Hi Anomie,
/var/log/messages never shows anything out of the ordinary (at least from what I can see). We used to have the server under maintenance contract with a specialist company (who originally also supplied and configured it), but they were also stumped.
Here's three examples (containing five entries from /var/log/messages and /var/log/syslog preceding each crash (ie: restart)):
var/log/syslog
Jun 8 10:00:10 mail postfix/local[20819]: 0704279C23F: to=<rodmaden@hayley-group.co.uk>, orig_to=<rod.maden@hayley-group.co.uk>, relay=local, delay=4, statu
s=sent (delivered to command: /usr/bin/procmail)
Jun 8 10:00:10 mail postfix/qmgr[3306]: 0704279C23F: removed
Jun 8 10:00:10 mail ipop3d[22591]: Logout user=carlbosley2 host=jonest.hayley-group.co.uk [10.11.24.108] nmsgs=0 ndele=0
Jun 8 10:00:10 mail postfix/qmgr[3306]: B213179C27B: from=<colin.jarvis@hayley-group.co.uk>, size=26882, nrcpt=1 (queue active)
Jun 8 10:00:10 mail postfix/smtpd[20177]: disconnect from unknown[10.11.254.8]
Jun 8 10:10:01 mail syslogd 1.4.1: restart.
Jun 8 14:14:21 mail postfix/smtpd[25050]: 0ECA379C289: client=unknown[10.11.254.8]
Jun 8 14:14:21 mail postfix/cleanup[21957]: 0ECA379C289: message-id=<4A2D0DED00004E590001.kayleigh.ilic@hayley-group.co.uk>
Jun 8 14:14:21 mail postfix/qmgr[3289]: 0ECA379C289: from=<kayleigh.ilic@hayley-group.co.uk>, size=24918, nrcpt=1 (queue active)
Jun 8 14:14:21 mail postfix/smtpd[25050]: disconnect from unknown[10.11.254.8]
Jun 8 14:14:21 mail postfix/smtpd[25051]: connect from unknown[10.11.254.8]
Jun 8 14:27:33 mail syslogd 1.4.1: restart.
Jun 9 09:56:53 mail ipop3d[26305]: Logout user=jarrodb host=barwoodj.hayley-group.co.uk [10.11.22.149] nmsgs=0 ndele=0
Jun 9 09:56:53 mail ipop3d[26306]: pop3 service init from 10.11.12.106
Jun 9 09:56:53 mail postfix/cleanup[25338]: 7258C79C2AA: message-id=<20090609085801.DB1483A00FB@mail.georgelodge.co.uk>
Jun 9 09:56:53 mail ipop3d[26306]: Login user=sophie host=nicols.hayley-group.co.uk [10.11.12.106] nmsgs=0/0
Jun 9 09:56:53 mail ipop3d[26306]: Logout user=sophie host=nicols.hayley-group.co.uk [10.11.12.106] nmsgs=0 ndele=0
Jun 9 10:13:13 mail syslogd 1.4.1: restart.
/var/log/message
Jun 8 09:50:00 mail CROND[21991]: (mail) CMD (/usr/bin/python -S /usr/lib/mailman/cron/gate_news)
Jun 8 09:55:00 mail CROND[22278]: (mail) CMD (/usr/bin/python -S /usr/lib/mailman/cron/gate_news)
Jun 8 10:00:00 mail CROND[22619]: (mail) CMD (/usr/bin/python -S /usr/lib/mailman/cron/gate_news)
Jun 8 10:00:00 mail CROND[22621]: (root) CMD (/bin/backup >/dev/null 2>&1)
Jun 8 10:00:01 mail kernel: end_request: I/O error, dev fd0, sector 0
Jun 8 10:10:01 mail syslogd 1.4.1: restart.
Jun 8 14:12:58 mail sudo: apache : TTY=unknown ; PWD=/u/admin ; USER=root ; COMMAND=/etc/sysconfig/oglfw/global changeuser steveams 100 Steve Crossley
Jun 8 14:12:58 mail sudo: apache : TTY=unknown ; PWD=/u/admin ; USER=root ; COMMAND=/etc/sysconfig/oglfw/installaliases
Jun 8 14:13:14 mail sudo: apache : TTY=unknown ; PWD=/u/admin ; USER=root ; COMMAND=/etc/sysconfig/oglfw/global changeuser steveams 100 Steve Crossley
Jun 8 14:13:14 mail sudo: apache : TTY=unknown ; PWD=/u/admin ; USER=root ; COMMAND=/etc/sysconfig/oglfw/global pwdset steveams BANGBANG1BANGBANGsGSAQ1zZB
ANGBANGxa8uAYfJD3X6VJu9ekEVX1
Jun 8 14:13:14 mail sudo: apache : TTY=unknown ; PWD=/u/admin ; USER=root ; COMMAND=/etc/sysconfig/oglfw/installaliases
Jun 8 14:27:33 mail syslogd 1.4.1: restart.
Jun 9 09:35:00 mail CROND[23903]: (mail) CMD (/usr/bin/python -S /usr/lib/mailman/cron/gate_news)
Jun 9 09:40:00 mail CROND[24783]: (mail) CMD (/usr/bin/python -S /usr/lib/mailman/cron/gate_news)
Jun 9 09:45:00 mail CROND[25553]: (mail) CMD (/usr/bin/python -S /usr/lib/mailman/cron/gate_news)
Jun 9 09:50:00 mail CROND[25879]: (mail) CMD (/usr/bin/python -S /usr/lib/mailman/cron/gate_news)
Jun 9 09:55:00 mail CROND[26180]: (mail) CMD (/usr/bin/python -S /usr/lib/mailman/cron/gate_news)
Jun 9 10:13:13 mail syslogd 1.4.1: restart.
I can post some more upon request.
/usr/lib/mailman/cron/gate_news <-- I have no idea what this is, except that it seems to run from a separate cron file, every 5 minutes of the day.
Quote:
You might install the SMART utilities and run hard drive tests.
|
To be honest, I really wouldn't feel comfortable installing anything onto this server, for fear of cocking anything up further (while it's still our primary mail host).
Quote:
Have you tested the RAM? If not, you can give that a go with memtest86+.
|
We haven't ran any RAM tests that I'm aware of (the maintenance company may have before my time). Though this would be awkward to perform as I can't afford to take the server down (I get plenty enough bitching from users when it crashes, voluntarily downtime would certainly not be well received!). It's certainly an option for when the new mail servers are live though.
Hi Xeta,
Pinging from my PC, or laptop or from colleagues' workstations also shows pings being returned (we always ping by IP). The second we switch off the server, the pings stop.
It's an interesting thought though, but restarting
always corrects the issue (this has been going on for about 12 months now). Evern if we are on site (working in the server room for instance), and manage to reboot the server immediately, it never fails to restart fine.
The mail server and firewall are on their own 10.11.3.0 subnet too. No-one would really need or want to assign a device to this subnet, and it would stick out if users were trying to do this for any reason.
Anyone have any other ideas?