Hello, I recently setup a box to run gameservers.

Just if this helps, specs are dual xeon 2.4, 2gb ecc reg ram, 2x 40gb 8meg cache 7200 rpm running raid0 from highpoint raid card in a 4u case, coolmax 470watt power supply.

Anyways, heres what has happened twice now:

-SSH shuts down
-HTTP shuts down

-Load up counter-strike server pinging tool and realize the gameservers are still up. I try to connect, and it shuts down. This was about 1 minute after SSH/HTTP shut down.

Ping was still working.

Last time it happened, it had been going on for a bit before I realized, and ping had stopped working too.

I'm anxious to see what the problem is.

Our tech down at the dc said this:
'I rebooted it, nothing. I plugged in the mouse and keyboard and it started working.'

Well, it had never worked for us, so I'm guessing it was only up for a minunte or so.

Call back again 'Well, I put keyboard and mouse back in, nothing. Let me try rebooting again. Ok its working now.'

Its been about an hour now, and its still running fine.

After going through the logs, there was no unusual activity whatsoever.

Any ideas on what the problem and/or how to fix it?

Our remote linux tech and the people at the datacenter have no ideas, so any ideas are appreciated.


Thanks alot,
--Mike

so theres no logs about ssh going down ?

what about the http error log ?

sorry seemed a bit obvious and patronising in retrospect

try juggling round syslog.conf to put * logging into 1 file, maybe remotely and see if its still sending out packets

Damnit, it just happened for the 3rd time in 36 hours. Does anyone have an ideas what the problem could be? Logs show nothing unusual, doesn't show ssh or http going down in the logs.

Thanks

One possibility is that someone is trying to exploit a vulnerability in the sshd and httpd processes... If someone was attempting to a buffer/integer/string format exploit on these processes it could cause the process to attempt to access a section of memory it is not privileged to access. This would cause the process to die leaving behind a core dump file (usually filename.core, where filename is the name of the process.)

Andrew