Bug#953860: more info

[Russell Coker]

On Thursday, 19 March 2020 11:49:37 AM AEDT Russell Coker wrote:
> On Thursday, 19 March 2020 5:20:08 AM AEDT Michael Biebl wrote:
> > Or to put it differently: Can you provide steps how this particular
> > issue can be reproduced?
> 
> It has happened twice, I have not yet worked out what triggers it.  I will
> provide more information as I get it.

root at sevm:~# last|grep rjc
rjc      pts/5        103.75.204.226   Sat Mar 14 18:14 - 18:16  (00:01)
rjc      pts/0        103.75.204.226   Wed Mar 11 15:56 - 15:56  (00:00)
rjc      pts/1        103.75.204.226   Tue Mar 10 00:58 - 15:36 (1+14:38)
rjc      pts/1        103.75.204.226   Mon Mar  9 22:18 - 00:25  (02:06)
root at sevm:~# uptime
 13:00:37 up 21:49,  2 users,  load average: 3.50, 3.36, 3.24

It's just happened again on the same system.  The user it happens with is rjc 
which has not logged in since well before the last reboot.

Below is the journalctl for the user rjc:

rjc at sevm:~$ journalctl 
Hint: You are currently not seeing messages from other users and the system.
      Users in groups 'adm', 'systemd-journal' can see all messages.
      Pass -q to turn off this notice.
-- Logs begin at Mon 2020-03-09 22:19:34 AEDT, end at Sat 2020-03-14 18:16:10 
AEDT. --
Mar 09 22:19:34 sevm sshd[236752]: Received disconnect from 103.75.204.226 
port 56700:11: disconnected by user
Mar 09 22:19:34 sevm sshd[236752]: Disconnected from user rjc 103.75.204.226 
port 56700
Mar 09 22:49:31 sevm sshd[244372]: Received disconnect from 103.75.204.226 
port 56887:11: disconnected by user
Mar 09 22:49:31 sevm sshd[244372]: Disconnected from user rjc 103.75.204.226 
port 56887
Mar 10 00:25:15 sevm sshd[236695]: Received disconnect from 103.75.204.226 
port 56552:11: disconnected by user
Mar 10 00:25:15 sevm sshd[236695]: Disconnected from user rjc 103.75.204.226 
port 56552
Mar 11 15:36:57 sevm sshd[284938]: Received disconnect from 103.75.204.226 
port 56843:11: disconnected by user
Mar 11 15:36:57 sevm sshd[284938]: Disconnected from user rjc 103.75.204.226 
port 56843
Mar 11 15:56:57 sevm sshd[487296]: Received disconnect from 103.75.204.226 
port 56734:11: disconnected by user
Mar 11 15:56:57 sevm sshd[487296]: Disconnected from user rjc 103.75.204.226 
port 56734
-- Reboot --
Mar 14 18:16:10 sevm sshd[76714]: Received disconnect from 103.75.204.226 port 
56912:11: disconnected by user
Mar 14 18:16:10 sevm sshd[76714]: Disconnected from user rjc 103.75.204.226 
port 56912

root at sevm:~# ls -l /var/log/journal/68f1b89bf8c73b0ed9ed905f535fa641/
user-1000*
-rw-r-----+ 1 root systemd-journal 8388608 Mar  9 22:19 /var/log/journal/
68f1b89bf8c73b0ed9ed905f535fa641/
user-1000 at 802af85f15f0436cbbf371c9ef25cc3d-0000000000248bda-0005a06a2d827e83.journal
-rw-r-----+ 1 root systemd-journal 8388608 Mar 10 00:25 /var/log/journal/
68f1b89bf8c73b0ed9ed905f535fa641/
user-1000 at 802af85f15f0436cbbf371c9ef25cc3d-0000000000249dea-0005a06a989e985c.journal
-rw-r-----+ 1 root systemd-journal 8388608 Mar 11 15:59 /var/log/journal/
68f1b89bf8c73b0ed9ed905f535fa641/
user-1000 at 802af85f15f0436cbbf371c9ef25cc3d-00000000002afc3b-0005a08cc956a1f0.journal
-rw-r-----+ 1 root systemd-journal 8388608 Mar 14 18:17 /var/log/journal/
68f1b89bf8c73b0ed9ed905f535fa641/
user-1000 at ec27874695864255946c8c42c8d10cc7-00000000002ce205-0005a0cb5c44ada7.journal
root at sevm:~# !mon
monshow --detail sevm,sharedobject

     server: localhost
       time: Sat Mar 21 13:05:59 2020
      state: scheduler running

Detail for group sevm service sharedobject

description
-----------
    upgraded shared objects
summary
-------
    Can't open /proc/51949/maps
hosts
-----
    sevm

-----DETAIL-----
1 deleted mapped files, 1 root owned processes
1 root programs:
/lib/systemd/systemd-journald:  293

1 deleted mapped files:
/var/log/journal/68f1b89bf8c73b0ed9ed905f535fa641/
user-1000 at ec27874695864255946c8c42c8d10cc7-0000000000000000-0000000000000000.journal

I'll do some more tests with creating users and only logging in once for each.

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/