.106.87.24
Jun 12 04:12:52 server sshd[19325]: Invalid user jboss from 189.106.87.24
Jun 12 04:12:53 server sshd[19327]: Invalid user test from 189.106.87.24
Jun 12 04:12:54 server sshd[19331]: Invalid user tomcat from 189.106.87.24
Jun 12 04:12:55 server sshd[19333]: Invalid user jboss from 189.106.87.24
Jun 12 04:13:01 server sshd[19337]: Invalid user tomcat from 189.106.87.24
Jun 12 04:13:03 server sshd[19339]: Invalid user jboss from 189.106.87.24
Jun 12 04:13:04 server sshd[19342]: Invalid user tomcat from 189.106.87.24
Jun 12 04:13:05 server sshd[19348]: Invalid user jboss from 189.106.87.24
Jun 12 04:13:07 server sshd[19351]: Invalid user tomcat from 189.106.87.24
Jun 12 04:13:07 server sshd[19353]: Invalid user jboss from 189.106.87.24
Jun 12 04:13:09 server sshd[19357]: Invalid user tomcat from 189.106.87.24
Jun 12 04:13:10 server sshd[19359]: Invalid user jboss from 189.106.87.24
Jun 12 04:13:12 server sshd[19365]: Invalid user jboss from 189.106.87.24
Jun 12 04:13:13 server sshd[19363]: Invalid user tomcat from 189.106.87.24
Jun 12 04:13:14 server sshd[19369]: Invalid user jboss from 189.106.87.24
Jun 12 04:13:15 server sshd[19373]: Invalid user tomcat from 189.106.87.24
Jun 12 04:13:17 server sshd[19375]: Invalid user jboss from 189.106.87.24
Jun 12 04:13:17 server sshd[19379]: Invalid user tomcat from 189.106.87.24
Jun 12 04:13:19 server sshd[19381]: Invalid user jboss from 189.106.87.24
Jun 12 04:13:20 server sshd[19383]: Invalid user tomcat from 189.106.87.24
Jun 12 04:13:22 server sshd[19387]: Invalid user jboss from 189.106.87.24
Jun 12 04:13:23 server sshd[19389]: Invalid user tomcat from 189.106.87.24
Jun 12 04:13:26 server sshd[19393]: Invalid user jboss from 189.106.87.24
Jun 12 04:13:27 server sshd[19396]: Invalid user tomcat from 189.106.87.24
Jun 12 04:13:28 server sshd[19399]: Invalid user jboss from 189.106.87.24
Jun 12 04:13:30 server sshd[19402]: Invalid user tomcat from 189.106.87.24
Jun 12 04:13:32 server sshd[19405]: Invalid user jboss from 189.106.87.24
Jun 12 04:13:33 server sshd[19407]: Invalid user tomcat from 189.106.87.24
Jun 12 04:13:35 server sshd[19411]: Invalid user jboss from 189.106.87.24
Jun 12 04:13:35 server sshd[19415]: Invalid user tomcat from 189.106.87.24
Jun 12 04:13:37 server sshd[19418]: Invalid user jboss from 189.106.87.24
Jun 12 04:13:38 server sshd[19421]: Invalid user tomcat from 189.106.87.24
Jun 12 04:13:40 server sshd[19423]: Invalid user jboss from 189.106.87.24
Jun 12 04:13:40 server sshd[19425]: Invalid user tomcat from 189.106.87.24
Jun 12 04:13:42 server sshd[19429]: Invalid user tomcat from 189.106.87.24
Jun 12 04:13:44 server sshd[19427]: Invalid user jboss from 189.106.87.24
Jun 12 04:13:46 server sshd[19433]: Invalid user tomcat from 189.106.87.24
Jun 12 04:13:49 server sshd[19437]: Invalid user tomcat from 189.106.87.24
Jun 12 04:13:50 server sshd[19441]: Invalid user jboss from 189.106.87.24
Jun 12 04:13:53 server sshd[19443]: Invalid user jboss from 189.106.87.24
Jun 12 04:13:56 server sshd[19447]: Invalid user tomcat from 189.106.87.24
Jun 12 04:13:57 server sshd[19451]: Invalid user jboss from 189.106.87.24
Jun 12 04:13:59 server sshd[19453]: Invalid user tomcat from 189.106.87.24
Jun 12 04:13:59 server sshd[19455]: Invalid user jboss from 189.106.87.24
Jun 12 04:14:01 server sshd[19459]: Invalid user tomcat from 189.106.87.24
Jun 12 04:14:02 server sshd[19460]: Invalid user jboss from 189.106.87.24
Jun 12 04:14:04 server sshd[19465]: Invalid user tomcat from 189.106.87.24
Jun 12 04:14:04 server sshd[19466]: Invalid user jboss from 189.106.87.24
Jun 12 04:14:06 server sshd[19472]: Invalid user jboss from 189.106.87.24
Jun 12 04:14:06 server sshd[19471]: Invalid user tomcat from 189.106.87.24
Jun 12 04:14:09 server sshd[19477]: Invalid user tomcat from 189.106.87.24
Jun 12 04:14:09 server sshd[19478]: Invalid user jboss from 189.106.87.24
Jun 12 04:14:11 server sshd[19483]: Invalid user tomcat from 189.106.87.24
Jun 12 04:14:12 server sshd[19485]: Invalid user jboss from 189.106.87.24
Jun 12 04:14:15 server sshd[19487]: Invalid user tomcat from 189.106.87.24
Jun 12 04:14:15 server sshd[19488]: Invalid user jboss from 189.106.87.24
Jun 12 04:14:18 server sshd[19495]: Invalid user tomcat from 189.106.87.24
Jun 12 04:14:18 server sshd[19496]: Invalid user jboss from 189.106.87.24
Jun 12 04:14:20 server sshd[19502]: Invalid user jboss from 189.106.87.24
Jun 12 04:14:21 server sshd[19501]: Invalid user tomcat from 189.106.87.24
Jun 12 04:14:23 server sshd[19507]: Invalid user jboss from 189.106.87.24
Jun 12 04:14:23 server sshd[19509]: Invalid user tomcat from 189.106.87.24
Jun 12 04:14:25 server sshd[19511]: Invalid user jboss from 189.106.87.24
Jun 12 04:14:25 server sshd[19513]: Invalid user tomcat from 189.106.87.24
Jun 12 04:14:28 server sshd[19517]: Invalid user jboss from 189.106.87.24
