Web Hosting Talk : Web Hosting Main Forums : Dedicated Server : Several server crashes with Rackshack.

[wewe]

Hi,
We had with 5stars a cobalt raq 4i with 128M RAM and about 18G Of storage Capacity, we moved our same Software to Rackshack to a new cobalt raq 4i with better resources 512M RAM and about 45G of storage capacity. Since that time we have been encountring several crashes per day.
The rackshack support staff claimed that we had to do a full restore, we agreed on that since we had no choice. After a very long time (more than 24 hours) we had the server again, we accessed the control panel and before doing anything we had "Internal Serve Error" (So how can they claim that a problem that caused by our software) which continued later repeatedly. And before restoring our data we had the server crashed again. They claimed that the crash is because of our tar operations (We think that it is not reasonable), so we stopped them. Finally the server crashed because we installed the mysql package.
We lost our customers and their trust. We had a bad position in the competition market. We paid too much money on overseas phone calls since the trouble ticket is not feasible and slow.
After long negociations with reackshack poeple they took the server to the office to monitor it, they claimed that did not find any hardware wrong and everything is well from there side. We are not operating something abnormal on the server, and we still working with a minimal data. We have only less than 70 virtual sites, a freemail service with about 1000 users (about 250 users simultaneously), and PHPMyadmin chat (Poor with users), and all of these were working very well on the old server.
The RS tech support insisted that there is nothing to do with it except to reboot it each time it crashes, so we need a dedicated person to monitor the advent of crash to reboot it, or to call or contact the rackshack poeple to reboot the server that may take a significant time to waste. We told them that from the above indications we can conclude that it might be something in the hardware, network or the operating system especially we have several crashes before installing anything on it and we demanded to change our server, but they refused that analysis and said that there is nothing wrong with Hardware and it is a software problem.
Finally, we wanted to stop all the suspected operations, so we stopped any unnecessary operation and although all the default cron job (We do not have any specific ones). the server still have crashes and in random times, especially in periods where minimal access or usage happen on the server. We have been with RS only about one month and they charged us for the new month. After calculating the setup fee and the charges we paid we concloded that we paid about $600 per month which is much expensive than any other company. And if we waived our server and decide to move to another company we are sure that they have someone ready to take our place.
The RS technical support seems to ignore our situation and claimed that the problem is from our side, although we had this problem since the first day with RS. We need your help to guide us in order to know where is the problem. We think that we do not use excess resourses on the server, we have a good experience on cobalt. Moreover, we used to operate more than these data on the old raq which was with less resources. Please help we are really mad.........!
Can somebody help?

[Chicken]

Why don't you ask for a different machine altogether (even if it means a set up fee), if you think it is the machine itself. Once it is determined to be the first machine, I'd think they'd credit the 2nd set up fee, but then again, I suppose you'd have to ask them about that to be sure.

[dektong]

Could it be CPU overheating? I read that some raqs will have less luck with regards to its CPU temperature. And I thought there is a way for you to monitor the CPU temperature in raqs ... I am just wonderring this as plausible explanations since any high activity (disk activity, hence including backup, tar, etc) will increase the CPU Load and hence, the CPU temperature ...

Good luck ...

cheers,

[wewe]

That is the /var/log/kernel before the server crashes

kindly..... advice is ther any resson to crashes the server ?


