Skip site navigation (1)Skip section navigation (2)
Date:      Sun, 20 Sep 1998 05:00:52 PDT
From:      "N. N.M" <madrapour@hotmail.com>
To:        freebsd-security@FreeBSD.ORG
Subject:   Re: A question probably relevant to IPFW
Message-ID:  <19980920120052.4652.qmail@hotmail.com>

next in thread | raw e-mail | index | archive | help

Hi

>I do have ipfw active on the machine with packet filtering but
>just a default let-anything-through filter.
>
>I didn't get any log entries like this, I've even been logged
>in just before the machine's rebooted before and there was no-one
>else logged in, no strange netstat -i entries.. 
>
>What was in your cron that starts up at this time? /etc/daily?
>
>home# time /etc/daily
><snip! crap..>
>real    1m25.888s
>user    0m2.159s
>sys     0m12.067s
>
>This machine's only a P75 and yet it still manages to finish
>/etc/daily in 1minute 25seconds. Was it 02:05 exactly?
>
>Mine's not rebooted in 6 days btw.. 
>
>Regards,
>
>Jay Tribick <netadmin@fastnet.co.uk>


The exact lines in /var/cron/log are as follow (these lines are repeated 
in /var/cron/log file whenever automatically rebooting is occured):

Sep 18 02:00:00 MACHINE-NAME CRON [21019]: (root) CMD (  /etc/daily 2>
&1 | sendmail root)

Sep 18 02:00:00 MACHINE-NAME CRON [21020]: (root) CMD 
(/usr/sbin/newsyslog)

Sep 18 02:00:00 MACHINE-NAME CRON [21021]: (root) CMD 
(/usr/libexec/atrun)

Sep 18 02:05:32 MACHINE-NAME cron [8949]: (CRON) STARTUP (fork ok)

It seems whenever this combination of the commands occure, it reboots. I 
mean a combination of: sendmail root, newsyslog and atrun; it reboots. 
I've commented the daily, weekly and monthly in "crontab" file to see if 
the problem will be fixed or not. 

Regards,
Nazila M.



______________________________________________________
Get Your Private, Free Email at http://www.hotmail.com

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?19980920120052.4652.qmail>