Jun 12 04:14:29 server sshd[19518]: Invalid user tomcat from 189.106.87.24
Jun 12 04:14:31 server sshd[19523]: Invalid user jboss from 189.106.87.24
Jun 12 04:14:32 server sshd[19527]: Invalid user tomcat from 189.106.87.24
Jun 12 04:14:34 server sshd[19529]: Invalid user jboss from 189.106.87.24
Jun 12 04:14:34 server sshd[19533]: Invalid user tomcat from 189.106.87.24
Jun 12 04:14:37 server sshd[19537]: Invalid user tomcat from 189.106.87.24
Jun 12 04:14:40 server sshd[19541]: Invalid user jboss from 189.106.87.24
Jun 12 04:14:43 server sshd[19546]: Invalid user jboss from 189.106.87.24
Jun 12 04:14:43 server sshd[19545]: Invalid user tomcat from 189.106.87.24
Jun 12 04:14:45 server sshd[19551]: Invalid user jboss from 189.106.87.24
Jun 12 04:14:45 server sshd[19552]: Invalid user tomcat from 189.106.87.24
Jun 12 04:14:48 server sshd[19556]: Invalid user tomcat from 189.106.87.24
Jun 12 04:14:48 server sshd[19555]: Invalid user jboss from 189.106.87.24
Jun 12 04:14:50 server sshd[19560]: Invalid user jboss from 189.106.87.24
Jun 12 04:14:51 server sshd[19559]: Invalid user tomcat from 189.106.87.24
Jun 12 04:14:53 server sshd[19565]: Invalid user jboss from 189.106.87.24
Jun 12 04:14:54 server sshd[19567]: Invalid user tomcat from 189.106.87.24
Jun 12 04:14:56 server sshd[19571]: Invalid user jboss from 189.106.87.24
Jun 12 04:14:57 server sshd[19573]: Invalid user tomcat from 189.106.87.24
Jun 12 04:14:59 server sshd[19575]: Invalid user jboss from 189.106.87.24
Jun 12 04:15:01 server sshd[19579]: Invalid user jboss from 189.106.87.24
Jun 12 04:15:03 server sshd[19581]: Invalid user tomcat from 189.106.87.24
Jun 12 04:15:04 server sshd[19619]: Invalid user jboss from 189.106.87.24
Jun 12 04:15:06 server sshd[19621]: Invalid user tomcat from 189.106.87.24
Jun 12 04:15:07 server sshd[19623]: Invalid user jboss from 189.106.87.24
Jun 12 04:15:08 server sshd[19627]: Invalid user tomcat from 189.106.87.24
Jun 12 04:15:09 server sshd[19631]: Invalid user jboss from 189.106.87.24
Jun 12 04:15:11 server sshd[19633]: Invalid user tomcat from 189.106.87.24
Jun 12 04:15:12 server sshd[19637]: Invalid user jboss from 189.106.87.24
Jun 12 04:15:14 server sshd[19639]: Invalid user tomcat from 189.106.87.24
Jun 12 04:15:14 server sshd[19641]: Invalid user jboss from 189.106.87.24
Jun 12 04:15:17 server sshd[19645]: Invalid user tomcat from 189.106.87.24
Jun 12 04:15:17 server sshd[19646]: Invalid user jboss from 189.106.87.24
Jun 12 04:15:20 server sshd[19651]: Invalid user tomcat from 189.106.87.24
Jun 12 04:15:21 server sshd[19653]: Invalid user jboss from 189.106.87.24
Jun 12 04:15:23 server sshd[19658]: Invalid user jboss from 189.106.87.24
Jun 12 04:15:27 server sshd[19662]: Invalid user tomcat from 189.106.87.24
Jun 12 04:15:28 server sshd[19665]: Invalid user jboss from 189.106.87.24
Jun 12 04:15:34 server sshd[19669]: Invalid user tomcat from 189.106.87.24
Jun 12 04:15:42 server sshd[19678]: Invalid user tomcat from 189.106.87.24
Jun 12 04:15:44 server sshd[19682]: Invalid user tomcat from 189.106.87.24
Jun 12 04:15:46 server sshd[19686]: Invalid user tomcat from 189.106.87.24
Jun 12 04:15:52 server sshd[19692]: Invalid user tomcat from 189.106.87.24
Jun 12 04:15:57 server sshd[19696]: Invalid user tomcat from 189.106.87.24
Jun 12 04:16:00 server sshd[19700]: Invalid user tomcat from 189.106.87.24
Jun 12 04:16:02 server sshd[19705]: Invalid user tomcat from 189.106.87.24
Jun 12 04:16:05 server sshd[19709]: Invalid user tomcat from 189.106.87.24
Jun 12 04:16:11 server sshd[19716]: Invalid user tomcat from 189.106.87.24
Jun 12 04:16:14 server sshd[19719]: Invalid user tomcat from 189.106.87.24
Jun 12 04:16:16 server sshd[19722]: Invalid user tomcat from 189.106.87.24
Jun 12 04:16:22 server sshd[19726]: Invalid user tomcat from 189.106.87.24
Jun 12 04:16:29 server sshd[19734]: Invalid user tomcat from 189.106.87.24
Jun 12 04:16:31 server sshd[19738]: Invalid user tomcat from 189.106.87.24
Jun 12 04:16:34 server sshd[19742]: Invalid user tomcat from 189.106.87.24
Jun 12 04:16:41 server sshd[19746]: Invalid user tomcat from 189.106.87.24
Jun 12 04:16:44 server sshd[19748]: Invalid user tomcat from 189.106.87.24
Jun 12 04:16:46 server sshd[19754]: Invalid user tomcat from 189.106.87.24
Jun 12 04:16:48 server sshd[19756]: Invalid user tomcat from 189.106.87.24
Jun 12 04:16:51 server sshd[19758]: Invalid user tomcat from 189.106.87.24
Jun 12 04:16:53 server sshd[19762]: Invalid user tomcat from 189.106.87.24
Jun 12 04:16:56 server sshd[19764]: Invalid user tomcat from 189.106.87.24
Jun 12 04:16:58 server sshd[19768]: Invalid user tomcat from 189.106.87.24
Jun 12 04:17:01 server sshd[19772]: Invalid user tomcat from 189.106.87.24
Jun 12 04:17:03 server sshd[19776]: Invalid user tomcat from 189.106.87.24
Jun 12 04:17:10 server sshd[19780]: Invalid user tomcat from 189.106.87.24