Nov 27 00:12:42 server kernel: possible SYN flooding on port 80. Sending cookies.
Nov 27 00:13:44 server kernel: possible SYN flooding on port 80. Sending cookies.
Nov 27 04:27:44 server last message repeated 2 times
Nov 27 04:32:25 server kernel: possible SYN flooding on port 80. Sending cookies.
Nov 27 04:33:36 server kernel: possible SYN flooding on port 80. Sending cookies.
Nov 27 04:38:26 server kernel: possible SYN flooding on port 80. Sending cookies.
Nov 27 04:39:27 server kernel: possible SYN flooding on port 80. Sending cookies.
Nov 27 04:40:33 server kernel: possible SYN flooding on port 80. Sending cookies.
Nov 27 04:41:34 server kernel: possible SYN flooding on port 80. Sending cookies.
Nov 27 04:42:42 server kernel: possible SYN flooding on port 80. Sending cookies.
Nov 27 04:44:08 server kernel: possible SYN flooding on port 80. Sending cookies.
Nov 27 04:45:11 server kernel: possible SYN flooding on port 80. Sending cookies.
Nov 27 04:48:10 server kernel: possible SYN flooding on port 80. Sending cookies.
Nov 27 04:49:49 server kernel: possible SYN flooding on port 80. Sending cookies.
Nov 27 04:50:50 server kernel: possible SYN flooding on port 80. Sending cookies.
Nov 27 04:51:53 server kernel: possible SYN flooding on port 80. Sending cookies.
Nov 27 05:03:45 server kernel: possible SYN flooding on port 80. Sending cookies.
Nov 27 05:04:49 server kernel: possible SYN flooding on port 80. Sending cookies.
Nov 27 05:06:38 server kernel: possible SYN flooding on port 80. Sending cookies.
Nov 27 05:08:19 server kernel: possible SYN flooding on port 80. Sending cookies.
Nov 27 05:09:50 server kernel: possible SYN flooding on port 80. Sending cookies.
Nov 27 06:15:57 server kernel: possible SYN flooding on port 80. Sending cookies.
Nov 27 06:17:18 server kernel: possible SYN flooding on port 80. Sending cookies.
Nov 27 06:18:49 server kernel: possible SYN flooding on port 80. Sending cookies.
Nov 27 06:19:51 server kernel: possible SYN flooding on port 80. Sending cookies.
Nov 27 06:20:53 server kernel: possible SYN flooding on port 80. Sending cookies.
Nov 27 08:21:01 server last message repeated 2 times
Nov 27 08:23:05 server last message repeated 2 times
Nov 27 08:24:08 server kernel: possible SYN flooding on port 80. Sending cookies.
Nov 27 08:25:25 server kernel: possible SYN flooding on port 80. Sending cookies.
Nov 27 08:26:27 server kernel: possible SYN flooding on port 80. Sending cookies.
Nov 27 08:27:41 server kernel: possible SYN flooding on port 80. Sending cookies.

here the server ofline.

kindly advice........

[wewe]

