[tech] [ucc] Minutes of Meeting 4th September 2009

Matt Johnston matt at ucc.asn.au
Sat Sep 5 23:52:33 WST 2009


On Fri, Sep 04, 2009 at 09:11:45PM +0800, James Andrewartha wrote:
> On Fri, 4 Sep 2009, Rufus Garton Smith wrote:
> 
> > Machine Technical Reports
> > -------------------------
> > Servers:
> > - madako, the core router, went down on Monday, which broke the network.
> > - Login is being slow, including ssh login.
> 
> bind had died on mooneye - I restarted it and things seem better.

Sorry, I've been stracing most processes [1] on mooneye for
a couple of days to try and figure which rogue process had
been chmodding /dev/null to 600. That's happened a few times
lately - really irritating, I suspect something's following
a symlink to /dev/null.  Haven't caught it though, damn
heisenbugs - I've stopped it now.

Cheers,
Matt

[1]
strace -f -F -e execve,chmod -p `ps aux|grep root|grep -v sshd|grep -v '\['|grep -v bash|grep -v su|grep -v getty|cut -c 5-16|xargs | sed 's/ +/ /g;s/ / -p /g'`


More information about the tech mailing list