IRC log for #fredlug on 20070620

03:15.54*** join/#fredlug stickster_ (n=stickste@fedora/stickster)
13:28.42*** join/#fredlug jsmith (n=jsmith@000-191-745.area3.spcsdns.net)
14:30.09*** join/#fredlug jsmith (n=jsmith@000-191-745.area3.spcsdns.net)
15:23.52jsmithAnybody have a spare PCI-to-PCMCIA adapter?
15:27.26*** join/#fredlug plarsen_ (n=plarsen@208.176.91.240.ptr.us.xo.net)
18:54.05plarsen_workEhhh - stickster_work .. are you around
18:54.05plarsen_work?
18:54.19plarsen_workdarn selinux audit log needs to be interpreted  :(
18:54.54plarsen_workavc: denied { sendto } for pid=28144 comm="snmpd" name="log" scontext=system_u:system_r:snmpd_t tcontext=user_u_system_r_initrc_t tclass=unitx_dgram_socket
18:55.04plarsen_workwhat object is being referred to here?
18:57.03jsmithIt appears to be a unix socket
18:58.38plarsen_workuhmmm - that I reconned -- but I'm puzzled to where I configure/change the setup for this?
19:18.58jsmithDid you try setroubleshoot?
19:20.54plarsen_workcan't - there's no specific audit log. I'll try to have it talk to dmesg ;)
19:21.42plarsen_worknot there on RHES4 :(
19:23.01jsmithAh...
19:23.16jsmithYou'll have to ask stickster_work then
20:11.50stickster_workplarsen_work: still there?
20:12.21stickster_workplarsen_work: May want to install "audit" package and start the auditd service
20:12.37stickster_workThere is a performance hit of a percent or two, but it's worth it at least while t-shooting
20:13.57stickster_workI'm assuming you transcribed this message, not cut 'n' paste, right?
20:14.17jsmithWhat, did the "unitx" give it away?
20:14.25stickster_workAh, I just saw that
20:14.26stickster_work:-D
20:14.31stickster_workI was looking at the weird tcontext
20:16.26stickster_workCheck that context, is it really initrc_t or something else?
20:17.56stickster_workSo could it be that your snmpd is being forbidden from writing to the system log?
20:22.41stickster_workNah, that would be syslogd_t
20:33.29plarsen_workThat's what it writes :(
20:33.44plarsen_workI do have snmpd entries in /var/log/messages
20:34.00plarsen_workand /var/log/snmpd.log
20:39.27plarsen_workstickster_work: sorry, but RHES4 doesn't seem to provide any "audit" packages. I did a "whatprovides" on setroubleshoot and came up empty
21:30.58jsmithstickster_work: Ping me when you get a free minute, please
21:44.21stickster_workjsmith: ping
21:44.59jsmithstickster: So, after rebooting my colo box, I can't get vsftpd to work right.
21:45.09sticksterjsmith: Ugh, do tell
21:45.19jsmithstickster: Was wondering if you had any clues... I've beat my head against the wall to the point I can't think
21:45.45sticksterSymptoms? (Note I promise nothing, thanks to my track record)
21:45.53stickster:-D
21:47.23jsmithvsftpd accepts the socket connection, but then closes the connection as soon as you change directories or type 'ls'
21:47.35sticksterWhoa.
21:47.40jsmithYeah...
21:47.51jsmithWait 'til you see the output of the strace on the process
21:48.22jsmithPardon the flood...
21:48.24jsmith[root@www log]# ps axuw | grep vsftpd
21:48.25jsmithroot      7264  0.0  0.0 19548 1348 pts/0    S    15:25   0:00 /usr/sbin/vsftpd /etc/vsftpd/vsftpd.conf
21:48.25jsmithroot      7472  0.0  0.0 51072  676 pts/0    R+   15:27   0:00 grep vsftpd
21:48.25jsmith[root@www log]# strace -p 7264
21:48.25jsmithProcess 7264 attached - interrupt to quit
21:48.25jsmithaccept(3, {sa_family=AF_INET, sin_port=htons(32924), sin_addr=inet_addr("68.246.234.24")}, [18446744069414584336]) = 0
21:48.28jsmithrt_sigprocmask(SIG_BLOCK, [CHLD], NULL, 8) = 0
21:48.30jsmithrt_sigprocmask(SIG_BLOCK, [HUP], NULL, 8) = 0
21:48.32jsmithclone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x2a96926c50) = 7553
21:48.35jsmithclose(0)                                = 0
21:48.37jsmithrt_sigprocmask(SIG_UNBLOCK, [CHLD], NULL, 8) = 0
21:48.41jsmithrt_sigprocmask(SIG_UNBLOCK, [HUP], NULL, 8) = 0
21:48.43jsmithaccept(3, 0x7fbffffa80, [18446744069414584348]) = ? ERESTARTSYS (To be restarted)
21:48.45jsmith--- SIGCHLD (Child exited) @ 0 (0) ---
21:48.47jsmithwait4(-1, NULL, WNOHANG, NULL)          = 7553
21:48.49jsmithwait4(-1, NULL, WNOHANG, NULL)          = -1 ECHILD (No child processes)