Jun 12 04:17:12 server sshd[19784]: Invalid user tomcat from 189.106.87.24
Jun 12 20:50:38 server sshd[21806]: Invalid user test from 205.209.121.130
Jun 12 20:50:41 server sshd[21808]: Invalid user oracle from 205.209.121.130
Jun 12 20:50:45 server sshd[21812]: Invalid user db2inst1 from 205.209.121.130
Jun 12 20:50:47 server sshd[21814]: Invalid user db2inst1 from 205.209.121.130
Jun 12 20:50:48 server sshd[21816]: Invalid user db2fenc1 from 205.209.121.130
Jun 12 20:50:55 server sshd[21818]: Invalid user db2fenc1 from 205.209.121.130
Jun 12 20:50:57 server sshd[21820]: Invalid user ts from 205.209.121.130
Jun 12 20:50:58 server sshd[21822]: Invalid user ts from 205.209.121.130
Jun 12 20:51:00 server sshd[21824]: Invalid user ts from 205.209.121.130
Jun 12 20:51:02 server sshd[21826]: Invalid user ts from 205.209.121.130
Jun 12 20:51:04 server sshd[21828]: Invalid user ts from 205.209.121.130
Jun 12 20:51:07 server sshd[21830]: Invalid user ts from 205.209.121.130
Jun 12 20:51:09 server sshd[21832]: Invalid user teamspeak from 205.209.121.130
Jun 12 20:51:15 server sshd[21838]: Invalid user ts2 from 205.209.121.130
Jun 12 20:51:16 server sshd[21840]: Invalid user ts1 from 205.209.121.130
Jun 12 20:51:18 server sshd[21842]: Invalid user ts2 from 205.209.121.130
Jun 12 20:51:20 server sshd[21844]: Invalid user ts1 from 205.209.121.130
Jun 12 20:51:22 server sshd[21846]: Invalid user hlds from 205.209.121.130
Jun 12 20:51:24 server sshd[21848]: Invalid user testftp from 205.209.121.130
Jun 12 20:51:26 server sshd[21850]: Invalid user testftp from 205.209.121.130
Jun 12 20:51:29 server sshd[21852]: Invalid user testftp from 205.209.121.130
Jun 12 20:51:31 server sshd[21854]: Invalid user testftp from 205.209.121.130
Jun 12 20:51:33 server sshd[21856]: Invalid user postgres from 205.209.121.130
Jun 12 20:51:34 server sshd[21858]: Invalid user postgres from 205.209.121.130
Jun 12 20:51:36 server sshd[21860]: Invalid user postgres from 205.209.121.130
Jun 12 20:51:38 server sshd[21862]: Invalid user postgres from 205.209.121.130
Jun 12 20:51:40 server sshd[21864]: Invalid user zabbix from 205.209.121.130
Jun 12 20:51:42 server sshd[21866]: Invalid user zabbix from 205.209.121.130
Jun 12 20:51:44 server sshd[21868]: Invalid user zabbix from 205.209.121.130
Jun 12 20:51:46 server sshd[21870]: Invalid user zabbix from 205.209.121.130
Jun 12 20:51:48 server sshd[21872]: Invalid user shoutcast from 205.209.121.130
Jun 12 20:51:50 server sshd[21874]: Invalid user shoutcast from 205.209.121.130
Jun 12 20:51:52 server sshd[21876]: Invalid user shoutcast from 205.209.121.130
Jun 12 22:36:57 server sshd[22065]: Invalid user shit from 149.166.168.36
Jun 12 22:37:35 server sshd[22123]: Invalid user tomcat from 149.166.168.36
Jun 12 22:37:36 server sshd[22125]: Invalid user tomcat from 149.166.168.36
Jun 12 22:37:37 server sshd[22127]: Invalid user tomcat from 149.166.168.36
Jun 12 22:37:38 server sshd[22129]: Invalid user tomcat from 149.166.168.36
Jun 12 22:37:40 server sshd[22131]: Invalid user tomcat from 149.166.168.36
Jun 12 22:37:41 server sshd[22133]: Invalid user tomcat from 149.166.168.36
Jun 12 22:37:42 server sshd[22135]: Invalid user tomcat from 149.166.168.36
Jun 12 22:37:43 server sshd[22137]: Invalid user oracle from 149.166.168.36
Jun 12 22:37:45 server sshd[22139]: Invalid user oracle from 149.166.168.36
Jun 12 22:37:46 server sshd[22141]: Invalid user oracle from 149.166.168.36
Jun 12 22:37:50 server sshd[22143]: Invalid user oracle from 149.166.168.36
Jun 12 22:37:52 server sshd[22145]: Invalid user oracle from 149.166.168.36
Jun 12 22:37:54 server sshd[22147]: Invalid user oracle from 149.166.168.36
Jun 12 22:37:55 server sshd[22149]: Invalid user test from 149.166.168.36
Jun 12 22:37:57 server sshd[22151]: Invalid user test from 149.166.168.36
Jun 12 22:37:58 server sshd[22153]: Invalid user test from 149.166.168.36
Jun 12 22:37:59 server sshd[22155]: Invalid user test from 149.166.168.36
Jun 12 22:38:00 server sshd[22157]: Invalid user test from 149.166.168.36
Jun 12 22:38:01 server sshd[22159]: Invalid user test from 149.166.168.36
Jun 12 22:38:03 server sshd[22161]: Invalid user test from 149.166.168.36
Jun 12 22:38:04 server sshd[22163]: Invalid user test from 149.166.168.36
Jun 12 22:38:08 server sshd[22169]: Invalid user user from 149.166.168.36
Jun 12 22:38:09 server sshd[22171]: Invalid user user from 149.166.168.36
Jun 12 22:38:11 server sshd[22173]: Invalid user user from 149.166.168.36
Jun 12 22:38:15 server sshd[22179]: Invalid user postgres from 149.166.168.36
Jun 12 22:38:17 server sshd[22181]: Invalid user postgres from 149.166.168.36
Jun 12 22:38:18 server sshd[22183]: Invalid user postgres from 149.166.168.36
Jun 12 22:38:19 server sshd[22185]: Invalid user postgres from 149.166.168.36
