Hi Rob, anything in /etc/cron.daily which would run at or about
midnight? Or any files in /var/spool/cron/crontabs or /etc/cron.d? Or
even a self-re-scheduling "at" job? ("sudo atq" will list any pending jobs)
On 13/03/2023 08:02, rmluglist2--- via Hampshire wrote:
>
> Hi all
>
> I have an Ubuntu box which is on 24/7/365. It has ufw running
> allowing nothing from outside my lan.
>
> A couple of times recently, I’ve come in to find the machine locked up
> with a lot of disk access (it can be ping’d but I can’t ssh into it
> and it doesn’t respond to mouse or keyboard on the console – only
> power cycling brings it back). As I say, this has now happened twice
> in the last 3-4 nights.
>
> It may have been hacked (but I doubt it looking at kern.log and
> auth.log – and I’m behind a NAT router with no ports open). Does
> anyone know if Ubuntu (Jammy) does some indexing or some other regular
> task overnight? The reason I ask is I’m wondering if it’s said
> indexing that’s crashed the (very old) system. It’s fine for a file
> server but not really fit for anything else. Incidentally, I’ve
> checked crontab and there’s nothing in there.
>
> Anything else I should be checking?
>
> Cheers
>
> Rob
>
>--
Please post to: Hampshire@???
Web Interface:
https://mailman.lug.org.uk/mailman/listinfo/hampshire
LUG URL:
http://www.hantslug.org.uk
--------------------------------------------------------------