21:48.51jsmithrt_sigreturn(0xffffffffffffffff)        = -1 EINTR (Interrupted system call)
21:48.53jsmithrt_sigprocmask(SIG_BLOCK, [CHLD], NULL, 8) = 0
21:48.55jsmithrt_sigprocmask(SIG_BLOCK, [HUP], NULL, 8) = 0
21:48.57jsmithrt_sigprocmask(SIG_UNBLOCK, [CHLD], NULL, 8) = 0
21:48.59jsmithrt_sigprocmask(SIG_UNBLOCK, [HUP], NULL, 8) = 0
21:49.01jsmithaccept(3, {sa_family=AF_INET, sin_port=htons(32920), sin_addr=inet_addr("68.246.234.24")}, [18446744069414584336]) = 0
21:49.04jsmithrt_sigprocmask(SIG_BLOCK, [CHLD], NULL, 8) = 0
21:49.06jsmithrt_sigprocmask(SIG_BLOCK, [HUP], NULL, 8) = 0
21:49.10jsmithclone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x2a96926c50) = 7559
21:49.13jsmithclose(0)                                = 0
21:49.15jsmithrt_sigprocmask(SIG_UNBLOCK, [CHLD], NULL, 8) = 0
21:49.17jsmithrt_sigprocmask(SIG_UNBLOCK, [HUP], NULL, 8) = 0
21:49.19jsmithaccept(3, 0x7fbffffa80, [18446744069414584348]) = ? ERESTARTSYS (To be restarted)
21:49.21jsmith--- SIGCHLD (Child exited) @ 0 (0) ---
21:49.23jsmithwait4(-1, NULL, WNOHANG, NULL)          = 7559
21:49.25jsmithwait4(-1, NULL, WNOHANG, NULL)          = -1 ECHILD (No child processes)
21:49.27jsmithrt_sigreturn(0xffffffffffffffff)        = -1 EINTR (Interrupted system call)
21:49.29jsmithrt_sig
21:50.06sticksterjsmith: Can you give me a normal user account there that I can try?
21:50.20jsmithNo... but I can give you root access :-)
21:50.27jsmithActually, I may have found the problem...
21:50.36jsmith/var/log/messages is filling up with SCSI errors
21:50.37jsmith:-(
21:50.41sticksterOh my gosh.
21:50.46sticksterThat's not good.
21:51.05sticksterWell, now you know why the box was up and dying on you
21:51.11plarsen_workouch!
21:51.12jsmithNope... wanna poke around on it?
21:51.18stickstersure
21:51.36sticksterHow shall we do this?  Shall I send you my SSH pubkey?
21:51.45jsmith[root@www log]# cat /proc/mdstat
21:51.45jsmithPersonalities : [raid0] [raid1]
21:51.45jsmithmd1 : active raid1 hdb2[1] hda2[0]
21:51.45jsmith<PROTECTED>
21:51.45jsmith<PROTECTED>
21:51.46jsmithmd2 : active raid1 hdb3[1] hda3[0]
21:51.48jsmith<PROTECTED>
21:51.50jsmith<PROTECTED>
21:51.52jsmithmd3 : active raid0 hdb5[1] hda5[0]
21:51.54jsmith<PROTECTED>
21:51.56jsmith<PROTECTED>
21:51.58jsmithmd0 : active raid1 hdb1[1] hda1[0]
21:52.00jsmith<PROTECTED>
21:52.02jsmithstickster: Sure!
21:52.06jsmithHmmmn... mdstat looks better than it did last week
21:52.12sticksterYeah, not so hairy there
21:52.59sticksterOK, pubkey bombs away
21:58.02sticksterjsmith: Just let me know where/when.
21:58.33jsmithstickster: Now, root@www.jaredsmith.net
22:01.27sticksterjsmith: Yeah, weird... so um... what was /dev/sda?
22:02.13jsmithOh... let's see...
22:02.15jsmithUh...
22:02.20jsmithYuck...
22:02.27stickster'cause I see only IDE devices now!
22:02.29jsmithThat was the RAID array for a friend of mine
22:02.33sticksterAhh
22:02.34jsmithHis website, etc.
22:02.43jsmithOne of the drives failed last week
22:02.51jsmithLooks like the other must have died today :-(
22:03.11sticksterouch
22:03.42jsmithWell, for various definitions of "died"
22:03.49sticksterheh
22:04.58sticksterI'm making a normal user acct for me just for now
22:07.18plarsen_workjsmith: are you running smartd ?
22:07.32jsmithplarsen_work: Probably not
22:07.36jsmithstickster: That's cool...
22:07.51jsmithstickster: So, I'm not sure the SCSI problem would explain the FTP thing, if it were sda
22:07.58sticksterright
22:08.07sticksterYeah, problem persists for me
22:12.14sticksterjsmith: selinux=disabled! shame!
22:12.15stickster:-D
22:13.16jsmithstickster: Yes, I know... this server's had a long life
22:13.26jsmithstickster: Back from when I didn't know jack about selinux
22:19.55jsmithNo problem... be back in a few
23:04.58plarsen_workstickster: I think it would explain it .. when you issue a command it tries to log, and if there's a SCSI/IO error it'll kill the process = disconnect
23:06.33jsmithI'm not getting the SCSI/IO errors anymore, as the RAID array is totally dead now
23:43.31sticksterplarsen: Well, the sda drive isn't really being used by vsftpd, and since the problem persists, I'm guessing that ain't it ;-)

Generated by irclog2html.pl Modified by Tim Riker to work with infobot.