Opened 6 years ago

Closed 6 years ago

#713 closed incident (fixed)

HybridVistorcentre 1&2 volle var

Reported by: mbreet Owned by:
Keywords: Leiden Cc:
Location: Generiek

Description

Volle vars bij visitorcentre 1&2

Change History (5)

comment:1 Changed 6 years ago by ed

HybridVisitorCentre1# df -h
Filesystem      Size    Used   Avail Capacity  Mounted on
/dev/ada0s1a    393M    316M     45M    87%    /
devfs           1.0k    1.0k      0B   100%    /dev
/dev/md0        4.3M    2.5M    1.5M    62%    /etc
/dev/md1        8.9M    8.6M   -388k   105%    /var
/dev/md2         19M    104k     17M     1%    /tmp

3.7M /var/log
3.9M /var/named/etc
4M /var/named

Sep 14 22:51:46 HybridVisitorCentre1 sshd[74365]: error: PAM: authentication error for root from 144.0.0.44
Sep 14 22:51:46 HybridVisitorCentre1 sshd[74352]: error: PAM: authentication error for root from 144.0.0.44
Sep 14 22:51:46 HybridVisitorCentre1 sshd[74368]: error: PAM: authentication error for root from 144.0.0.44
Sep 14 22:51:46 HybridVisitorCentre1 sshd[74361]: error: PAM: authentication error for root from 144.0.0.44
Sep 14 22:51:47 HybridVisitorCentre1 sshd[74373]: error: PAM: authentication error for root from 144.0.0.44

Veel SSH attacks in /var/log/messages.

comment:2 Changed 6 years ago by ed

## /Var/log/messages was ca 3Mb groot geworden deze leeg gemaakt.
# cd /var/log/
# sh /etc/rc.d/syslogd stop
# rm messages
# sh /etc/rc.d/syslogd start

Even in de gaten houden. Als dit terug komt moeten we iets doen tegen de vele SSH login attemps

comment:3 Changed 6 years ago by huub

Heeft Watertoren ook last van. Misschien ssh verhuizen (externe port forwarden)?

comment:4 Changed 6 years ago by ed

Lijkt op dit moment goed te gaan, gisteren nog een paar SSH attempts gezien maar verder is het er rustig.
We houden dit nog even in de gaten, anders inderdaad de SSH port verhuizen.

comment:5 Changed 6 years ago by huub

Resolution: fixed
Status: newclosed

Geen problemen meer gezien.

Note: See TracTickets for help on using tickets.