[KLUG Members] help with lockup problem on debian sarge

[Adam Tauno Williams]

> > > The last two days at different times (3am Sun and 6am Mon) my sarge
> > > email server has just gone unresponsive. No video, ssh, anything. For
> > > all purposes the machine is off, but it is still powered. I cannot seem
> > > to find any reason in the logs for it. All appears well and then nothing
> > > reported until a hard reboot. 
> > Do you have syslog marking enabled?  Do you see any messages after the
> > last mark?
> I have -- Mark -- items in /var/log/messages. There are messages in
> syslog after the last mark. For today the last mark was 6:06 and the
> last syslog item is 6:25.

Try increasing your mark frequency to once a minute until you have the
problem worked out.  Then you know if time elapsed after the last entry
before the frotz.

> There is an entry in the auth.log that occurs after the last syslog
> entry by 2 seconds that I'm not sure of:
> su[13716]: + ??? root:nobody
> su[13716]: (pam_unix) session opened for user nobody by (uid=0)
> This is the absolute last log item I have before things go boom. 
> Any clue what + ??? is?

No,  but it doesn't seem that strange.  Could be a cron job,  su-ing
from root to a less powerful user is a pretty common thing to do.
 
> > > I checked and saw that there were courier updates that fixed a potential
> > > DOS. 
> > > http://freshmeat.net/articles/view/1792/
> > > What I am wondering is how I can check to see if this was causing the
> > > problem I'm having. Could these packages I'm running for imap have been
> > > locking up the machine?
> > It seems terribly unlikely that a DOS attack against your IMAP server
> > would leave you without video or an operational console.
> > Sometimes a handy trick is to setup a dumb terminal on a serial port and
> > set the kernel to use that as a console.  Then the last kernel messages
> > are preserved for you to see even if the host flakes out (leaving you
> > with no video, etc...).  It is pretty simple if you have a spare Wyse or
> > VT100 around.  Otherwise just a PC with a terminal emulator will work.
> Any links for doing with this a PC? I don't have any terminals. Can I
> just run an open connection from a linux desktop nearby?

You should be able to use a linux PC and hook the two together with a
null modem cable and run minicom (a terminal emulator included in most
LINUX distros).  Then google for 'serial console howto'.  and it should
walk you through the steps.