[NBLUG/talk] Servers rebooting every hour

Kyle Rankin kyle at nblug.org
Wed Feb 6 07:17:52 PST 2008


On Tue, Feb 05, 2008 at 10:43:57PM -0800, Bob Blick wrote:
> Troy Arnold wrote:
> 
> > Still, I'd put my beer on a script or a process that isn't behaving as
> > intended.  
> 
> Chances are good that's the type of problem it is.
> 
> > So, before you pull your hair out looking for that amazingly stealthy
> > rootkit, checkout the files in /var/spool/crontabs and/or shutdown
> > crond/atd... and hell, maybe even recursively grep the filesystem for
> > 'reboot'
> 
> Killing cron doesn't stop it. Besides, the 60:35 repeat sounds like 60
> minutes plus boot time.
> 
> -Bob
> 
> 

If anything, make an image of the machine and if you haven't done any
forensics analysis, after my talk next week you might be motivated to dig
deeper.

-- 
Kyle Rankin
NBLUG President
The North Bay Linux Users Group
http://nblug.org
IRC: greenfly at irc.freenode.net #nblug 
kyle at nblug.org



More information about the talk mailing list