That is the /var/log/kernel After rebooted


Nov 27 15:27:12 server kernel: klogd 1.3-3, log source = /proc/kmsg started.
Nov 27 15:27:12 server kernel: Inspecting /boot/System.map
Nov 27 15:27:12 server kernel: Loaded 7617 symbols from /boot/System.map.
Nov 27 15:27:12 server kernel: Symbols match kernel version 2.2.16.
Nov 27 15:27:12 server kernel: Loaded 124 symbols from 2 modules.
Nov 27 15:27:12 server kernel: Linux version 2.2.16C28_III (root@sun.cobalt.com) (gcc version egcs-2.91.66 19990314/Linux (egcs-1.1.2 release)) #1 Mon Jul 30 22:07:58 PDT 2001
Nov 27 15:27:12 server kernel: Ignoring bogus EBDA pointer 3FFF000
Nov 27 15:27:12 server kernel: Detected 448211 kHz processor.
Nov 27 15:27:12 server kernel: Pending 0x00
Nov 27 15:27:12 server kernel: Calibrating delay loop... 894.57 BogoMIPS
Nov 27 15:27:12 server kernel: Memory: 517124k/524288k available (1244k kernel code, 416k reserved, 5440k data, 64k init)
Nov 27 15:27:12 server kernel: Dentry hash table entries: 65536 (order 7, 512k)
Nov 27 15:27:12 server kernel: Buffer cache hash table entries: 524288 (order 9, 2048k)
Nov 27 15:27:12 server kernel: Page cache hash table entries: 131072 (order 7, 512k)
Nov 27 15:27:12 server kernel: VFS: Diskquotas version dquot_6.4.0 initialized
Nov 27 15:27:12 server kernel: CPU: L1 I Cache: 32K L1 D Cache: 32K
Nov 27 15:27:13 server kernel: CPU: L2 Cache: 128K
Nov 27 15:27:13 server kernel: CPU: AMD AMD-K6(tm)-III Processor stepping 04
Nov 27 15:27:13 server kernel: Checking 386/387 coupling... OK, FPU using exception 16 error reporting.
Nov 27 15:27:13 server kernel: Checking 'hlt' instruction... OK.
Nov 27 15:27:13 server kernel: POSIX conformance testing by UNIFIX
Nov 27 15:27:13 server kernel: PCI: Using configuration type 1
Nov 27 15:27:13 server kernel: PCI: Probing PCI hardware
Nov 27 15:27:14 server kernel: Linux NET4.0 for Linux 2.2
Nov 27 15:27:14 server kernel: Based upon Swansea University Computer Society NET3.039
Nov 27 15:27:14 server kernel: NET4: Unix domain sockets 1.0 for Linux NET4.0.
Nov 27 15:27:14 server kernel: NET4: Linux TCP/IP 1.0 for NET4.0
Nov 27 15:27:14 server kernel: IP Protocols: ICMP, UDP, TCP, IGMP
Nov 27 15:27:14 server kernel: TCP: Hash tables configured (ehash 524288 bhash 65536)
Nov 27 15:27:14 server kernel: Initializing RT netlink socket
Nov 27 15:27:14 server kernel: Starting kswapd v 1.5
Nov 27 15:27:15 server kernel: Cobalt watchdog v1.4 enabled
Nov 27 15:27:15 server kernel: Cobalt I2C bus initialized
Nov 27 15:27:15 server kernel: Cobalt temperature sensor v1.3 enabled
Nov 27 15:27:15 server kernel: Serial driver version 4.27 with no serial options enabled
Nov 27 15:27:15 server kernel: ttyS00 at 0x03f8 (irq = 4) is a 16550A
Nov 27 15:27:15 server kernel: keyboard: Timeout - AT keyboard not present?
Nov 27 15:27:15 server kernel: keyboard: Timeout - AT keyboard not present?
Nov 27 15:27:15 server kernel: ttyS01 at 0x02f8 (irq = 3) is a 16550A
Nov 27 15:27:16 server kernel: pty: 256 Unix98 ptys configured
Nov 27 15:27:16 server kernel: Real Time Clock Driver v1.09
Nov 27 15:27:16 server kernel: lcd: Cobalt LCD Driver v3.12^M
Nov 27 15:27:16 server kernel: serialnumber: Version 1.9 initialized. Serial number=05000007d22ff801.
Nov 27 15:27:16 server kernel: Copyright (c)1994-2000 Axent Technologies, Inc.
Nov 27 15:27:16 server kernel: Uniform Multi-Platform E-IDE driver Revision: 6.30
Nov 27 15:27:16 server kernel: ide: Assuming 33MHz system bus speed for PIO modes; override with idebus=xx
Nov 27 15:27:16 server kernel: ALI15X3: IDE controller on PCI bus 00 dev 78
Nov 27 15:27:16 server kernel: ALI15X3: chipset revision 193
Nov 27 15:27:17 server kernel: ALI15X3: 100%% native mode on irq 14
Nov 27 15:27:17 server kernel: ide0: BM-DMA at 0xf000-0xf007, BIOS settings: hdaMA, hdbMA
Nov 27 15:27:17 server kernel: ide1: BM-DMA at 0xf008-0xf00f, BIOS settings: hdcMA, hddMA
Nov 27 15:27:17 server kernel: hda: ST320410A, ATA DISK drive
Nov 27 15:27:17 server kernel: ide: Assuming 33MHz system bus speed for PIO modes; override with idebus=xx
Nov 27 15:27:17 server kernel: hdc: QUANTUM FIREBALLP AS30.0, ATA DISK drive
Nov 27 15:27:17 server kernel: ide0 at 0x1f0-0x1f7,0x3f6 on irq 14
Nov 27 15:27:17 server kernel: ide1 at 0x170-0x177,0x376 on irq 15
Nov 27 15:27:18 server kernel: hda: ST320410A, 19092MB w/2048kB Cache, CHS=38792/16/63, UDMA(33)
Nov 27 15:27:18 server kernel: hdc: QUANTUM FIREBALLP AS30.0, 28629MB w/1902kB Cache, CHS=58168/16/63, UDMA(33)
Nov 27 15:27:18 server kernel: md driver 0.90.0 MAX_MD_DEVS=256, MAX_REAL=12
Nov 27 15:27:18 server kernel: translucent personality registered
Nov 27 15:27:18 server kernel: linear personality registered
