HELP- Netonix Virus?

[wtm]

I am looking at other issues ! The hack was cleared, but there still seems to be a problem there as the log states that Lighttpd seems to have to restart about every minute. Updating the firmware does not fix that issue, and may in fact be what is now causing it? I haven't tried to roll the firmware back to see if Lighttpd doesn't restart every minute? Guess I will do that an report back?

[Stephen]

As a quick reminder, presently, we do think the vulnerability is in lighttpd, yes it is an old version. While we investigate a fix, and assuming that the vulnerability is, in fact, in the webserver. There is an option to potentially defend the switch if it is exposed to the internet. Basically, the exploit will only work if it can reach the webserver. We believe that infected machine's on the user's network is what is spreading this malicious code or if the switch is exposed directly from the internet, the attacker could also reach it directly from whatever machine they launched this attack from.

Possible Counter Measures:
For now, there are 2 options.
1. Change your management VLAN so that management ports are isolated from machine's other than one's you trust (whatever machine you use to access the switch, or the associated server if there is a VPN or similar)

Meaning, if you have ports that are customer facing and go out to the web, take these off the management vlan. This will prevent any incoming traffic from having access to the webserver.

2. use the Access Control option in the switch to prevent any connecting ip except for your management machine to have access. The access control's/firewall is handled via ip tables, the webserver will no longer be exposed to any device's except the one's you specify here (careful with this option)

As a reminder, you can access this via Device->Access Controls. The webui should help you navigate it, you can set multiple entries if you have a few machine's that need access. All others should be blocked. Once you start an entry, the webui will show you your current ip of the machine you're using to configure it so you can start by blocking it from everything but this machine.


Note, "Tarpit" is irrelevant here, this is a function of the webserver, but the "Allowed Address's" may make a difference.

It would be helpful if at least a few people tried this and reported back whether or not this stops the attacks.

This is because, although we have some evidence, we're not entirely certain if the attack vector is scenario 1 or scenario 2 (see my earlier post in this thread for details).
If scenario 2, these counter measures will work until a patch is available.
If scenario 1, then it means this won't work, and you'll see this occur again. If that happens, clear your browser's data, the malicious code may be hijacking it to spread.

The other issue, if scenario 2, and the attacker has infected your machine that you use to access the switch, then blocking in this manner won't work. If that's the case, running a security scan may help turn up some issue's. Once again, if you do this and find something, please report back here to help us isolate the problem at large.

[Stephen]

I am looking at other issues ! The hack was cleared, but there still seems to be a problem there as the log states that Lighttpd seems to have to restart about every minute. Updating the firmware does not fix that issue, and may in fact be what is now causing it? I haven't tried to roll the firmware back to see if Lighttpd doesn't restart every minute? Guess I will do that an report back?

There might be a machine on your network that is running malicious code continuously. Or if these switch's are exposed to the web, the attacker's program may be running on their machine basically doing the same. Try using the Access Control's I mentioned in the comment above to block everything but your machine from accessing the switch's web ui and see if the restarts stop.

Let us know what happens.

[rockhead]

Mickey mouse workaround proposal ...
ssh in edit config https =false ,
save
BAM !
Need to learn the netonix way to apply from command line ... I'd rather avoid
the reboot

[Stephen]

Mickey mouse workaround proposal ...
ssh in edit config http =false ,

BAM !
Need to learn the netonix way to save and apply from command line ...

Are you sure this helped?

If it did, in the CLI you can run the commands

conf t
no https-server allow-http
end
(click enter to save)

Or in the webui, it is under Device->Configuration
Look for the "Https" panel
and uncheck the box "Allow HTTP"
and save/apply

To accomplish the same.


Though this option should be disabled by default.
I must admit I don't understand what this would do to prevent the malicious code from spreading, unless it is intercepting your session with a man-in-the-middle attack. But then that would imply that you must have had an open session to switch's that where compromised (similar to scenario 2). We don't think that's what's happening presently. But are still gathering information.

So let us know anything you see.

[rockhead]

Well it helps if you are disabling the attack vector <shrug>

[rockhead]

Or in the webui, it is under Device->Configuration
Look for the "Https" panel
and uncheck the box "Allow HTTP"
and save/apply

To accomplish the same.

So let us know anything you see.

Nuh uuuhhhhh, the gui timeout 'rescues' you and it gets re-enabled

[lligetfa]

On older units like 8+ years old that may happen.

But if your switch is not super old v1.5.12 to v1.5.16 works fine. You'll know it does not work as it hangs after file upload. If happens refresh page then try v1.5.14 then v1.5.16

My very old WS-24 Board rev B on 1.5.12 just hangs after the file upload trying to upgrade to either 1.5.14 or 1.5.16.