Jun 12 22:38:21 server sshd[22187]: Invalid user postgres from 149.166.168.36
Jun 12 22:38:22 server sshd[22189]: Invalid user admin from 149.166.168.36
Jun 12 22:38:23 server sshd[22191]: Invalid user nagios from 149.166.168.36
Jun 12 22:38:25 server sshd[22193]: Invalid user nagios from 149.166.168.36
Jun 12 22:38:26 server sshd[22195]: Invalid user nagios from 149.166.168.36
Jun 12 22:38:27 server sshd[22197]: Invalid user nagios from 149.166.168.36
Jun 12 22:38:29 server sshd[22199]: Invalid user prueba from 149.166.168.36
Jun 12 22:38:30 server sshd[22201]: Invalid user prueba from 149.166.168.36
Jun 12 22:38:31 server sshd[22203]: Invalid user prueba from 149.166.168.36
Jun 12 22:38:33 server sshd[22205]: Invalid user prueba from 149.166.168.36
Jun 12 22:38:35 server sshd[22207]: Invalid user pgsql from 149.166.168.36
Jun 12 22:38:38 server sshd[22213]: Invalid user temp from 149.166.168.36
Jun 12 22:38:40 server sshd[22215]: Invalid user web from 149.166.168.36
Jun 12 22:38:41 server sshd[22217]: Invalid user web from 149.166.168.36
Jun 12 22:38:47 server sshd[22219]: Invalid user temp from 149.166.168.36
Jun 12 22:38:48 server sshd[22221]: Invalid user backup from 149.166.168.36
Jun 12 22:38:52 server sshd[22227]: Invalid user cms from 149.166.168.36
Jun 13 06:26:32 server sshd[23058]: Invalid user 1 from 150.186.100.102
Jun 13 06:26:36 server sshd[23062]: Invalid user a from 150.186.100.102
Jun 13 06:26:37 server sshd[23064]: Invalid user gameserver from 150.186.100.102
Jun 13 06:26:40 server sshd[23066]: Invalid user abcs from 150.186.100.102
Jun 13 06:26:41 server sshd[23068]: Invalid user gameservers from 150.186.100.102
Jun 13 06:26:44 server sshd[23070]: Invalid user adempiere from 150.186.100.102
Jun 13 06:26:47 server sshd[23072]: Invalid user gastftp from 150.186.100.102
Jun 13 06:26:48 server sshd[23074]: Invalid user adempiere from 150.186.100.102
Jun 13 06:26:50 server sshd[23076]: Invalid user gasttest from 150.186.100.102
Jun 13 06:26:54 server sshd[23078]: Invalid user admin from 150.186.100.102
Jun 13 06:26:55 server sshd[23080]: Invalid user nagios from 150.186.100.102
Jun 13 06:26:55 server sshd[23082]: Invalid user gdm from 150.186.100.102
Jun 13 06:27:01 server sshd[23085]: Invalid user guestftp from 150.186.100.102
Jun 13 06:27:01 server sshd[23084]: Invalid user nagios from 150.186.100.102
Jun 13 06:27:02 server sshd[23088]: Invalid user admin from 150.186.100.102
Jun 13 06:27:05 server sshd[23090]: Invalid user guesttest from 150.186.100.102
Jun 13 06:27:07 server sshd[23092]: Invalid user admin from 150.186.100.102
Jun 13 06:27:08 server sshd[23094]: Invalid user nagios from 150.186.100.102
Jun 13 06:27:11 server sshd[23098]: Invalid user admin from 150.186.100.102
Jun 13 06:27:11 server sshd[23096]: Invalid user home from 150.186.100.102
Jun 13 06:27:13 server sshd[23100]: Invalid user nagios from 150.186.100.102
Jun 13 06:27:15 server sshd[23102]: Invalid user webmaster from 150.186.100.102
Jun 13 06:27:16 server sshd[23104]: Invalid user admin from 150.186.100.102
Jun 13 06:27:18 server sshd[23106]: Invalid user nagios from 150.186.100.102
Jun 13 06:27:19 server sshd[23110]: Invalid user webmaster from 150.186.100.102
Jun 13 06:27:19 server sshd[23108]: Invalid user home from 150.186.100.102
Jun 13 06:27:21 server sshd[23112]: Invalid user admin from 150.186.100.102
Jun 13 06:27:21 server sshd[23114]: Invalid user nagios from 150.186.100.102
Jun 13 06:27:23 server sshd[23116]: Invalid user home from 150.186.100.102
Jun 13 06:27:23 server sshd[23117]: Invalid user probaftp from 150.186.100.102
Jun 13 06:27:26 server sshd[23121]: Invalid user admin from 150.186.100.102
Jun 13 06:27:26 server sshd[23120]: Invalid user nagios from 150.186.100.102
Jun 13 06:27:27 server sshd[23124]: Invalid user home from 150.186.100.102
Jun 13 06:27:27 server sshd[23125]: Invalid user proba from 150.186.100.102
Jun 13 06:27:30 server sshd[23128]: Invalid user admin from 150.186.100.102
Jun 13 06:27:31 server sshd[23131]: Invalid user proba from 150.186.100.102
Jun 13 06:27:34 server sshd[23134]: Invalid user nagios from 150.186.100.102
Jun 13 06:27:36 server sshd[23136]: Invalid user proba from 150.186.100.102
Jun 13 06:27:36 server sshd[23130]: Invalid user home from 150.186.100.102
Jun 13 06:27:43 server sshd[23140]: Invalid user home from 150.186.100.102
Jun 13 06:27:48 server sshd[23142]: Invalid user home from 150.186.100.102
Jun 13 06:27:52 server sshd[23148]: Invalid user home from 150.186.100.102
Jun 13 06:27:56 server sshd[23150]: Invalid user home from 150.186.100.102
Jun 13 06:28:03 server sshd[23152]: Invalid user home from 150.186.100.102
Jun 13 06:28:54 server sshd[23166]: Invalid user nagios from 150.186.100.102
Jun 13 06:28:58 server sshd[23170]: Invalid user nagios from 150.186.100.102
Jun 13 06:29:08 server sshd[23174]: Invalid user nagios from 150.186.100.102