Nov 27 15:27:18 server kernel: raid0 personality registered
Nov 27 15:27:18 server kernel: raid1 personality registered
Nov 27 15:27:18 server kernel: raid5 personality registered
Nov 27 15:27:18 server kernel: raid5: measuring checksumming speed
Nov 27 15:27:19 server kernel: raid5: MMX detected, trying high-speed MMX checksum routines
Nov 27 15:27:19 server kernel: pII_mmx : 933.450 MB/sec
Nov 27 15:27:19 server kernel: p5_mmx : 862.584 MB/sec
Nov 27 15:27:19 server kernel: 8regs : 438.912 MB/sec
Nov 27 15:27:19 server kernel: 32regs : 281.178 MB/sec
Nov 27 15:27:19 server kernel: using fastest function: pII_mmx (933.450 MB/sec)
Nov 27 15:27:19 server kernel: sym53c8xx: at PCI bus 0, device 14, function 0
Nov 27 15:27:19 server kernel: sym53c8xx: 53c875 detected
Nov 27 15:27:20 server kernel: sym53c875-0: rev 0x4 on pci bus 0 device 14 function 0 irq 12
Nov 27 15:27:20 server kernel: sym53c875-0: ID 7, Fast-20, Parity Checking
Nov 27 15:27:20 server kernel: scsi0 : sym53c8xx-1.7.3a-20010304
Nov 27 15:27:20 server kernel: scsi : 1 host.
Nov 27 15:27:20 server kernel: scsi : detected total.
Nov 27 15:27:20 server kernel: md.c: sizeof(mdp_super_t) = 4096
Nov 27 15:27:21 server kernel: Partition check:
Nov 27 15:27:21 server kernel: hda: hda1 hda2 < hda5 hda6 > hda3 hda4
Nov 27 15:27:21 server kernel: hdc: hdc1
Nov 27 15:27:21 server kernel: autodetecting RAID arrays
Nov 27 15:27:21 server kernel: autorun ...
Nov 27 15:27:21 server kernel: ... autorun DONE.
Nov 27 15:27:21 server kernel: VFS: Mounted root (ext2 filesystem) readonly.
Nov 27 15:27:21 server kernel: Freeing unused kernel memory: 64k freed
Nov 27 15:27:22 server kernel: Adding Swap: 131532k swap-space (priority -1)
Nov 27 15:27:22 server kernel: Cobalt Networks Bandwidth Limiting Module
Nov 27 15:27:22 server kernel: Copyright (c) 1999, Cobalt Networks, Inc.
Nov 27 15:27:22 server kernel: All rights reserved
Nov 27 15:27:22 server kernel: eth0: Invalid EEPROM checksum 0x25fd, check settings before activating this device!
Nov 27 15:27:22 server kernel: eth0: Intel PCI EtherExpress Pro100 82559ER, 00:10:E0:05:1D:10, I/O at 0x6200, IRQ 11.
Nov 27 15:27:22 server kernel: Board assembly 000000-000, Physical connectors present:
Nov 27 15:27:22 server kernel: Primary interface chip None PHY #0.
Nov 27 15:27:23 server kernel: General self-test: passed.
Nov 27 15:27:23 server kernel: Serial sub-system self-test: passed.
Nov 27 15:27:23 server kernel: Internal registers self-test: passed.
Nov 27 15:27:23 server kernel: ROM checksum self-test: passed (0xdbd8681d).
Nov 27 15:27:23 server kernel: Receiver lock-up workaround activated.
Nov 27 15:27:23 server kernel: eth1: Invalid EEPROM checksum 0x24fd, check settings before activating this device!
Nov 27 15:27:23 server kernel: eth1: Intel PCI EtherExpress Pro100 82559ER, 00:10:E0:05:1D:0F, I/O at 0x6240, IRQ 10.
Nov 27 15:27:23 server kernel: Board assembly 000000-000, Physical connectors present:
Nov 27 15:27:24 server kernel: Primary interface chip None PHY #0.
Nov 27 15:27:24 server kernel: General self-test: passed.
Nov 27 15:27:24 server kernel: Serial sub-system self-test: passed.
Nov 27 15:27:24 server kernel: Internal registers self-test: passed.
Nov 27 15:27:24 server kernel: ROM checksum self-test: passed (0xdbd8681d).
Nov 27 15:27:24 server kernel: Receiver lock-up workaround activated.
Nov 27 15:27:24 server kernel: portmap: RPC call returned error 111
Nov 27 15:27:25 server kernel: RPC: task of released request still queued!
Nov 27 15:27:25 server kernel: RPC: (task is on xprt_pending)
Nov 27 15:27:25 server kernel: portmap: RPC call returned error 111
Nov 27 15:27:25 server kernel: RPC: task of released request still queued!
Nov 27 15:27:25 server kernel: RPC: (task is on xprt_pending)
Nov 27 15:27:25 server kernel: lockd_up: makesock failed, error=-111
Nov 27 15:27:25 server kernel: portmap: RPC call returned error 111
Nov 27 15:27:25 server kernel: RPC: task of released request still queued!
Nov 27 15:27:26 server kernel: RPC: (task is on xprt_pending)
Nov 27 15:54:21 server kernel: swap_duplicate at c0119ce5: entry 00040000, unused page
Nov 27 15:54:21 server kernel: swap_free: swap-space map bad (entry 00040000)
Nov 27 15:56:58 server kernel: swap_duplicate at c0119ce5: entry 00040000, unused page
Nov 27 15:56:58 server kernel: swap_free: swap-space map bad (entry 00040000)
Nov 27 16:02:02 server kernel: swap_duplicate at c0119ce5: entry 00040000, unused page
Nov 27 16:02:02 server kernel: swap_free: swap-space map bad (entry 00040000)
Nov 27 16:05:56 server kernel: swap_duplicate at c0119ce5: entry 00040000, unused page
Nov 27 16:05:56 server kernel: swap_free: swap-space map bad

