[BlueOnyx:12390] Re: 5106R performance issues

[Rickard Osser]

Hi Chris,

we've had a couple of mail-crackers trying out one of our machines
today. Blocked out 3 C-nets just for these three attackers.
I suppose there's something going on on mail-servers as well right now.

Best regards,

Rickard


On tis, 2013-03-05 at 08:49 -0600, Chris Gebhardt - VIRTBIZ Internet
wrote:
> I've been noticing that we have some 5106R boxes that have typically 
> been pretty good performers, but they are falling apart lately.  It's a 
> mixture of machines that we are running and some our customers are 
> running.   The symptoms are varied, and a bit erratic (which I will 
> list).  There is nothing that I have found that specifically ties 
> anything together, but I thought I would mention it in the event that 
> anybody else has noticed similar.
> 
> FWIW, none of the 5108R boxes I have access to have shared these symptoms.
> 
> -- takes an extraordinary long time to run nightly backups (raqbackup.sh).
> 
> -- cron.daily is set to run at 4am, but some jobs do not begin until 
> 10am, finishing around 2pm.
> 
> -- ActiveMonitor reports "The FTP server is not running and could not be 
> restarted."
> 
> -- Dovecot will stop responding, requiring an admin to SSH and do
> # killall -9 dovecot
> # service dovecot start
> 
> -- ActiveMonitor reports "The SMTP server is not running and could not 
> be restarted."
> 
> -- Periodic "The CPU is being moderately used alerts.
> 
> Again, the only commonality is that the affected systems are 5106R.   Odd!
> 
> One thing we did find yesterday after hearing from a customer is that 
> several systems were being hit hard by 60.10.6.85 attempting to POST 
> garbage into various websites.  I set a null-route for the containing 
> /24 and put an end to that.  ;)
> 
> I've looked at logs, watched processes... nothing is jumping out at me 
> other than these are 5106R boxes.   I'm not looking for a magic fix 
> (although if you've got one, don't be stingy!)   I just thought I would 
> mention my observation in case anyone else has witnessed same.
>