[Stephen]

Or in the webui, it is under Device->Configuration
Look for the "Https" panel
and uncheck the box "Allow HTTP"
and save/apply

To accomplish the same.

So let us know anything you see.

Nuh uuuhhhhh, the gui timeout 'rescues' you and it gets re-enabled

I just did it successfully on 1.5.16, if you modified the config file manually, it may throw off the system a bit, since the software handling config wouldn't have recorded this change. You may want to default and then try again, if you want to use this method. (This is just a possibility though)
If the switch is infected, the extra resource's being used up may also make it difficult to apply config change's, especially from the webui. May want to try clearing payload (in linux console, cd /www; rm index.html; /etc/init.d/lighttpd restart ) and try again.

[sdwisp]

There is still a program running in the back ground that will max out CPE usage . Cleared up switch are good for 8 to 12 hours and we have found this in the log ??

any Ideas ?


Dec 31 16:00:04 kernel: 0x00040000-0x00080000 : "config"

Dec 31 16:00:04 kernel: 0x00080000-0x001c0000 : "linux_recovery"

Dec 31 16:00:04 kernel: 0x001c0000-0x003c0000 : "rootfs_recovery"

Dec 31 16:00:04 kernel: 0x003c0000-0x00500000 : "linux"

Dec 31 16:00:04 kernel: 0x00500000-0x00b00000 : "rootfs"

Dec 31 16:00:04 kernel: mtd: partition "rootfs" set to be root filesystem

Dec 31 16:00:04 kernel: 0x00b00000-0x00f40000 : "rootfs_data"

Dec 31 16:00:04 kernel: 0x00f40000-0x00f80000 : "FIS directory"

Dec 31 16:00:04 kernel: 0x00f80000-0x00f81000 : "RedBoot config"

Dec 31 16:00:04 kernel: 0x00fc0000-0x01000000 : "Redundant FIS"

Dec 31 16:00:04 kernel: 0x03f40000-0x03f80000 : "FIS directory 512"

Dec 31 16:00:04 kernel: mtd: partition "FIS directory 512" is out of reach -- disabled

Dec 31 16:00:04 kernel: 0x03f80000-0x03f81000 : "RedBoot config 512"

Dec 31 16:00:04 kernel: mtd: partition "RedBoot config 512" is out of reach -- disabled

Dec 31 16:00:04 kernel: 0x03fc0000-0x04000000 : "Redundant FIS 512"

Dec 31 16:00:04 kernel: mtd: partition "Redundant FIS 512" is out of reach -- disabled

Dec 31 16:00:04 kernel: ip_tables: (C) 2000-2006 Netfilter Core Team

Dec 31 16:00:04 kernel: TCP cubic registered

Dec 31 16:00:04 kernel: NET: Registered protocol family 10

Dec 31 16:00:04 kernel: lo: Disabled Privacy Extensions

Dec 31 16:00:04 kernel: ip6_tables: (C) 2000-2006 Netfilter Core Team

Dec 31 16:00:04 kernel: NET: Registered protocol family 17

Dec 31 16:00:04 kernel: 802.1Q VLAN Support v1.8 Ben Greear

Dec 31 16:00:04 kernel: All bugs added by David S. Miller

Dec 31 16:00:04 kernel: VFS: Mounted root (squashfs filesystem) readonly.

Dec 31 16:00:04 kernel: Freeing unused kernel memory: 116k freed

Dec 31 16:00:04 kernel: Please be patient, while OpenWrt loads ...

Dec 31 16:00:04 kernel: Algorithmics/MIPS FPU Emulator v1.5

Dec 31 16:00:04 kernel: mini_fo: using base directory: /

Dec 31 16:00:04 kernel: mini_fo: using storage directory: /jffs

Dec 31 16:00:05 sysinit: killall: udhcpc: no process killed

Dec 31 16:00:08 kernel: vtss_core: module license '(c) Vitesse Semiconductor Inc.' taints kernel.

Dec 31 16:00:08 kernel: switch: 'Luton26' board detected

Dec 31 16:00:09 kernel: vtss_port: Loaded port module on board Luton26, type 5

Dec 31 16:00:10 kernel: nf_conntrack version 0.5.0 (2048 buckets, 8192 max)

Dec 31 16:00:11 system: Setting MAC address from flash configuration: EC:13:B2:84:81:34