Jun 13 06:29:13 server sshd[23179]: Invalid user nagios from 150.186.100.102
Jun 13 06:29:18 server sshd[23185]: Invalid user nagios from 150.186.100.102
Jun 13 06:29:22 server sshd[23191]: Invalid user nagios from 150.186.100.102
Jun 13 06:29:27 server sshd[23197]: Invalid user nagios from 150.186.100.102
Jun 13 06:29:33 server sshd[23204]: Invalid user nagios from 150.186.100.102
Jun 13 06:29:37 server sshd[23211]: Invalid user nagios from 150.186.100.102
Jun 13 06:29:42 server sshd[23220]: Invalid user nagios from 150.186.100.102
Jun 13 06:29:48 server sshd[23227]: Invalid user nagios from 150.186.100.102
Jun 13 06:29:51 server sshd[23235]: Invalid user nagios from 150.186.100.102
Jun 13 06:29:56 server sshd[23243]: Invalid user nagios from 150.186.100.102
Jun 14 01:34:16 server sshd[25579]: Invalid user oracle from 120.69.154.203
Jun 14 01:34:25 server sshd[25581]: Invalid user test from 120.69.154.203
Jun 14 03:08:37 server sshd[25744]: Invalid user apache from 58.242.99.78
Jun 14 03:08:45 server sshd[25746]: Invalid user apache from 58.242.99.78
Jun 14 03:08:56 server sshd[25748]: Invalid user bage from 58.242.99.78
Jun 14 13:40:33 server sshd[27130]: Invalid user plesk-root from 91.186.31.36
Jun 16 04:12:38 server sshd[3133]: Invalid user staff from 203.93.239.122
Jun 16 04:12:41 server sshd[3171]: Invalid user sales from 203.93.239.122
Jun 16 04:12:45 server sshd[3209]: Invalid user recruit from 203.93.239.122
Jun 16 04:12:48 server sshd[3248]: Invalid user alias from 203.93.239.122
Jun 16 04:12:55 server sshd[3322]: Invalid user office from 203.93.239.122
Jun 16 04:12:59 server sshd[3324]: Invalid user samba from 203.93.239.122
Jun 16 04:13:02 server sshd[3362]: Invalid user tomcat from 203.93.239.122
Jun 16 04:13:05 server sshd[3400]: Invalid user webadmin from 203.93.239.122
Jun 16 04:13:09 server sshd[3439]: Invalid user spam from 203.93.239.122
Jun 16 04:13:12 server sshd[3477]: Invalid user virus from 203.93.239.122
Jun 16 04:13:20 server sshd[3515]: Invalid user cyrus from 203.93.239.122
Jun 16 04:13:23 server sshd[3553]: Invalid user oracle from 203.93.239.122
Jun 16 04:13:27 server sshd[3591]: Invalid user michael from 203.93.239.122
Jun 16 04:13:37 server sshd[3705]: Invalid user test from 203.93.239.122
Jun 16 04:13:41 server sshd[3727]: Invalid user webmaster from 203.93.239.122
Jun 16 04:13:44 server sshd[3745]: Invalid user postmaster from 203.93.239.122
Jun 16 04:13:55 server sshd[3870]: Invalid user postgres from 203.93.239.122
Jun 16 04:13:59 server sshd[3917]: Invalid user paul from 203.93.239.122
Jun 16 04:14:05 server sshd[3960]: Invalid user guest from 203.93.239.122
Jun 16 18:46:49 server sshd[23415]: Invalid user tester from 60.210.8.234
Jun 16 18:47:04 server sshd[23565]: Invalid user oracle from 60.210.8.234
Jun 16 18:47:11 server sshd[23603]: Invalid user oracle from 60.210.8.234
Jun 16 18:47:15 server sshd[23641]: Invalid user oracle from 60.210.8.234
Jun 16 18:47:20 server sshd[23679]: Invalid user oracle from 60.210.8.234
Jun 16 18:47:26 server sshd[23718]: Invalid user test from 60.210.8.234
Jun 16 18:47:31 server sshd[23793]: Invalid user test from 60.210.8.234
Jun 16 18:47:35 server sshd[23831]: Invalid user test from 60.210.8.234
Jun 16 19:56:37 server sshd[27429]: Invalid user peiman from 218.249.29.194
Jun 16 19:56:42 server sshd[27446]: Invalid user peiman from 218.249.29.194
Jun 16 19:56:47 server sshd[27505]: Invalid user peiman from 218.249.29.194
Jun 16 19:56:55 server sshd[27580]: Invalid user sales from 218.249.29.194
Jun 16 19:57:00 server sshd[27618]: Invalid user admin from 218.249.29.194
Jun 16 19:57:04 server sshd[27656]: Invalid user project1 from 218.249.29.194
Jun 16 19:57:09 server sshd[27694]: Invalid user project2 from 218.249.29.194
Jun 16 19:57:15 server sshd[27732]: Invalid user project3 from 218.249.29.194
Jun 16 19:57:19 server sshd[27806]: Invalid user project4 from 218.249.29.194
Jun 16 19:57:24 server sshd[27844]: Invalid user yasnis from 218.249.29.194
Jun 16 19:57:29 server sshd[27882]: Invalid user yasnis from 218.249.29.194
Jun 16 19:57:36 server sshd[27956]: Invalid user yasnis from 218.249.29.194
Jun 16 19:57:43 server sshd[27994]: Invalid user yasnis from 218.249.29.194
Jun 16 19:57:47 server sshd[28032]: Invalid user ahsan from 218.249.29.194
Jun 16 19:57:54 server sshd[28106]: Invalid user ahsan from 218.249.29.194
Jun 16 19:57:59 server sshd[28145]: Invalid user ahsan from 218.249.29.194
Jun 16 19:58:03 server sshd[28183]: Invalid user ahsan from 218.249.29.194
Jun 17 00:16:40 server sshd[844]: Invalid user apache from 193.252.184.161
Jun 17 00:16:42 server sshd[846]: Invalid user apache from 193.252.184.161
Jun 17 00:16:44 server sshd[884]: Invalid user bage from 193.252.184.161
Jun 17 00:16:46 server sshd[886]: Invalid user bage from 193.252.184.161
