-1

we have today strange behavior with our Linux server rhel 7.6

from some reason server goes down

and from the messages file we can see that server stop be available on Oct 16 18:17:22

after some time we start the server at - Oct 18 04:42:46 , ( power on )

Oct 16 18:17:22 linux avahi-daemon[1140]: Invalid response packet from host 45.52.7.60.
Oct 16 18:17:22 linux avahi-daemon[1140]: Invalid response packet from host 45.52.91.79.
Oct 16 18:17:22 linux avahi-daemon[1140]: Invalid response packet from host 45.52.56.84.
Oct 16 18:17:22 linux avahi-daemon[1140]: Invalid response packet from host 45.52.84.118.
Oct 16 18:17:22 linux avahi-daemon[1140]: Invalid response packet from host 45.52.46.210.
Oct 16 18:17:22 linux avahi-daemon[1140]: Invalid response packet from host 45.52.81.152.
Oct 16 18:17:22 linux avahi-daemon[1140]: Invalid response packet from host 45.52.84.119.
Oct 16 18:17:22 linux avahi-daemon[1140]: Invalid response packet from host 45.52.130.225.
Oct 16 18:17:22 linux avahi-daemon[1140]: Invalid response packet from host 45.52.81.103.
Oct 16 18:17:22 linux avahi-daemon[1140]: Invalid response packet from host 45.52.92.110.
Oct 16 18:17:22 linux avahi-daemon[1140]: Invalid response packet from host 45.52.236.182.
Oct 16 18:17:22 linux avahi-daemon[1140]: Invalid response packet from host 45.52.77.79.
Oct 16 18:17:22 linux avahi-daemon[1140]: Invalid response packet from host 45.52.73.52.
Oct 16 18:17:22 linux avahi-daemon[1140]: Invalid response packet from host 45.52.88.172.
Oct 16 18:17:22 linux avahi-daemon[1140]: Invalid response packet from host 45.52.61.224.
Oct 16 18:17:22 linux avahi-daemon[1140]: Invalid response packet from host 45.52.98.223.
Oct 16 18:17:22 linux avahi-daemon[1140]: Invalid response packet from host 45.52.78.250.
Oct 18 04:42:46 linux rsyslogd: [origin software="rsyslogd" swVersion="7.4.7" x-pid="1122" x-info="http://www.rsyslog.com"] start
Oct 18 04:42:42 linux kernel: Initializing cgroup subsys cpuset
Oct 18 04:42:42 linux kernel: Initializing cgroup subsys cpu
Oct 18 04:42:42 linux kernel: Initializing cgroup subsys cpuacct
Oct 18 04:42:42 linux kernel: Linux version 3.10.0-327.el7.x86_64 (mockbuild@x86-034.build.eng.bos.redhat.com) (gcc version 4.8.3 20140911 (Red Hat 4.8.3-9) (GCC) ) #1 SMP Thu Oct 29 17:29:29 EDT 2015
Oct 18 04:42:42 linux kernel: Command line: BOOT_IMAGE=/vmlinuz-3.10.0-327.el7.x86_64
Oct 18 04:42:42 linux kernel: Disabled fast string operations
Oct 18 04:42:42 linux kernel: e820: BIOS-provided physical RAM map:

since we not have much details why server goes down unexpected ,

then the only thing that we see are the avahi-daemon

so my question is - dose avahi-daemon service could be the reason for the machine unexpected shutdown?

in spite this is not logical but only avahi-daemon message are the message before machine goes down

2

Those avahi-daemon service could be the reason for the machine unexpected shutdown?

No, 100%.

Considering nothing had been logged just before the server went down, it could most likely indicate a hardware failure, power loss or someone simply pressed the reset button.

If your server contains an IPMI/BMC chip you can check its hardware log using ipmitool.

Also, you don't have to have avahi-daemon installed on your server.

3

If it's a real server, it has a BMC. You should at the very least examine the BMCs event log. That will tell you at least some information about why the server disappeared. (Consider that syslog is just a normal file created by a daemon - that means in addition to hardware problems, the daemon could have died, or the filesystem got confused. That's why the BMC is so valuable.)

There are also events which don't make it into syslog (most kernel panics, for obvious reasons). These would show up on the console - a real server should have its console directed to a serial port to which the BMC is listening. That means you can connect to the console over the network from another server, and see what appears. Sometimes a physical console will show the same info (but remember to turn off screen blanking). There are programs that will connect to the console via IPMI and log everything that appears (conman, for instance).

3

According to public Whois lookup information, 45.52.*.* network segment belongs to Frontier Communications of America, Inc. Since you are receiving invalid responses from all over that segment, it looks like avahi-daemon has not been restricted from accepting packets from outside your own network and it's responding to random queries from all the other clients of your Internet Service Provider.

As Artem S. Tashkinov said, if you don't need avahi-daemon, you should disable it. And even if you do, you should probably restrict it to respond to queries from your own network only.

If your server has a hardware management processor (also sometimes known as BMC, or Baseboard Management Controller), it might have logged some information about the crash. If a management processor exists and is IPMI-compatible, then ipmitool sel elist might display a list of hardware log events; these might indicate a loss of incoming power (e.g. power outage, or a janitor pulling the plug to run a floor buffer?), memory failure (if ECC memory is used) or other hardware faults, depending on the actual capabilities of your server hardware.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.