1

My Ubuntu 14.04 server is hosted on a well-known cloud provider.

I noticed today something that usually makes my heart stop:

user@myserver123:/var/log$ screen -ls
No Sockets found in /var/run/screen/S-user.

I confirmed there was a reboot Friday night (literally the worst time for a reboot to happen).

First I checked last:

reboot   system boot  3.16.0-31-generi Fri Jul 24 20:08 - 19:50 (3+23:42)   

wtmp begins Fri Jul 24 20:08:04 2015

Attempting to investigate I looked through /var/log/auth.log and found this:

authlog

Why all the ^@ in the log file? Lines above the block of ^@ are normal ssh authentication failures.

I notice it says (Power Button) on the first line after the ^@.

Does this mean someone at the data center pushed the power button on the machine hosting my VPS?

  • 1
    This ^@ represents the hex 0 character. Check that part with hexdump -C. It's not the reason for the reboot. What do /var/log/messages and /var/log/syslog report for that time? – ott-- Jul 28 '15 at 20:56
  • Nothing out of the ordinary: pastebin.com/q3FtkuFp – bee Jul 28 '15 at 21:36
0

You have a block of null bytes in your log file. This could be due to:

  • A bug in the syslog program. Unlikely.
  • A kernel bug, especially one in the filesystem or disk drivers. Mildly likely.
  • A failing disk. Since you have a VPS, that's something to ask the VPS provider.
  • Failing RAM. Since you have a VPS, that's something to ask the VPS provider. On a machine running on non-ECC hardware, RAM is the first thing I'd check.
  • An attacker clumsily failing to hide their tracks. Very unlikely because writing zeros is a strange way to hide — copying harmless log messages or plain deleting the incriminating ones would be the normal thing.

The message about the power button provides no information about the cause of the reboot. It's saying that now, in the current session, systemd will initiate a system shutdown if you press the shutdown button.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.