Jun 17 00:16:47 server sshd[924]: Invalid user cacti from 193.252.184.161
Jun 17 00:16:49 server sshd[926]: Invalid user cacti from 193.252.184.161
Jun 17 00:16:51 server sshd[928]: Invalid user cacti from 193.252.184.161
Jun 17 00:16:52 server sshd[966]: Invalid user cacti from 193.252.184.161
Jun 17 00:16:56 server sshd[968]: Invalid user cacti from 193.252.184.161
Jun 17 00:16:57 server sshd[1006]: Invalid user cactiuser from 193.252.184.161
Jun 17 00:16:59 server sshd[1008]: Invalid user cactiuser from 193.252.184.161
Jun 17 00:17:02 server sshd[1046]: Invalid user cactiuser from 193.252.184.161
Jun 17 00:17:04 server sshd[1048]: Invalid user cactiuser from 193.252.184.161
Jun 17 00:17:06 server sshd[1086]: Invalid user cactiuser from 193.252.184.161
Jun 17 00:17:07 server sshd[1088]: Invalid user cleo from 193.252.184.161
Jun 17 00:17:12 server sshd[1160]: Invalid user cleo from 193.252.184.161
Jun 17 00:17:14 server sshd[1164]: Invalid user fido from 193.252.184.161
Jun 17 00:17:16 server sshd[1166]: Invalid user fido from 193.252.184.161
Jun 17 00:17:19 server sshd[1204]: Invalid user goce from 193.252.184.161
Jun 17 00:17:20 server sshd[1221]: Invalid user kataxavier from 193.252.184.161
Jun 17 00:17:22 server sshd[1244]: Invalid user kataxavier from 193.252.184.161
Jun 17 00:17:24 server sshd[1246]: Invalid user kazui from 193.252.184.161
Jun 17 00:17:26 server sshd[1285]: Invalid user kazui from 193.252.184.161
Jun 17 00:17:28 server sshd[1287]: Invalid user morin from 193.252.184.161
Jun 17 00:17:30 server sshd[1325]: Invalid user morin from 193.252.184.161
Jun 17 00:17:42 server sshd[1449]: Invalid user oracle from 193.252.184.161
Jun 17 00:17:43 server sshd[1451]: Invalid user oracle from 193.252.184.161
Jun 17 00:17:45 server sshd[1453]: Invalid user oracle from 193.252.184.161
Jun 17 00:17:50 server sshd[1527]: Invalid user oracle from 193.252.184.161
Jun 17 00:17:51 server sshd[1529]: Invalid user oracle from 193.252.184.161
Jun 17 00:17:54 server sshd[1531]: Invalid user oracle from 193.252.184.161
Jun 17 00:17:55 server sshd[1569]: Invalid user oracle from 193.252.184.161
Jun 17 00:17:58 server sshd[1571]: Invalid user oracle from 193.252.184.161
Jun 17 00:17:59 server sshd[1609]: Invalid user ovi from 193.252.184.161
Jun 17 00:18:02 server sshd[1611]: Invalid user ovi from 193.252.184.161
Jun 17 00:18:03 server sshd[1649]: Invalid user postgres from 193.252.184.161
Jun 17 00:18:05 server sshd[1651]: Invalid user postgres from 193.252.184.161
Jun 17 00:18:07 server sshd[1689]: Invalid user postgres from 193.252.184.161
Jun 17 00:18:10 server sshd[1691]: Invalid user postgres from 193.252.184.161
Jun 17 00:18:11 server sshd[1729]: Invalid user postgres from 193.252.184.161
Jun 17 00:18:13 server sshd[1731]: Invalid user postgres from 193.252.184.161
Jun 17 00:18:15 server sshd[1733]: Invalid user postgres from 193.252.184.161
Jun 17 00:18:17 server sshd[1771]: Invalid user postgres from 193.252.184.161
Jun 17 17:51:39 server sshd[32302]: Invalid user oracle from 125.33.196.215
Jun 17 17:51:41 server sshd[32304]: Invalid user postgres from 125.33.196.215
Jun 17 17:51:48 server sshd[32383]: Invalid user postgres from 125.33.196.215
Jun 17 17:51:56 server sshd[32460]: Invalid user fpt from 125.33.196.215
Jun 17 17:52:03 server sshd[32503]: Invalid user secure from 125.33.196.215
Jun 17 17:52:06 server sshd[32542]: Invalid user secure from 125.33.196.215
Jun 17 17:52:07 server sshd[32584]: Invalid user admin from 125.33.196.215
Jun 17 17:52:09 server sshd[32581]: Invalid user secure from 125.33.196.215
Jun 17 17:52:12 server sshd[32624]: Invalid user backup from 125.33.196.215
Jun 17 17:52:13 server sshd[32626]: Invalid user spam from 125.33.196.215
Jun 17 17:52:16 server sshd[32664]: Invalid user admin from 125.33.196.215
Jun 17 17:52:18 server sshd[32668]: Invalid user spam from 125.33.196.215
Jun 17 17:52:20 server sshd[32666]: Invalid user secure from 125.33.196.215
Jun 17 17:52:22 server sshd[32706]: Invalid user secure from 125.33.196.215
Jun 17 17:52:24 server sshd[32708]: Invalid user backup from 125.33.196.215
Jun 17 17:52:24 server sshd[32710]: Invalid user admin from 125.33.196.215
Jun 17 17:52:26 server sshd[32748]: Invalid user secure from 125.33.196.215
Jun 17 17:52:30 server sshd[32750]: Invalid user spam from 125.33.196.215
Jun 17 17:52:34 server sshd[321]: Invalid user secure from 125.33.196.215
Jun 17 17:52:41 server sshd[403]: Invalid user tomcat from 125.33.196.215
Jun 17 17:52:48 server sshd[514]: Invalid user tomcat from 125.33.196.215
Jun 17 17:52:53 server sshd[552]: Invalid user tomcat from 125.33.196.215
Jun 17 17:52:58 server sshd[590]: Invalid user tomcat from 125.33.196.215
Jun 18 22:37:00 server sshd[23195]: Invalid user plesk-root from 95.211.132.226
Jun 18 22:37:00 server sshd[23197]: Invalid user joomla from 95.211.132.226

