Image

Imagejackal wrote in Imagelinux

The Cause of the crash.

So I'm home now and I can see what exactly happened to my host to cause it to crash.



Mar 31 06:43:40 jackal sshd(pam_unix)[1868]: session closed for user jackal
Mar 31 21:54:02 jackal sshd(pam_unix)[2788]: check pass; user unknown
Mar 31 21:54:02 jackal sshd(pam_unix)[2788]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=cimco.propagation.net
Mar 31 21:54:05 jackal sshd(pam_unix)[2791]: check pass; user unknown
Mar 31 21:54:05 jackal sshd(pam_unix)[2791]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=cimco.propagation.net
Mar 31 21:54:08 jackal sshd(pam_unix)[2793]: check pass; user unknown
Mar 31 21:54:08 jackal sshd(pam_unix)[2793]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=cimco.propagation.net
Mar 31 21:54:11 jackal sshd(pam_unix)[2795]: check pass; user unknown
Mar 31 21:54:11 jackal sshd(pam_unix)[2795]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=cimco.propagation.net
Mar 31 21:54:14 jackal sshd(pam_unix)[2797]: check pass; user unknown
Mar 31 21:54:14 jackal sshd(pam_unix)[2797]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=cimco.propagation.net
Mar 31 21:54:17 jackal sshd(pam_unix)[2799]: check pass; user unknown
Mar 31 21:54:17 jackal sshd(pam_unix)[2799]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=cimco.propagation.net
Mar 31 21:54:20 jackal sshd(pam_unix)[2802]: check pass; user unknown
Mar 31 21:54:20 jackal sshd(pam_unix)[2802]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=cimco.propagation.net
Mar 31 21:54:23 jackal sshd(pam_unix)[2804]: check pass; user unknown
Mar 31 21:54:23 jackal sshd(pam_unix)[2804]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=cimco.propagation.net
Mar 31 21:54:26 jackal sshd(pam_unix)[2806]: check pass; user unknown
Mar 31 21:54:26 jackal sshd(pam_unix)[2806]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=cimco.propagation.net
Mar 31 21:54:32 jackal sshd(pam_unix)[2808]: check pass; user unknown
Mar 31 21:54:32 jackal sshd(pam_unix)[2808]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=cimco.propagation.net
Mar 31 21:54:35 jackal sshd(pam_unix)[2810]: check pass; user unknown
Mar 31 21:54:35 jackal sshd(pam_unix)[2810]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=cimco.propagation.net
Mar 31 21:54:38 jackal sshd(pam_unix)[2813]: check pass; user unknown
Mar 31 21:54:38 jackal sshd(pam_unix)[2813]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=cimco.propagation.net
Mar 31 21:54:41 jackal sshd(pam_unix)[2815]: check pass; user unknown
Mar 31 21:54:41 jackal sshd(pam_unix)[2815]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=cimco.propagation.net
Mar 31 21:54:44 jackal sshd(pam_unix)[2817]: check pass; user unknown
Mar 31 21:54:44 jackal sshd(pam_unix)[2817]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=cimco.propagation.net
Mar 31 21:54:47 jackal sshd(pam_unix)[2819]: check pass; user unknown
Mar 31 21:54:47 jackal sshd(pam_unix)[2819]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=cimco.propagation.net
Mar 31 21:54:50 jackal sshd(pam_unix)[2821]: check pass; user unknown
Mar 31 21:54:50 jackal sshd(pam_unix)[2821]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=cimco.propagation.net
Mar 31 21:54:53 jackal sshd(pam_unix)[2823]: check pass; user unknown
Mar 31 21:54:53 jackal sshd(pam_unix)[2823]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=cimco.propagation.net
Mar 31 21:54:56 jackal sshd(pam_unix)[2825]: check pass; user unknown
Mar 31 21:54:56 jackal sshd(pam_unix)[2825]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=cimco.propagation.net
Mar 31 21:55:04 jackal sshd(pam_unix)[2827]: check pass; user unknown
Mar 31 21:55:04 jackal sshd(pam_unix)[2827]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=cimco.propagation.net
Mar 31 21:55:07 jackal sshd(pam_unix)[2829]: check pass; user unknown