Dec 31 16:00:11 kernel: i2c /dev entries driver

Dec 31 16:00:11 kernel: i2c_vcoreiii i2c_vcoreiii: i2c bus driver on IRQ 19

Dec 31 16:00:12 sysinit: Loading defaults

Dec 31 16:00:12 system: starting ntpclient

Dec 31 16:00:12 sysinit: Adding custom chains

Dec 31 16:00:13 sysinit: Loading zones

Dec 31 16:00:13 sysinit: Loading forwarding

Dec 31 16:00:13 sysinit: Loading redirects

Dec 31 16:00:13 sysinit: Loading rules

Dec 31 16:00:13 sysinit: Loading includes

Dec 31 16:00:14 sd_wisp: adding lan (eth0) to firewall zone lan

Dec 31 16:00:14 dropbear[672]: Running in background

Dec 31 16:00:15 netonix: 1.5.16 on WS-12-250-DC

Dec 31 16:00:18 UI: web config OK

Dec 31 16:00:18 syslogd exiting

Dec 31 16:00:19 syslogd started: BusyBox v1.19.4

Dec 31 16:00:27 sysinit: 1969-12-31 16:00:26: (network.c.272) warning: please use server.use-ipv6 only for hostnames, not without server.bind / empty address; your config will break if the kernel default for IPV6_V6ONLY changes

Dec 31 16:00:27 sysinit: 1969-12-31 16:00:26: (network.c.272) warning: please use server.use-ipv6 only for hostnames, not without server.bind / empty address; your config will break if the kernel default for IPV6_V6ONLY changes

