The Planet Forums > dropped packets in LogWatch?

ChrisM

Jan 20 2004, 08:50 AM

Is this abnormal?

QUOTE

################### LogWatch 4.3.2 (02/18/03) ####################
Processing Initiated: Tue Jan 20 04:02:02 2004
Date Range Processed: yesterday
Detail Level of Output: 0
Logfiles for Host: ************
################################################################

--------------------- Kernel Begin ------------------------

Dropped 235 packets on interface eth0
From 12.223.132.96 - 5 packets

Should I be concerned, or is this routine?

Also, apache has been 'automagically' restarted once each of the last 5 or 6 days. Could it be related?

Many thanks for any input that you have.

eddy2099

Jan 20 2004, 09:03 AM

Was there anything after that mentioning which IP and services it was dropped ? Well, if so, there is nothing to worry about. basically it is telling you that your firewall or iptable is working and dropping connections which are not desirable such as hacks and other infiltrations.

ChrisM

Jan 20 2004, 09:05 AM

QUOTE (eddy2099)

Was there anything after that mentioning which IP and services it was dropped ? Well, if so, there is nothing to worry about. basically it is telling you that your firewall or iptable is working and dropping connections which are not desirable such as hacks and other infiltrations.

Yes, it goes on to tell which IP and services were dropped.
Thanks for the info. Feel better knowing.

DataDork

Jan 20 2004, 10:18 AM

QUOTE

apache has been 'automagically' restarted once each of the last 5 or 6 days. Could it be related?

This is an caused by cpanel when it tried to update htpd. What you need to do is

up2date --configure
option "8" and add httpd to the list, right after kernel*;

PM me if you need some additional help solving that issue. I fixed a couple servers yesterday with the same symptons.

Take care, Chris!

ChrisM

Jan 20 2004, 10:28 AM

Thanks James. Just did it.

By the way... is there a scheduled 'fix' for this from CPanel, or will this be necessary on future servers?

Paul

Jan 20 2004, 10:55 AM

QUOTE (ChrisM)

Is this abnormal?

QUOTE

################### LogWatch 4.3.2 (02/18/03) ####################
Processing Initiated: Tue Jan 20 04:02:02 2004
Date Range Processed: yesterday
Detail Level of Output: 0
Logfiles for Host: ************
################################################################

--------------------- Kernel Begin ------------------------

Dropped 235 packets on interface eth0
From 12.223.132.96 - 5 packets

Should I be concerned, or is this routine?

Only 235 dropped packets?... you lightweight

ChrisM

Jan 20 2004, 10:58 AM

QUOTE (Paul)

Only 235 dropped packets?... you lightweight

Only have a couple of domains on this server. Don't dare (yet) to put any really important sites on this server. We'll see how it goes. Getting more confident in SM every day.