Mar 31 21:55:07 jackal sshd(pam_unix)[2829]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=cimco.propagation.net
Mar 31 21:55:10 jackal sshd(pam_unix)[2832]: check pass; user unknown
Mar 31 21:55:10 jackal sshd(pam_unix)[2832]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=cimco.propagation.net
Mar 31 21:55:13 jackal sshd(pam_unix)[2834]: check pass; user unknown
Mar 31 21:55:13 jackal sshd(pam_unix)[2834]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=cimco.propagation.net
Mar 31 21:55:16 jackal sshd(pam_unix)[2836]: check pass; user unknown
Mar 31 21:55:16 jackal sshd(pam_unix)[2836]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=cimco.propagation.net
Mar 31 21:55:19 jackal sshd(pam_unix)[2838]: check pass; user unknown
Mar 31 21:55:19 jackal sshd(pam_unix)[2838]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=cimco.propagation.net
Mar 31 21:55:25 jackal sshd(pam_unix)[2841]: check pass; user unknown
Mar 31 21:55:25 jackal sshd(pam_unix)[2841]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=cimco.propagation.net
Mar 31 21:55:32 jackal sshd(pam_unix)[2843]: check pass; user unknown
Mar 31 21:55:32 jackal sshd(pam_unix)[2843]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=cimco.propagation.net
Mar 31 21:55:38 jackal sshd(pam_unix)[2845]: check pass; user unknown
Mar 31 21:55:38 jackal sshd(pam_unix)[2845]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=cimco.propagation.net
Mar 31 21:55:41 jackal sshd(pam_unix)[2847]: check pass; user unknown
Mar 31 21:55:41 jackal sshd(pam_unix)[2847]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=cimco.propagation.net
Mar 31 21:55:44 jackal sshd(pam_unix)[2849]: check pass; user unknown
Mar 31 21:55:44 jackal sshd(pam_unix)[2849]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=cimco.propagation.net
Mar 31 21:55:47 jackal sshd(pam_unix)[2852]: check pass; user unknown
Mar 31 21:55:47 jackal sshd(pam_unix)[2852]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=cimco.propagation.net
Mar 31 21:55:50 jackal sshd(pam_unix)[2854]: check pass; user unknown
Mar 31 21:55:50 jackal sshd(pam_unix)[2854]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=cimco.propagation.net
Mar 31 21:55:53 jackal sshd(pam_unix)[2856]: check pass; user unknown
Mar 31 21:55:53 jackal sshd(pam_unix)[2856]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=cimco.propagation.net
Mar 31 21:55:56 jackal sshd(pam_unix)[2858]: check pass; user unknown
Mar 31 21:55:56 jackal sshd(pam_unix)[2858]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=cimco.propagation.net
Mar 31 21:55:59 jackal sshd(pam_unix)[2860]: check pass; user unknown
Mar 31 21:55:59 jackal sshd(pam_unix)[2860]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=cimco.propagation.net
Mar 31 21:56:05 jackal sshd(pam_unix)[2862]: check pass; user unknown
Mar 31 21:56:05 jackal sshd(pam_unix)[2862]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=cimco.propagation.net
Mar 31 21:56:08 jackal sshd(pam_unix)[2865]: check pass; user unknown
Mar 31 21:56:08 jackal sshd(pam_unix)[2865]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=cimco.propagation.net
Mar 31 21:56:11 jackal sshd(pam_unix)[2867]: check pass; user unknown
Mar 31 21:56:11 jackal sshd(pam_unix)[2867]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=cimco.propagation.net
Mar 31 21:56:17 jackal sshd(pam_unix)[2869]: check pass; user unknown
Mar 31 21:56:17 jackal sshd(pam_unix)[2869]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=cimco.propagation.net
Mar 31 21:56:20 jackal sshd(pam_unix)[2871]: check pass; user unknown
Mar 31 21:56:20 jackal sshd(pam_unix)[2871]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=cimco.propagation.net
Mar 31 21:56:32 jackal sshd(pam_unix)[2873]: check pass; user unknown
Mar 31 21:56:32 jackal sshd(pam_unix)[2873]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=cimco.propagation.net