Dec 31 16:00:27 sysinit: 1969-12-31 16:00:26: (log.c.216) server started

Dec 31 16:00:30 switch[837]: Detected warm boot

Dec 31 16:00:32 switch[836]: temp sensor version 1

Dec 31 16:00:38 system: starting ntpclient

Dec 31 16:00:51 system: starting ntpclient

Aug 2 08:13:58 system: time set by NTP server

Aug 2 08:14:32 switch[819]: Warning: expected 1 fans but found 0

Aug 2 14:59:17 monitor: restarting vtss_appl

Aug 2 14:59:29 monitor: restarting vtss_appl

Aug 2 14:59:53 monitor: restarting vtss_appl

Aug 2 14:59:53 monitor: restarting lighttpd

Aug 2 15:00:08 monitor: restarting vtss_appl

Aug 2 15:00:08 monitor: restarting lighttpd

Aug 2 15:00:21 monitor: restarting vtss_appl

Aug 2 15:00:21 monitor: restarting lighttpd

Aug 2 15:00:34 monitor: restarting lighttpd

Aug 2 15:00:46 monitor: restarting vtss_appl

Aug 2 15:00:46 monitor: restarting lighttpd

Aug 2 15:00:59 monitor: restarting vtss_appl

Aug 2 15:01:00 monitor: restarting lighttpd

Aug 2 15:01:12 monitor: restarting vtss_appl

Aug 2 15:01:13 monitor: restarting lighttpd

Aug 2 15:01:14 monitor: restarting shellinaboxd

Aug 2 15:01:27 monitor: restarting data collection daemon

Aug 2 15:01:27 monitor: restarting lighttpd

Aug 2 15:01:29 monitor: restarting shellinaboxd

Aug 2 15:01:29 switch[897]: Detected warm boot

Aug 2 15:01:32 switch[896]: temp sensor version 1

Aug 2 15:01:45 monitor: restarting vtss_appl

Aug 2 15:01:46 monitor: restarting lighttpd

Aug 2 15:01:50 monitor: restarting shellinaboxd

Aug 2 15:02:02 monitor: restarting vtss_appl

Aug 2 15:02:02 monitor: restarting lighttpd

Aug 2 15:02:16 monitor: restarting lighttpd

Aug 2 15:02:28 monitor: restarting lighttpd

Aug 2 15:02:37 switch[879]: Warning: expected 1 fans but found 0

Aug 2 15:02:40 monitor: restarting vtss_appl

Aug 2 15:02:40 monitor: restarting lighttpd

Aug 2 15:02:53 monitor: restarting lighttpd

Aug 2 15:03:05 monitor: restarting lighttpd

Aug 2 15:03:17 monitor: restarting lighttpd

Aug 2 15:03:29 monitor: restarting lighttpd

Aug 2 15:03:41 monitor: restarting lighttpd

Aug 2 15:03:53 monitor: restarting lighttpd

Aug 2 15:04:05 monitor: restarting lighttpd

Aug 2 15:04:17 monitor: restarting lighttpd

Aug 2 15:04:29 monitor: restarting lighttpd

Aug 2 15:04:41 monitor: restarting lighttpd

Aug 2 15:04:53 monitor: restarting lighttpd

Aug 2 15:05:05 monitor: restarting vtss_appl

Aug 2 15:05:05 monitor: restarting lighttpd

Aug 2 15:05:18 monitor: restarting lighttpd

Aug 2 15:05:30 monitor: restarting lighttpd

Aug 2 15:05:42 monitor: restarting vtss_appl

Aug 2 15:05:42 monitor: restarting lighttpd

Aug 2 15:05:45 monitor: restarting shellinaboxd

Aug 2 15:05:57 monitor: restarting vtss_appl

Aug 2 15:05:58 monitor: restarting lighttpd

Aug 2 15:06:11 monitor: restarting lighttpd

Aug 2 15:06:23 monitor: restarting vtss_appl

Aug 2 15:06:23 monitor: restarting lighttpd

Aug 2 15:06:36 monitor: restarting lighttpd

Aug 2 15:06:48 monitor: restarting lighttpd

Aug 2 15:07:00 monitor: restarting lighttpd

Aug 2 15:07:12 monitor: restarting lighttpd

Aug 2 15:07:24 monitor: restarting lighttpd

Aug 2 15:07:36 monitor: restarting lighttpd

Aug 2 15:07:48 monitor: restarting lighttpd

Aug 2 15:08:00 monitor: restarting lighttpd

Aug 2 15:08:12 monitor: restarting lighttpd

Aug 2 15:08:24 monitor: restarting vtss_appl

Aug 2 15:08:24 monitor: restarting lighttpd

Aug 2 15:08:26 monitor: restarting shellinaboxd

Aug 2 15:08:38 monitor: restarting lighttpd

Aug 2 15:08:50 monitor: restarting lighttpd

Aug 2 15:09:02 monitor: restarting vtss_appl

Aug 2 15:09:02 monitor: restarting lighttpd

Aug 2 15:09:16 monitor: restarting lighttpd

Aug 2 15:09:27 monitor: restarting lighttpd

Aug 2 15:09:39 monitor: restarting vtss_appl

Aug 2 15:09:40 monitor: restarting lighttpd

Aug 2 15:09:53 monitor: restarting vtss_appl

Aug 2 15:09:53 monitor: restarting lighttpd

Aug 2 15:10:06 monitor: restarting lighttpd

