UNIX for Dummies Questions & Answers

Yesterday evening my server appeared to fall over. I couldn't copy (scp) files to it, and I couldn't SSH to it either. Every time I tried, it just gave me this message:

Read from remote host <IP ADDRESS>: Connection reset by peer
Connection to <IP ADDRESS> closed.

I got in this morning, and unfortunately it hadn't fixed itself. I went down to the server room to try and use the console down there, but that wasn't responding, so I rebooted it.

This fixed the problem, and everything came back up, but I would like to know what happened to it. I've had a look in /var/log/secure and it isn't massively helpful - it shows the last activity before falling over as being on 30th August (which is correct) and then nothing until 9:10 this morning:

Sep 3 09:10:24 www sshd[2849]: Server listening on :: port 22.
Sep 3 09:10:24 www sshd[2849]: error: Bind to port 22 on 0.0.0.0 failed: Address already in use.

Which I guess is when I booted it. It hasn't recorded any failed attempts to connect to it.

Are there any logs that might show me what happened in between this period so that I can figure out what went wrong? I was thinking maybe some process logs or something?

Sorry for the lengthy post, wanted to give as much detail as possible. Thanks guys!

But you forgot the most important: What architecture/OS (and version would help)

Ah, yes. That was daft of me. Redhat Enterprise Linux 5.

uname -a gives:
Linux <SERVER ADDRESS> 2.6.18-8.el5 #1 SMP Fri Jan 26 14:15:21 EST 2007 i686 i686 i386 GNU/Linux

[EDIT] Oh, And if it helps, cat /proc/version gives
Linux version 2.6.18-8.el5 (brewbuilder@ls20-bc2-14.build.redhat.com) (gcc version 4.1.1 20070105 (Red Hat 4.1.1-52)) #1 SMP Fri Jan
26 14:15:21 EST 2007

Thanks

You could try /var/log/messages. Also, if sar is configured on your server you could check that to see if resources ran low and caused the hang/crash. If it isn't configured you may want to set that up in case it crashes again. Finally, checking "last" should tell you who was logged in at the time it failed if that gives any clues.

Thanks for your help rhfrommn. I couldn't find anything useful in those locations, and sar isn't configured, but I'll look up how to do it for next time. I've also turned the reporting on SSH up. It looks like I won't know what happend to it on this occasion, but if it happens again I should be able to find out what is going on.