My server just stopped working a couple of minutes ago.  I can SSH but no :80 web interface, 8080 works.  I've rebooted to no avail.  Can somebody please look at the log and help?

 

Dmesg output found here: http://pastebin.com/Ta5QL7gk

 

I'm running 6 beta 14.

 

Thanks!

 

Geoff

Is someone attacking me?

 

TCP: request_sock_TCP: Possible SYN flooding on port 6891. Sending cookies.  Check SNMP counters.

mdcmd (82): spindown 0

mdcmd (83): spindown 1

mdcmd (84): spindown 2

UDP: bad checksum. From 131.221.255.221:1038 to 192.168.1.35:6891 ulen 111

mdcmd (85): spindown 2

mdcmd (86): spindown 1

mdcmd (87): spindown 2

mdcmd (88): spindown 0

mdcmd (89): spindown 2

mdcmd (90): spindown 1

UDP: bad checksum. From 2.103.156.39:60950 to 192.168.1.35:6891 ulen 1410

UDP: bad checksum. From 2.103.156.39:60950 to 192.168.1.35:6891 ulen 1410

UDP: bad checksum. From 2.103.156.39:60950 to 192.168.1.35:1034 ulen 1410

UDP: bad checksum. From 2.103.156.39:60950 to 192.168.1.35:1034 ulen 1410

UDP: bad checksum. From 2.103.156.39:60950 to 192.168.1.35:1034 ulen 28

mdcmd (91): spindown 2

mdcmd (92): spindown 1

mdcmd (93): spindown 2

mdcmd (94): spindown 1

mdcmd (95): spindown 1

INFO: rcu_sched self-detected stall on CPU { 0}  (t=6000 jiffies g=8598756 c=8598755 q=41101)

Task dump for CPU 0:

shfs            R  running task        0 31679      1 0x00000008

0000000000000000 ffff88021fc03da8 ffffffff8105e0b5 0000000000000000

0000000000000000 ffff88021fc03dc8 ffffffff81060780 0000000000000001

ffffffff81834400 ffff88021fc03df8 ffffffff8107845f ffffffff81834400

Call Trace:

<IRQ>  [<ffffffff8105e0b5>] sched_show_task+0xbe/0xc3

[<ffffffff81060780>] dump_cpu_task+0x35/0x39

[<ffffffff8107845f>] rcu_dump_cpu_stacks+0x6a/0x8c

[<ffffffff8107acb5>] rcu_check_callbacks+0x1db/0x4f9

[<ffffffff81088601>] ? tick_sched_handle+0x34/0x34

[<ffffffff8107ca53>] update_process_times+0x3a/0x64

[<ffffffff810885ff>] tick_sched_handle+0x32/0x34

[<ffffffff81088638>] tick_sched_timer+0x37/0x61

[<ffffffff8107cf9b>] __run_hrtimer.isra.29+0x57/0xb0

[<ffffffff8107d48a>] hrtimer_interrupt+0xd9/0x1c0

[<ffffffff8102f72e>] local_apic_timer_interrupt+0x50/0x54

[<ffffffff8102fb0b>] smp_apic_timer_interrupt+0x3c/0x4e

[<ffffffff815fdf7d>] apic_timer_interrupt+0x6d/0x80

<EOI>  [<ffffffff8114c555>] ? __discard_prealloc+0xb1/0xb3

[<ffffffff8114c5bb>] reiserfs_discard_all_prealloc+0x44/0x4e

[<ffffffff81168de0>] do_journal_end+0x4e7/0xc78

[<ffffffff81169ad0>] journal_end+0xae/0xb6

Turns out I had not really rebooted, issuing "reboot" at the command prompt only disconnected my SSH session but did not reboot.  I did a hard reset and the server started responding again.  But something weird is happening, this is the second time this week that I had to reboot to server.

The CPU stalls appear to be the same problem as here and here and a bunch listed here.  The next release is reported to have a possible fix, for those suffering from this issue.

 

The SYN flood and UDP checksum errors do look suspicious, but I'm not sure it's an attack.  It also doesn't look related to the CPU stalls.  Look up the URL's, see if you recognize them or not.

Thanks RobJ, look forward to the next release then. 

 

I see other, non-unRaid users, with the SYN flood issue on Serverfault: http://serverfault.com/questions/294209/possible-syn-flooding-in-log-despite-low-number-of-syn-recv-connections .

It looks like you are being attacked. There are addresses located in Brazil and Ireland in your log.