[KLUG Members] help with lockup problem on debian sarge

[Richard Harding]

On Mon, 2005-08-29 at 11:07 -0400, Adam Tauno Williams wrote:
> > The last two days at different times (3am Sun and 6am Mon) my sarge
> > email server has just gone unresponsive. No video, ssh, anything. For
> > all purposes the machine is off, but it is still powered. I cannot seem
> > to find any reason in the logs for it. All appears well and then nothing
> > reported until a hard reboot. 
> 
> Do you have syslog marking enabled?  Do you see any messages after the
> last mark?
I have -- Mark -- items in /var/log/messages. There are messages in
syslog after the last mark. For today the last mark was 6:06 and the
last syslog item is 6:25.

There is an entry in the auth.log that occurs after the last syslog
entry by 2 seconds that I'm not sure of:
su[13716]: + ??? root:nobody
su[13716]: (pam_unix) session opened for user nobody by (uid=0)

This is the absolute last log item I have before things go boom. 

Any clue what + ??? is?

> 
> > I checked and saw that there were courier updates that fixed a potential
> > DOS. 
> > http://freshmeat.net/articles/view/1792/
> > What I am wondering is how I can check to see if this was causing the
> > problem I'm having. Could these packages I'm running for imap have been
> > locking up the machine?
> 
> It seems terribly unlikely that a DOS attack against your IMAP server
> would leave you without video or an operational console.
> 
> Sometimes a handy trick is to setup a dumb terminal on a serial port and
> set the kernel to use that as a console.  Then the last kernel messages
> are preserved for you to see even if the host flakes out (leaving you
> with no video, etc...).  It is pretty simple if you have a spare Wyse or
> VT100 around.  Otherwise just a PC with a terminal emulator will work.

Any links for doing with this a PC? I don't have any terminals. Can I
just run an open connection from a linux desktop nearby?

Thanks for the help. 

Rick