Aug 2 15:10:18 monitor: restarting lighttpd

Aug 2 15:10:30 monitor: restarting vtss_appl

Aug 2 15:10:30 monitor: restarting lighttpd

Aug 2 15:10:43 monitor: restarting lighttpd

Aug 2 15:10:55 monitor: restarting lighttpd

Aug 2 15:11:07 monitor: restarting vtss_appl

Aug 2 15:11:08 monitor: restarting lighttpd

Aug 2 15:11:09 monitor: restarting shellinaboxd

Aug 2 15:11:22 monitor: restarting lighttpd

Aug 2 15:11:22 monitor: restarting shellinaboxd

Aug 2 15:11:34 monitor: restarting lighttpd

Aug 2 15:11:47 monitor: restarting lighttpd

Aug 2 15:12:01 monitor: restarting lighttpd

Aug 2 15:12:13 monitor: restarting vtss_appl

Aug 2 15:12:14 monitor: restarting lighttpd

Aug 2 15:12:16 monitor: restarting shellinaboxd

Aug 2 15:12:29 monitor: restarting lighttpd

Aug 2 15:12:29 monitor: restarting shellinaboxd

Aug 2 15:12:41 monitor: restarting lighttpd

Aug 2 15:12:53 monitor: restarting lighttpd

Aug 2 15:13:05 monitor: restarting vtss_appl

Aug 2 15:13:05 monitor: restarting lighttpd

Aug 2 15:13:18 monitor: restarting lighttpd

Aug 2 15:13:30 monitor: restarting vtss_appl

Aug 2 15:13:30 monitor: restarting lighttpd

Aug 2 15:13:43 monitor: restarting lighttpd

Aug 2 15:13:55 monitor: restarting vtss_appl

Aug 2 15:13:55 monitor: restarting lighttpd

Aug 2 15:13:57 monitor: restarting shellinaboxd

Aug 2 15:14:09 monitor: restarting lighttpd

Aug 2 15:14:21 monitor: restarting lighttpd

Aug 2 15:14:33 monitor: restarting lighttpd

Aug 2 15:14:45 monitor: restarting lighttpd

Aug 2 15:14:57 monitor: restarting lighttpd

Aug 2 15:15:09 monitor: restarting lighttpd

Aug 2 15:15:20 monitor: restarting lighttpd

Aug 2 15:15:32 monitor: restarting lighttpd

Aug 2 15:15:44 monitor: restarting lighttpd

Aug 2 15:15:56 monitor: restarting lighttpd

Aug 2 15:16:08 monitor: restarting lighttpd

Aug 2 15:16:20 monitor: restarting lighttpd

Aug 2 15:16:32 monitor: restarting lighttpd

Aug 2 15:16:43 monitor: restarting vtss_appl

Aug 2 15:16:44 monitor: restarting lighttpd

Aug 2 15:16:58 monitor: restarting lighttpd

Aug 2 15:17:10 monitor: restarting lighttpd

Aug 2 15:17:11 monitor: restarting shellinaboxd

Aug 2 15:17:22 monitor: restarting lighttpd

Aug 2 15:17:34 monitor: restarting lighttpd

Aug 2 15:17:46 monitor: restarting vtss_appl

Aug 2 15:17:46 monitor: restarting lighttpd

Aug 2 15:17:47 monitor: restarting shellinaboxd

Aug 2 15:17:59 monitor: restarting lighttpd

Aug 2 15:18:11 monitor: restarting vtss_appl

Aug 2 15:18:11 monitor: restarting lighttpd

Aug 2 15:18:25 monitor: restarting lighttpd

Aug 2 15:18:26 monitor: restarting shellinaboxd

Aug 2 15:18:37 monitor: restarting lighttpd

Aug 2 15:18:49 monitor: restarting lighttpd

Aug 2 15:19:01 monitor: restarting vtss_appl

Aug 2 15:19:01 monitor: restarting lighttpd

Aug 2 15:19:15 monitor: restarting vtss_appl

Aug 2 15:19:15 monitor: restarting lighttpd

Aug 2 15:19:28 monitor: restarting vtss_appl

Aug 2 15:19:29 monitor: restarting lighttpd

Aug 2 15:19:42 monitor: restarting vtss_appl

Aug 2 15:19:43 monitor: restarting lighttpd

Aug 2 15:19:56 monitor: restarting vtss_appl

Aug 2 15:19:57 monitor: restarting lighttpd

Aug 2 15:20:10 monitor: restarting lighttpd

Aug 2 15:20:22 monitor: restarting vtss_appl

Aug 2 15:20:22 monitor: restarting lighttpd

Aug 2 15:20:36 monitor: restarting lighttpd

Aug 2 15:20:48 monitor: restarting lighttpd

Aug 2 15:20:48 monitor: restarting shellinaboxd

Aug 2 15:21:00 monitor: restarting lighttpd

Aug 2 15:21:12 monitor: restarting lighttpd

Aug 2 15:21:23 monitor: restarting lighttpd

Aug 2 15:21:35 monitor: restarting lighttpd

Aug 2 15:21:47 monitor: restarting lighttpd

Aug 2 15:22:01 monitor: restarting vtss_appl

Aug 2 15:22:02 monitor: restarting lighttpd

Aug 2 15:22:16 monitor: restarting lighttpd

Aug 2 15:22:28 monitor: restarting vtss_appl

Aug 2 15:22:28 monitor: restarting lighttpd