Ist nur ein Ausschnitt. Für mich ist das eine Bruteforce Attacke - ich habe den Server erst einmal auf den neuesten Stand gebracht, die Firewall konfiguriert und ihn ausgeschaltet. Aber ich weiß nicht was ich dann noch tun könnte. Vielleicht wisst Ihr was noch wirkungsvoll wäre?

Ich weiß nicht, aber ich würde gerne einen User einrichten, der SSH Nutzen kann und gleichzeitig würde ich dies gerne dem User "root" verbieten. Ich habe aber keine Idee wie.

Geier0815 · 19 Juni 2010

/etc/ssh/sshd_conf "Permit root-login" "no" und schon kann root sich nicht mehr anmelden (nach neustart des Dienstes, selbstverständlich). Ansonsten kannst Du ja in der Firewall einstellen Zugriffe nur von bestimmten IP-Adressen zu zulassen.

Chaoshh · 19 Juni 2010

Natürlich habe ich keine feste IP das würde dann nur für LAN gültig sein.

Der Angriff war wohl recht primitiv und der Hacker keine große Leuchte wie es scheint. Er suchte nur "pauschal" nach den gängigsten und einfachsten Logins und Passwörtern. So in der Art "Login" und "123456". Hauptsache er ist nicht durchgekommen.

Danke für den Tipp.