[shortfork]

Originally posted by wewe
That is the /var/log/kernel before the server crashes

kindly..... advice is ther any resson to crashes the server ?


Nov 27 00:12:42 server kernel: possible SYN flooding on port 80. Sending cookies.
<snip>

here the server ofline.

kindly advice........

I read your original message on the RS message board but never saw this one posted there..

If you haven't posted it there, you probably should or send the info in a trouble ticket.. RS is in flux at the moment due to the move to the data center.. I belive syn floods should be filtered by RS before they get to you and perhaps the door got opened by accident.. you should let them know this information..

Shortness

[wewe]

I belive syn floods should be filtered by RS before they get to you and perhaps the door got opened by accident..

Kindly....What That mean?

[shortfork]

go to google.com and do a search on syn flood

Shortness

[gertiebeth]

Originally posted by shortfork
go to google.com and do a search on syn flood

Shortness

Ack! I searched the forums for info and came up w/ this thread, but am having trouble finding specific Raq4i info w/ "SYN Flood" at goggle.com. Can someone kindly help me??

I am receiving kernel log files detailing SYN flooding messages on my Raq. Example:

Jan 4 14:32:44 www kernel: possible SYN flooding on port 80. Sending cookies.
Jan 4 14:34:45 www last message repeated 2 times
Jan 4 14:36:46 www last message repeated 2 times
Jan 4 14:37:48 www kernel: possible SYN flooding on port 80. Sending cookies.
Jan 4 14:39:49 www last message repeated 2 times
Jan 4 14:41:50 www last message repeated 2 times
Jan 4 14:42:51 www kernel: possible SYN flooding on port 80. Sending cookies.
Jan 4 14:44:52 www last message repeated 2 times
Jan 4 14:45:55 www kernel: possible SYN flooding on port 80. Sending cookies.
Jan 4 14:47:55 www last message repeated 2 times
Jan 4 14:49:56 www last message repeated 2 times
Jan 4 14:51:57 www last message repeated 2 times

This "SYN Flood" is causing my RaQ to crash. It seems a search engine submission company has added a cgi script of mine to their auto-submission script. The CGI script has been deleted, but I am still having the SYN flooding problems and the auto-submissions are causing my log files to grow at an astonomical rate. I literally have to telnet in everyday to manually remove the large log files.

After searching the forums, it seems I may need to install a firewall, but don't want to take any action until I hear from support. (Tech help at my hosting company has relpyed w/ "A firewall will simply stop the packets from returning to their host, it will not stop your system from receiving them." only.)


Any help would be greatly appreciated!!

[shortfork]

Originally posted by gertiebeth
After searching the forums, it seems I may need to install a firewall, but don't want to take any action until I hear from support. (Tech help at my hosting company has relpyed w/ "A firewall will simply stop the packets from returning to their host, it will not stop your system from receiving them." only.)

Your system will still get the packets, but they will get no farther than the firewall and then be sent back into space. If you set the rules for the particular port you are trying to block with no logging, then you should be able to relieve some of the load.

No matter though on the above, you should have a firewall no matter what any other reasons are, just for general security purposes.

Shortness