Aug 2 15:22:42 monitor: restarting vtss_appl

Aug 2 15:22:42 monitor: restarting lighttpd

Aug 2 15:22:55 monitor: restarting lighttpd

Aug 2 15:23:07 monitor: restarting lighttpd

Aug 2 15:23:19 monitor: restarting lighttpd

Aug 2 15:23:31 monitor: restarting lighttpd

Aug 2 15:23:42 monitor: restarting lighttpd

Aug 2 15:23:54 monitor: restarting vtss_appl

Aug 2 15:23:55 monitor: restarting lighttpd

Aug 2 15:24:07 monitor: restarting vtss_appl

Aug 2 15:24:08 monitor: restarting lighttpd

Aug 2 15:24:21 monitor: restarting lighttpd

Aug 2 15:24:33 monitor: restarting lighttpd

Aug 2 15:24:45 monitor: restarting lighttpd

Aug 2 15:24:57 monitor: restarting lighttpd

Aug 2 15:25:09 monitor: restarting lighttpd

Aug 2 15:25:21 monitor: restarting vtss_appl

Aug 2 15:25:21 monitor: restarting lighttpd

Aug 2 15:25:35 monitor: restarting vtss_appl

Aug 2 15:25:35 monitor: restarting lighttpd

Aug 2 15:25:36 monitor: restarting shellinaboxd

Aug 2 15:25:49 monitor: restarting vtss_appl

Aug 2 15:25:49 monitor: restarting lighttpd

Aug 2 15:25:51 monitor: restarting shellinaboxd

Aug 2 15:26:03 monitor: restarting vtss_appl

Aug 2 15:26:04 monitor: restarting lighttpd

Aug 2 15:26:05 monitor: restarting shellinaboxd

Aug 2 15:26:17 monitor: restarting lighttpd

Aug 2 15:26:29 monitor: restarting lighttpd

Aug 2 15:26:41 monitor: restarting lighttpd

Aug 2 15:26:53 monitor: restarting vtss_appl

Aug 2 15:26:53 monitor: restarting lighttpd

Aug 2 15:26:55 monitor: restarting shellinaboxd

Aug 2 15:27:07 monitor: restarting lighttpd

Aug 2 15:27:08 monitor: restarting shellinaboxd

Aug 2 15:27:20 monitor: restarting lighttpd

Aug 2 15:27:32 monitor: restarting lighttpd

Aug 2 15:27:43 monitor: restarting lighttpd

Aug 2 15:27:55 monitor: restarting vtss_appl

Aug 2 15:27:56 monitor: restarting lighttpd

Aug 2 15:28:09 monitor: restarting data collection daemon

Aug 2 15:28:09 monitor: restarting vtss_appl

Aug 2 15:28:10 monitor: restarting lighttpd

Aug 2 15:28:11 switch[2180]: Detected warm boot

Aug 2 15:28:13 switch[2179]: temp sensor version 1

Aug 2 15:28:23 monitor: restarting data collection daemon

Aug 2 15:28:23 monitor: restarting lighttpd

Aug 2 15:28:37 monitor: restarting data collection daemon

Aug 2 15:28:37 monitor: restarting lighttpd

Aug 2 15:28:38 switch[2271]: Detected warm boot

Aug 2 15:28:41 switch[2270]: temp sensor version 1

Aug 2 15:28:50 monitor: restarting data collection daemon

Aug 2 15:28:50 monitor: restarting lighttpd

Aug 2 15:28:51 switch[2317]: Detected warm boot

Aug 2 15:28:54 switch[2316]: temp sensor version 1

Aug 2 15:29:07 monitor: restarting data collection daemon

Aug 2 15:29:07 monitor: restarting lighttpd

Aug 2 15:29:08 switch[2363]: Detected warm boot

Aug 2 15:29:11 switch[2362]: temp sensor version 1

Aug 2 15:29:24 monitor: restarting lighttpd

Aug 2 15:29:38 monitor: restarting lighttpd

Aug 2 15:29:50 monitor: restarting vtss_appl

Aug 2 15:29:50 monitor: restarting lighttpd

Aug 2 15:30:04 monitor: restarting lighttpd

Aug 2 15:30:15 monitor: restarting lighttpd

Aug 2 15:30:17 switch[2351]: Warning: expected 1 fans but found 0

Aug 2 15:30:27 monitor: restarting lighttpd

Aug 2 15:30:39 monitor: restarting lighttpd

Aug 2 15:30:51 monitor: restarting lighttpd

Aug 2 15:31:03 monitor: restarting vtss_appl

Aug 2 15:31:03 monitor: restarting lighttpd

Aug 2 15:31:16 monitor: restarting lighttpd

Aug 2 15:31:28 monitor: restarting lighttpd

Aug 2 15:31:40 monitor: restarting lighttpd

Aug 2 15:31:40 monitor: restarting shellinaboxd

Aug 2 15:31:52 monitor: restarting lighttpd

Aug 2 15:32:03 monitor: restarting lighttpd

Aug 2 15:32:04 monitor: restarting shellinaboxd

Aug 2 15:32:15 monitor: restarting lighttpd

Aug 2 15:32:26 monitor: restarting lighttpd

Aug 2 15:32:38 monitor: restarting lighttpd

Aug 2 15:32:38 monitor: restarting shellinaboxd

Aug 2 15:32:50 monitor: restarting lighttpd

