Show Posts
1
22.1 Legacy Series / Unbound and Suricata both crash during overnight operations
« on: March 13, 2022, 11:35:08 am »
Updated to 22.1.2 last Friday. Each night since, both Unbound and Suricata have been in a stopped state when I get up in the morning.
Here we see me restarting the Unbound service yesterday afternoon at 4:02pm after coming back from a trip. Then it needs to start the service again at 4:20am? And then stops the service at 4:34am? From 4:34 until when I manually start it again in the morning there's 7 pages of statistics all generated within 2 minutes of that service stop.
For Suricata we see me starting it at 4:02pm yesterday (again, when I got back from a trip), no information until the Rule Reload at 2:37am. Nothing showing the service stopped for any reason and yet here I am starting the service at 4:23am today.
How can I figure out what is causing these services to stop?
Code: [Select]
2022-03-13T04:34:50-05:00 Informational unbound [71050:0] info: service stopped (unbound 1.15.0).
2022-03-13T04:20:39-05:00 Informational unbound [71050:0] info: start of service (unbound 1.15.0).
2022-03-13T04:20:39-05:00 Notice unbound [71050:0] notice: init module 0: iterator
2022-03-13T04:20:39-05:00 Notice unbound daemonize unbound dhcpd watcher.
2022-03-12T20:34:14-06:00 Notice unbound dhcpd expired MTXINABOX @ 192.168.37.200
2022-03-12T20:33:13-06:00 Notice unbound dhcpd expired dan-Standard-PC-i440FX-PIIX-1996 @ 192.168.37.179
2022-03-12T16:02:08-06:00 Informational unbound [41343:0] info: start of service (unbound 1.15.0).Here we see me restarting the Unbound service yesterday afternoon at 4:02pm after coming back from a trip. Then it needs to start the service again at 4:20am? And then stops the service at 4:34am? From 4:34 until when I manually start it again in the morning there's 7 pages of statistics all generated within 2 minutes of that service stop.
Code: [Select]
2022-03-13T04:31:27-05:00 Notice suricata [100278] <Notice> -- all 3 packet processing threads, 4 management threads initialized, engine started.
2022-03-13T04:23:28-05:00 Notice suricata [100207] <Notice> -- This is Suricata version 6.0.4 RELEASE running in SYSTEM mode
2022-03-13T00:02:37-06:00 Notice suricata [100188] <Notice> -- rule reload starting
2022-03-12T16:10:09-06:00 Notice suricata [100188] <Notice> -- all 3 packet processing threads, 4 management threads initialized, engine started.
2022-03-12T16:02:14-06:00 Notice suricata [100101] <Notice> -- This is Suricata version 6.0.4 RELEASE running in SYSTEM modeFor Suricata we see me starting it at 4:02pm yesterday (again, when I got back from a trip), no information until the Rule Reload at 2:37am. Nothing showing the service stopped for any reason and yet here I am starting the service at 4:23am today.
How can I figure out what is causing these services to stop?