Re: [gentoo-user] Approx monthly hard lockups

[Mark Knecht]

On Thu, May 13, 2021 at 12:20 AM Walter Dnes <waltdnes@××××××××.org> wrote:
>
> On Wed, May 12, 2021 at 09:50:29PM -0500, Dale wrote
> > Walter Dnes wrote:
> > > On Wed, May 12, 2021 at 11:16:56AM -0700, Mark Knecht wrote
> > >> Is there nothing in the system logs? What's near the end before
whatever
> > >> you get from booting after this issue?
> > >   Where would those logfiles be?  "dmesg" starts off with...
> > >
> >
> >
> > Most likely in /var/log/messages. The bad thing about dmesg, I think it
> > resets when rebooting which erases previous info.
> >
> > As Mark pointed out, you need to go back to the time before it starts
> > adding the boot up process.
>
>   No help.  /var/log/messages goes straight from iptables messages to
> bootup with no indication of shutdown...
>
> May 12 11:26:31 i3 kernel: FECESBOOK:IN= OUT=eth0 SRC=192.168.1.249
DST=31.13.80.12 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=5824 DF PROTO=TCP
SPT=50566 DPT=443 WINDOW=64170 RES=0x00 SYN URGP=0
> May 12 11:26:32 i3 kernel: FECESBOOK:IN= OUT=eth0 SRC=192.168.1.249
DST=31.13.80.12 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=60152 DF PROTO=TCP
SPT=50568 DPT=443 WINDOW=64170 RES=0x00 SYN URGP=0
> May 12 11:34:04 i3 syslog-ng[1384]: syslog-ng starting up;
version='3.30.1'
> May 12 11:34:04 i3 crond[1414]: /usr/sbin/crond 4.5 dillon's cron daemon,
started with loglevel notice
> May 12 11:34:04 i3 /usr/sbin/gpm[1443]: *** info [daemon/startup.c(136)]:
> May 12 11:34:04 i3 /usr/sbin/gpm[1443]: Started gpm successfully. Entered
daemon mode.
>
>   When doing a regular shutdown I get stuff like...
>
> May 12 11:42:31 i3 shutdown[1974]: shutting down for system reboot
> May 12 11:42:31 i3 init[1]: Switching to runlevel: 6
> May 12 11:42:32 i3 init[1]: Trying to re-exec init
> May 12 11:42:32 i3 start-stop-daemon[2053]: Will stop /usr/sbin/sshd
> May 12 11:42:32 i3 start-stop-daemon[2053]: Will stop PID 1764
> May 12 11:42:32 i3 start-stop-daemon[2053]: Sending signal 15 to PID 1764
> May 12 11:42:32 i3 sshd[1764]: Received signal 15; terminating.
>

OK, but those messages are yesterday, May 12th, at 11:42 in the morning.
Being that you started this thread on May 12th at 9:35 (when I received the
first email anyway) the actual lockup presumably occurred earlier.

I believe you're in the correct file, or set of files. Depending on how
your logging works (what logger, what options) generally the logs roll over
into successive files. (*.1, *.2, *.3, etc) Assuming you have some idea
when the lockup occurred you want to look for what was going on just before
that. Do the logs hit a date/time and stop? Or do they go on logging with
lots of similar or repeating messages for hours or days?

Do double check that you log into a directory that doesn't run out of space
once a month. That could cause problems also.

HTH,
MArk