Topic: My 5.5u2 has become unstable

[David Woolley]

Hi,

I wonder if anyone recognises these symptoms.

An established server/gateway running for several months without problems.

In the last two weeks,  on a couple of occasions the local screen has responded to alt_arrow and I can start a new login session, but I can't type at the prompt of an existing session.  At these times, the server & gateway are still working for LAN users.  This morning during this condition, (the last input was ping followed by ctrl_z, then I typed logout, sme responded "there are stopped jobs")  I could open the server-manager, the reboot command was transferred to the server, but  the reboot did not happen.  I  started a new local session as Admin and selected reboot from the menu.  This has resolved the issue for now.

On a couple of other occasions in the last two weeks, LAN users have been unable to login and the server-manager has been unavailable.  Resolved by rebooting, but I don't like doing that - its far too much a M$ response.

So what has changed?  About 6 weeks ago, I installed snort/acid/guardian, and that's about it.

Many thanks for any opinions

cheers
David

[Steve Bush]

I had some issues with Guardian on my SME5.6 server, so I uninstalled it.  I didn't know if the problems were coming from patches I was installing trying to get PPTP and port forwarding working or from guardian.  Either way, the server became unresponsive.  I haven't done any additional troubleshooting on the issue as it is a remote installation.

[Jeroen]

Did you check your log files yet?

Jeroen

[David Woolley]

Thanks Jeroen.  Which particular logs do you think would be most helpful?

David

[David Woolley]

Thanks Steve.

Yes, a few posts are gesturing an accusing finger towards Guardian.  Indeed, some of my LAN users are unwilling to accept it locking rogue ip's for as long as 24 hours, and I am under some pressure to remove it anyway.

Perhaps I should leave the system as is and wait for the next freeze-up and remove Guardian at that time to allow a more monitored control experiment.

Until that time, any thoughts for other avenues to check?

Many thanks

David

[RayG]

I am having similar problems on one of my sme 5.5 servers also. One other symptom is that Guardian dies quietly sometime during the night and I have to restart it manually. Uninstalling and reinstalling guardian hasn't improved the situation. If guardian is the problem, what options are available to replaces it's functionality ?

[David Woolley]

Hi Ray.

Do you think uninstalling Guardian without reinstalling it would recover SME's legendary stability?

I don't know any programmes similar to Guardian.

Thanks

David

[RayG]

I'm going to uninstall Guardian tonight and see how things go. It will take a couple weeks to be sure the stability is restored. I guesss a Guardian replacement isn't really needed. Guardian seems to be on a 5 minute cycle which is pretty much forever compared to the length of a cyber-attack. The Snort logs can be checked a couple times a day and ipchains rules added manually. In reality, the cyber-attacks can probably be ignored. SME is NOT a microsoft product after all.

[David Woolley]

Hi Ray,

My "unstable" server has been running for a week now without any problems, so this is a curious one!

What king of periods have you been experiencing between glitches?

It seems a shame to loose the functionality of Guardian without knowing exactly what's going on.

If you do uninstall Guardian, would you please get back to us all with a report of any change in your server's behaviour.

Thanks

David

[RayG]

I uninstalled Guardian two weeks ago and things seem generally stable.

The most obvious problem I was having with Guardian is that it would stop running at some point and I would have to restart it manually. At some point after the Friday night log rotate, the system would become unstable. I would loose DNS, the ability to log into the server, and eventually all functionality would dissapear. Power cycling was the only recovery option.

After removing Guardian, the system went two weeks without any issues untill this Saturday afternoon. I lost all internet access but everything else was working. I initiated a shutdown from the server manager and that worked properly. The server came up fine after a reboot and viewing the logs showed a DHCP negotiation failure with my ISP. That happens from time to time. Had I looked at the logs before rebooting, I could have killed and restarted the WAN interface and a reboot would not have been required.

I liked Guardian because puts things in one neat package. I'm completely clueless as to why it seems to be causeing problems in my instalation. It's clearly working flawlessly for others.