From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from lists.gentoo.org ([140.105.134.102] helo=robin.gentoo.org) by nuthatch.gentoo.org with esmtp (Exim 4.43) id 1EIVM9-000678-BH for garchives@archives.gentoo.org; Thu, 22 Sep 2005 17:59:37 +0000 Received: from robin.gentoo.org (localhost [127.0.0.1]) by robin.gentoo.org (8.13.5/8.13.5) with SMTP id j8MHpTiM006467; Thu, 22 Sep 2005 17:51:29 GMT Received: from core1.needhosting.net (core1.needhosting.net [65.254.55.226]) by robin.gentoo.org (8.13.5/8.13.5) with ESMTP id j8MHpSvS032695 for ; Thu, 22 Sep 2005 17:51:29 GMT Received: from [69.212.231.242] (helo=[192.168.1.2] ident=mVPdhjrWNU0) by core1.needhosting.net with esmtpsa (TLSv1:AES256-SHA:256) (Exim 4.52) id 1EIVKD-0001ae-K5 for gentoo-server@lists.gentoo.org; Thu, 22 Sep 2005 13:57:37 -0400 Message-ID: <4332F08D.7000804@fire-eyes.org> Date: Thu, 22 Sep 2005 13:57:33 -0400 From: fire-eyes User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.11) Gecko/20050913 X-Accept-Language: en-us, en Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-server@gentoo.org Reply-to: gentoo-server@lists.gentoo.org MIME-Version: 1.0 To: gentoo-server@lists.gentoo.org Subject: Re: [gentoo-server] Server goes down twice in two days, looking for input References: <4332C0DE.5060503@fire-eyes.org> <200509221201.41080.robert@sixthings.com> In-Reply-To: <200509221201.41080.robert@sixthings.com> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - core1.needhosting.net X-AntiAbuse: Original Domain - lists.gentoo.org X-AntiAbuse: Originator/Caller UID/GID - [0 0] / [47 12] X-AntiAbuse: Sender Address Domain - fire-eyes.org X-Source: X-Source-Args: X-Source-Dir: X-Archives-Salt: c3c74e4f-64d8-4231-9bc8-0549c58b9041 X-Archives-Hash: 86455dde178ada5c4ad42b061168c01d Robert Larson wrote: > This may be a long shot, but is it possible the BIOS battery is dying or is > already dead? Hadn't thought of that, I'll check it. > Also, another thing worth checking and the main reason I respond is, have you > considered the possibility of an intrusion? I have seen things gone awry > before with the addition of a kernel rootkit, and it might be worth looking > into just in case. Probably not the case, but, better safe than sorry. Yes, I considered that. I have seen no signs of such activity. Of course, that doesn't mean it hasn't happened. > Of course, there are some portage pkgs: > app-forensics/rkhunter > app-forensics/chkrootkit I use those :) They are nice tools. Thanks for the reply! -- gentoo-server@gentoo.org mailing list