Followed by:


Apr 1 03:43:38 jackal kernel: IPTABLES:6:IN=eth0 OUT= MAC=00:50:ba:cf:84:70:00:50:57:01:40:72:08:00 SRC=54.68.21.203 DST=70.174.162.210 LEN=554 TOS=0x00 PREC=0x00 TTL=46 ID=38747 PROTO=UDP SPT=50244 DPT=1025 LEN=534
Apr 1 03:52:50 jackal kernel: IPTABLES:6:IN=eth0 OUT= MAC=00:50:ba:cf:84:70:00:50:57:01:40:72:08:00 SRC=61.152.160.117 DST=70.174.162.210 LEN=40 TOS=0x00 PREC=0x00 TTL=94 ID=256 PROTO=TCP SPT=6000 DPT=7212 WINDOW=16384 RES=0x00 SYN URGP=0
Apr 1 04:01:01 jackal crond(pam_unix)[2925]: session opened for user root by (uid=0)
Apr 1 04:01:01 jackal crond(pam_unix)[2925]: session closed for user root
Apr 1 04:02:01 jackal crond(pam_unix)[2927]: session opened for user root by (uid=0)
Apr 1 04:02:21 jackal kernel: Unable to handle kernel NULL pointer dereference at virtual address 00000001
Apr 1 04:02:21 jackal kernel: printing eip:
Apr 1 04:02:21 jackal kernel: c0150864
Apr 1 04:02:21 jackal kernel: *pde = 00000000
Apr 1 04:02:21 jackal kernel: Oops: 0000 [#2]
Apr 1 04:02:21 jackal kernel: Modules linked in: ipt_MASQUERADE iptable_nat ipt_REJECT ipt_state ip_conntrack ipt_LOG iptable_filter iptable_mangle ip_tables md5 ipv6 parport_pc lp parport autofs4 i2c_dev i2c_core sunrpc dm_mod sd_mod sbp2 scsi_mod ohci1394 ieee1394 uhci_hcd pcnet32 via_rhine mii floppy ext3 jbd
Apr 1 04:02:21 jackal kernel: CPU: 0
Apr 1 04:02:21 jackal kernel: EIP: 0060:[] Not tainted VLI
Apr 1 04:02:21 jackal kernel: EFLAGS: 00010002 (2.6.12-1.1381_FC3)
Apr 1 04:02:21 jackal kernel: EIP is at find_get_page+0x11/0x24
Apr 1 04:02:21 jackal kernel: eax: 00000001 ebx: 00000130 ecx: 00000001 edx: 00000001
Apr 1 04:02:21 jackal kernel: esi: c104d180 edi: c5b03e78 ebp: 00000000 esp: c7b61dd0
Apr 1 04:02:21 jackal kernel: ds: 007b es: 007b ss: 0068
Apr 1 04:02:21 jackal kernel: Process http-analyze (pid: 3388, threadinfo=c7b61000 task=cf89f550)
Apr 1 04:02:21 jackal kernel: Stack: c0150c53 00001000 00000010 00000000 000080d2 00000020 00000120 0000011f
Apr 1 04:02:21 jackal kernel: 00000000 00000000 00000020 00000100 00000000 00000020 00001000 00000000
Apr 1 04:02:21 jackal kernel: 0015f19e 00000000 0000012e 00000130 00000130 00000000 0000015f 0000012f
Apr 1 04:02:21 jackal kernel: Call Trace:
Apr 1 04:02:21 jackal kernel: [] do_generic_mapping_read+0x1a4/0x6ce
Apr 1 04:02:21 jackal kernel: [] __generic_file_aio_read+0x18a/0x1f0
Apr 1 04:02:21 jackal kernel: [] file_read_actor+0x0/0xe3
Apr 1 04:02:21 jackal kernel: [] generic_file_aio_read+0x3e/0x4f
Apr 1 04:02:21 jackal kernel: [] do_sync_read+0xa1/0xf5
Apr 1 04:02:21 jackal kernel: [] autoremove_wake_function+0x0/0x37
Apr 1 04:02:21 jackal kernel: [] vfs_read+0xad/0x108
Apr 1 04:02:21 jackal kernel: [] sys_read+0x41/0x6a
Apr 1 04:02:21 jackal kernel: [] syscall_call+0x7/0xb
Apr 1 04:02:21 jackal kernel: Code: f2 b9 27 01 15 c0 c7 04 24 02 00 00 00 e8 de 34 21 00 83 c4 44 5b 5e 5f 5d c3 fa 83 c0 04 e8 88 63 0b 00 85 c0 89 c1 74 0c 89 c2 <8b> 00 f6 c4 80 75 07 ff 42 04 fb 89 c8 c3 8b 51 0c eb f4 fa 83
Apr 1 04:02:22 jackal cups: cupsd shutdown succeeded
Apr 1 04:02:24 jackal cups: cupsd startup succeeded
Apr 1 04:02:26 jackal nmbd[2943]: [2006/04/01 04:02:26, 0] nmbd/nmbd.c:process(542)