Aug 2 15:33:01 monitor: restarting lighttpd

Aug 2 15:33:12 monitor: restarting lighttpd

Aug 2 15:33:24 monitor: restarting lighttpd

Aug 2 15:33:36 monitor: restarting lighttpd

Aug 2 15:33:47 monitor: restarting lighttpd

Aug 2 15:33:58 monitor: restarting lighttpd

Aug 2 15:34:10 monitor: restarting lighttpd

Aug 2 15:34:21 monitor: restarting vtss_appl

Aug 2 15:34:22 monitor: restarting lighttpd

Aug 2 15:34:35 monitor: restarting lighttpd

Aug 2 15:34:47 monitor: restarting lighttpd

Aug 2 15:34:59 monitor: restarting lighttpd

Aug 2 15:35:11 monitor: restarting lighttpd

Aug 2 15:35:22 monitor: restarting lighttpd

Aug 2 15:35:34 monitor: restarting lighttpd

Aug 2 15:35:45 monitor: restarting lighttpd

Aug 2 15:35:57 monitor: restarting lighttpd

Aug 2 15:36:08 monitor: restarting lighttpd

Aug 2 15:36:20 monitor: restarting lighttpd

Aug 2 15:36:31 monitor: restarting lighttpd

Aug 2 15:36:43 monitor: restarting lighttpd

Aug 2 15:36:54 monitor: restarting lighttpd

Aug 2 15:37:06 monitor: restarting lighttpd

Aug 2 15:37:17 monitor: restarting lighttpd

Aug 2 15:37:29 monitor: restarting lighttpd

Aug 2 15:37:40 monitor: restarting lighttpd

Aug 2 15:37:52 monitor: restarting lighttpd

Aug 2 15:38:03 monitor: restarting lighttpd

Aug 2 15:38:15 monitor: restarting lighttpd

Aug 2 15:38:26 monitor: restarting lighttpd

Aug 2 15:38:38 monitor: restarting lighttpd

Aug 2 15:38:49 monitor: restarting lighttpd

Aug 2 15:39:01 monitor: restarting lighttpd

Aug 2 15:39:01 monitor: restarting shellinaboxd

Aug 2 15:39:12 monitor: restarting lighttpd

Aug 2 15:39:25 monitor: restarting lighttpd

Aug 2 15:39:40 monitor: restarting lighttpd

Aug 2 15:39:52 monitor: restarting lighttpd

Aug 2 15:40:04 monitor: restarting vtss_appl

Aug 2 15:40:04 monitor: restarting lighttpd

Aug 2 15:40:17 monitor: restarting vtss_appl

Aug 2 15:40:18 monitor: restarting lighttpd

Aug 2 15:40:31 monitor: restarting vtss_appl

Aug 2 15:40:32 monitor: restarting lighttpd

Aug 2 15:40:33 monitor: restarting shellinaboxd

Aug 2 15:40:45 monitor: restarting lighttpd

Aug 2 15:40:57 monitor: restarting data collection daemon

Aug 2 15:40:57 monitor: restarting lighttpd

Aug 2 15:40:58 switch[690]: Detected warm boot

Aug 2 15:41:01 switch[689]: temp sensor version 1

Aug 2 15:41:10 monitor: restarting data collection daemon

Aug 2 15:41:10 monitor: restarting lighttpd

Aug 2 15:41:11 switch[737]: Detected warm boot

Aug 2 15:41:14 switch[736]: temp sensor version 1

Aug 2 15:41:27 monitor: restarting lighttpd

Aug 2 15:41:40 monitor: restarting lighttpd

Aug 2 15:41:51 monitor: restarting lighttpd

Aug 2 15:42:03 monitor: restarting lighttpd

Aug 2 15:42:14 monitor: restarting lighttpd

Aug 2 15:42:19 switch[725]: Warning: expected 1 fans but found 0

Aug 2 15:42:26 monitor: restarting lighttpd

Aug 2 15:42:37 monitor: restarting lighttpd

Aug 2 15:42:49 monitor: restarting lighttpd

Aug 2 15:43:00 monitor: restarting lighttpd

Aug 2 15:43:12 monitor: restarting lighttpd

Aug 2 15:43:23 monitor: restarting lighttpd

Aug 2 15:43:35 monitor: restarting vtss_appl

Aug 2 15:43:35 monitor: restarting lighttpd

Aug 2 15:43:47 monitor: restarting lighttpd

Aug 2 15:43:58 monitor: restarting lighttpd

Aug 2 15:44:10 monitor: restarting lighttpd

Aug 2 15:44:21 monitor: restarting lighttpd

Aug 2 15:44:33 monitor: restarting lighttpd

Aug 2 15:44:46 monitor: restarting lighttpd

Aug 2 15:44:58 monitor: restarting lighttpd

Aug 2 15:45:11 monitor: restarting lighttpd

Aug 2 15:45:22 monitor: restarting lighttpd

Aug 2 15:45:34 monitor: restarting lighttpd

Aug 2 15:45:46 monitor: restarting lighttpd

Aug 2 15:45:58 monitor: restarting lighttpd

Aug 2 15:46:10 monitor: restarting lighttpd

Aug 2 15:46:22 monitor: restarting lighttpd

Aug 2 15:46:34 monitor: restarting lighttpd

Aug 2 15:46:46 monitor: restarting lighttpd

Aug 2 15:46:57 monitor: restarting lighttpd

