Results 1 to 6 of 6
  1. #1
    Master Untangler
    Join Date
    Dec 2018
    Posts
    225

    Default Our Untangle server just restarted for no apparent reason?

    This is probably the wrong place but I couldn't find a better place to put it.



    I updated to the latest version of 14.2 a couple days ago and this morning the machine just restarted.

    Is there any way I can track down as to why this happened?

    It has been running for about 10 days now on a Supermicro 5018D-FN8T (same as my home router) with no issues until now.

  2. #2
    Untangle Ninja sky-knight's Avatar
    Join Date
    Apr 2008
    Location
    Phoenix, AZ
    Posts
    26,546

    Default

    I'd look in /var/log/uvm for .crash files.

    If you see one, that's not a good sign. Usually a bad RAM stick, but a defective hard disk can do that too.

    Then there's the "easy", someone has your admin ui password, logged into the unit and restarted it. With that admin UI password SSH access may have been gained too.

    If you're not familiar with SSH access and reading log files, you'll have to open an ticket with Untangle so they can dig into your unit. There's a history kept of commands run manually, if someone breached the box it'll show up. You can see this information your self under config -> about, look for the history line, it'll say YES and a number. The number is the number of commands run on via the root console, if that's a positive integer and you cannot associate that reality with something you know you did... your box was hacked and it needs paved.
    Rob Sandling, BS:SWE, MCP
    NexgenAppliances.com
    Phone: 866-794-8879 x201
    Email: support@nexgenappliances.com

  3. #3
    Master Untangler
    Join Date
    Dec 2018
    Posts
    225

    Default

    I don't see any .crash files.

    In the wrapper.log file I see these entries so it doesn't look like it was restarted manually:
    Jul 1 11:39:07 5018D-FN8T-AO uvmwrapper: Caught SIGINT: initiating shutdown (pid: 82703)
    Jul 1 11:39:15 5018D-FN8T-AO uvmwrapper: ==============================
    Jul 1 11:39:15 5018D-FN8T-AO uvmwrapper: UVM Stopped
    Jul 1 11:39:15 5018D-FN8T-AO uvmwrapper: ==============================
    Jul 1 11:39:16 5018D-FN8T-AO uvmwrapper: ==============================
    Jul 1 11:39:16 5018D-FN8T-AO uvmwrapper: UVM Launching
    Jul 1 11:39:16 5018D-FN8T-AO uvmwrapper: ==============================
    Jul 1 11:39:16 5018D-FN8T-AO uvmwrapper: untangle-vm launched (pid: 45259)
    Jul 1 11:39:16 5018D-FN8T-AO uvmwrapper: untangle-vm monitoring (pid: 45259)
    Jul 3 21:53:28 5018D-FN8T-AO uvmwrapper: Caught SIGINT: initiating shutdown (pid: 45259)
    Jul 3 21:53:43 5018D-FN8T-AO uvmwrapper: ==============================
    Jul 3 21:53:43 5018D-FN8T-AO uvmwrapper: UVM Stopped
    Jul 3 21:53:43 5018D-FN8T-AO uvmwrapper: ==============================
    Jul 3 21:53:59 5018D-FN8T-AO uvmwrapper: ==============================
    Jul 3 21:53:59 5018D-FN8T-AO uvmwrapper: UVM Launching
    Jul 3 21:53:59 5018D-FN8T-AO uvmwrapper: ==============================
    Jul 3 21:53:59 5018D-FN8T-AO uvmwrapper: untangle-vm launched (pid: 29303)
    Jul 3 21:53:59 5018D-FN8T-AO uvmwrapper: untangle-vm monitoring (pid: 29303)
    Jul 5 03:21:15 5018D-FN8T-AO uvmwrapper: ==============================
    Jul 5 03:21:15 5018D-FN8T-AO uvmwrapper: UVM Launching
    Jul 5 03:21:15 5018D-FN8T-AO uvmwrapper: ==============================
    Jul 5 03:21:15 5018D-FN8T-AO uvmwrapper: untangle-vm launched (pid: 3787)
    Jul 5 03:21:15 5018D-FN8T-AO uvmwrapper: untangle-vm monitoring (pid: 3787)

    I am the only one that has access to the server so if I didn't do it nobody else should have. I do see commands on that Config --> About line but I know I have run some commands myself.

    My home router shows that too. I only have SSH enabled though for my machine at work and no outside access.

    It actually just did it again. The whole machine isn't rebooting it's just UVM restarting it appears as it comes back in 30ish seconds while an actual reboot takes 2ish minutes.

    I decided to just reboot the physical box (Untangle is installed directly on this machine). We'll see what happens.

  4. #4
    Untangle Ninja sky-knight's Avatar
    Join Date
    Apr 2008
    Location
    Phoenix, AZ
    Posts
    26,546

    Default

    UVM doesn't just restart unless it's crashing... Untangle may have changed their log behavior to remove the .crash files.

    I'd open a ticket with Untangle support at this point. The only thing left I can suggest is to down the box for a RAM test.
    Rob Sandling, BS:SWE, MCP
    NexgenAppliances.com
    Phone: 866-794-8879 x201
    Email: support@nexgenappliances.com

  5. #5
    Newbie vulcansheart's Avatar
    Join Date
    Jul 2019
    Location
    South Carolina
    Posts
    13

    Default

    I'd put my money on hardware failure.

  6. #6
    Master Untangler
    Join Date
    Dec 2018
    Posts
    225

    Default

    It very well could be RAM.

    I'll probably just ask to get another set and swap them out then test the existing RAM as it's only $60 now for 16GB so it'll be faster just to swap it out.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

SEO by vBSEO 3.6.0 PL2