Falls wer noch Ideen hat wie ich den Server noch besser schützen kann und gleichzeitig den SSH Zugriff und Funktionen beibehalten - bitte posten.

stj@ · 19 Juni 2010

Um den ssh Server noch weiter abzusichern, können Public-Keys zur Anmeldung verwendet werden und Passwörter abgeschaltet werden (Ubuntuusers Artikel [1]). Nur wer deinen Schlüssel hat, kann sich per ssh anmelden. Allerdings besteht hier ein erhöhtes Risiko sich selbst auszusperren, was besonders auf Headless Servern, die nur per Netzwerk erreicht werden können, nervenaufreibend werden kann. Als Kompromiss könnte hier die lokale Anmeldung über die Serielle Schnittstelle eingeschaltet werden.

panamajo · 19 Juni 2010

Chaoshh schrieb:
Der Angriff war wohl recht primitiv und der Hacker keine große Leuchte wie es scheint. Er suchte nur "pauschal" nach den gängigsten und einfachsten Logins und Passwörtern. So in der Art "Login" und "123456". Hauptsache er ist nicht durchgekommen.

Das ist ganz normal und kann jederzeit vorkommen. Z.Zt. läuft auf meinem Rechner @home eine seit 48h andauernde DDoS Attacke, was man sehr gut daran sieht dass eine alphabetische Loginliste von Rechnern rund um den Erdball abgearbeitet wird.
[/quote]

Chaoshh schrieb:
Falls wer noch Ideen hat wie ich den Server noch besser schützen kann und gleichzeitig den SSH Zugriff und Funktionen beibehalten - bitte posten.

Fail2ban (ab 0.8.4) ist ein probates Mittel um Skript-Kiddies zu vertreiben, gegen einen DDoS ist der Erfolg eher gering.

framp · 19 Juni 2010

Das kommt auf jedem Server vor, der Port 22 offen hat. Deshalb musst Du den Port entsprechend sichern.
Am sichersten ist einen key zu benutzen und nur key authorized ssh Zugriff zuzulassen.

panamajo · 19 Juni 2010

framp schrieb:
Am sichersten ist einen key zu benutzen und nur key authorized ssh Zugriff zuzulassen.

Das ist richtig und habe ich nie in Frage gestellt. Interessiert den DDoS aber nicht die Bohne.
Vmtl. hat eh nur irgendein Idiot einen Zahlendreher bzgl. IP beim Start des Skripts gemacht, denn wie interessant sind Rechner im DynIP Bereich eines großen ISPs?

framp · 20 Juni 2010

panamajo schrieb:
... denn wie interessant sind Rechner im DynIP Bereich eines großen ISPs?

Eine Zeit lang musste ich einen ssh Zugriff bei mir zu Hause offen haben. Da bekam ich die o.g. Messges im Log diverse male. Es waren auch Angriffe von einer indischen Universität dabei. Ich habe daraufhin den Dekan per eMail angeschrieben und der IT Verantwortliche der Uni hat geantwortet, dass von der IP Adresse technisch kein Angriff möglich gewesen wäre. Bei der Antwort war der Dekan auf cc ... jedenfalls war daraufhin von dort Ruhe :roll:

Tenor: Port 22 ist ein beliebtes Ziel für Einbruchsversuche - also muss der narrensicher eingerichtet sein. Die verscheidenen Möglichkeiten habe ich im obigen Link schon geposten ;-)

panamajo · 20 Juni 2010

framp schrieb:
der IT Verantwortliche der Uni hat geantwortet, dass von der IP Adresse technisch kein Angriff möglich gewesen wäre. Bei der Antwort war der Dekan auf cc ... jedenfalls war daraufhin von dort Ruhe

Naja, dann hat vllt. jemand auf den Busch geklopft dass man nicht jeden Mist ungefiltert am Gateway durchlässt.
Ich rede aber nicht von einem DoS sondern DDoS, soviele Dekane und sonstweg Verantwortiliche kann man gar nicht kontaktieren...

Code:

# lastb | uniq -f 2 | wc -l
666
btmp begins Sat Jun 19 02:15:14 2010

Ist kein Problem da der ssh Zugang Key-based ist.

Chaoshh · 20 Juni 2010

Ich habe erst einmal folgende Maßnahmen selbst ergriffen:
- den Port im Router von einem hohen Port (über 10000) auf einen hohen Port (über 20000, aber ein anderer) forwarded
- in der /etc/ssh/sshd_conf habe ich "permit root-login=no" stehen
- der SSHD horcht jetzt auf dem internen hohen Port (über 20000)
- einen ssh User angelegt, der einen Namen hat, der aus einem Wort und folgenden, nichtssagenden Zahlen, besteht
- auch das PW dieses benutzers ist kompliziert und über 10 Zeichen lang. Kein Wörterbuch führt es.
- dieser Benutzer loggt sich dann ein

Ich hoffe, daß ist eine gute Sicherung erst einmal. So komme ich rein und kann mich einloggen. Dann kann ich ja mit "su" oder "sudo" weiterarbeiten.

Ich muss nur noch irgendwie hinkriegen, daß nicht nur root, sondern auch alle anderen Benutzer sich nicht einloggen dürfen.

Die geposteten Links werde ich abarbeiten und versuche soviel wie möglich davon umzusetzen.

K4m1K4tz3 · 20 Juni 2010

panamajo schrieb:
Code:

# lastb | uniq -f 2 | wc -l 666

Da ist wohl Satan höchst persönlich am Werk ;-)

Server ausgerastet ?

Member

Guru

Ultimate Guru

Guru

Member

Moderator

Member

Moderator

Member

Member

Guru

Member

Newbie

Guru

Moderator

Guru

Moderator

Guru

Member

Advanced Hacker