Aug 2 15:47:09 monitor: restarting lighttpd

Aug 2 15:47:21 monitor: restarting lighttpd

Aug 2 15:47:33 monitor: restarting lighttpd

Aug 2 15:47:44 monitor: restarting lighttpd

Aug 2 15:47:56 monitor: restarting lighttpd

Aug 2 15:48:07 monitor: restarting lighttpd

Aug 2 15:48:19 monitor: restarting lighttpd

Aug 2 15:48:31 monitor: restarting lighttpd

Aug 2 15:48:42 monitor: restarting lighttpd

Aug 2 15:48:54 monitor: restarting lighttpd

Aug 2 15:48:54 monitor: restarting shellinaboxd

Aug 2 15:49:06 monitor: restarting lighttpd

Aug 2 15:49:18 monitor: restarting lighttpd

Aug 2 15:49:30 monitor: restarting lighttpd

Aug 2 15:49:43 monitor: restarting lighttpd

Aug 2 15:49:55 monitor: restarting lighttpd

Aug 2 15:50:08 monitor: restarting lighttpd

Aug 2 15:50:20 monitor: restarting lighttpd

Aug 2 15:50:33 monitor: restarting lighttpd

Aug 2 15:50:46 monitor: restarting data collection daemon

Aug 2 15:50:46 monitor: restarting lighttpd

Aug 2 15:50:47 switch[2366]: Detected warm boot

Aug 2 15:50:50 switch[2365]: temp sensor version 1

Aug 2 15:51:00 monitor: restarting lighttpd

Aug 2 15:51:16 monitor: restarting lighttpd

Aug 2 15:51:28 monitor: restarting lighttpd

Aug 2 15:51:40 monitor: restarting lighttpd

Aug 2 15:51:52 monitor: restarting lighttpd

Aug 2 15:51:56 switch[2354]: Warning: expected 1 fans but found 0

Aug 2 15:52:04 monitor: restarting lighttpd

Aug 2 15:52:17 monitor: restarting lighttpd

Aug 2 15:52:17 monitor: restarting shellinaboxd

Aug 2 15:52:29 monitor: restarting lighttpd

Aug 2 15:52:30 monitor: restarting shellinaboxd

Aug 2 15:52:41 monitor: restarting lighttpd

Aug 2 15:52:53 monitor: restarting lighttpd

Aug 2 15:53:05 monitor: restarting lighttpd

Aug 2 15:53:17 monitor: restarting lighttpd

Aug 2 15:53:29 monitor: restarting lighttpd

Aug 2 15:53:40 monitor: restarting lighttpd

Aug 2 15:53:52 monitor: restarting lighttpd

Aug 2 15:53:52 monitor: restarting shellinaboxd

Aug 2 15:54:04 monitor: restarting lighttpd

Aug 2 15:54:04 monitor: restarting shellinaboxd

Aug 2 15:54:16 monitor: restarting lighttpd

Aug 2 15:54:28 monitor: restarting lighttpd

Aug 2 15:54:40 monitor: restarting lighttpd

Aug 2 15:54:53 monitor: restarting lighttpd

Aug 2 15:55:04 monitor: restarting vtss_appl

Aug 2 15:55:05 monitor: restarting lighttpd

Aug 2 15:55:18 monitor: restarting lighttpd

Aug 2 15:55:30 monitor: restarting vtss_appl

Aug 2 15:55:30 monitor: restarting lighttpd

Aug 2 15:55:44 monitor: restarting vtss_appl

Aug 2 15:55:44 monitor: restarting lighttpd

Aug 2 15:55:45 monitor: restarting shellinaboxd

Aug 2 15:55:58 monitor: restarting lighttpd

Aug 2 15:56:11 monitor: restarting lighttpd

Aug 2 15:56:23 monitor: restarting lighttpd

Aug 2 15:56:35 monitor: restarting lighttpd

Aug 2 15:56:47 monitor: restarting lighttpd

Aug 2 15:56:59 monitor: restarting lighttpd

Aug 2 15:57:10 monitor: restarting lighttpd

Aug 2 15:57:22 monitor: restarting lighttpd

Aug 2 15:57:34 monitor: restarting lighttpd

Aug 2 15:57:45 monitor: restarting lighttpd

Aug 2 15:57:57 monitor: restarting lighttpd

Aug 2 15:58:09 monitor: restarting lighttpd

Aug 2 15:58:21 monitor: restarting lighttpd

Aug 2 15:58:33 monitor: restarting lighttpd

Aug 2 15:58:44 monitor: restarting lighttpd

Aug 2 15:58:56 monitor: restarting lighttpd

Aug 2 15:59:08 monitor: restarting lighttpd

Aug 2 15:59:19 monitor: restarting lighttpd

Aug 2 15:59:32 monitor: restarting vtss_appl

Aug 2 15:59:32 monitor: restarting lighttpd

Aug 2 15:59:45 monitor: restarting lighttpd

Aug 2 15:59:57 monitor: restarting lighttpd

Aug 2 16:00:09 monitor: restarting lighttpd

Aug 2 16:00:21 monitor: restarting lighttpd

Aug 2 16:00:32 monitor: restarting lighttpd

Aug 2 16:00:33 monitor: restarting shellinaboxd

Aug 2 16:00:45 monitor: restarting lighttpd

Aug 2 16:00:45 monitor: restarting shellinaboxd

Aug 2 16:00:57 monitor: restarting lighttpd

Copyright 2014-2024 Neton