centos突然处理假死机状态

ljiayu-nj

重新开机后，只正常2分钟左右，就处理假死机状态，动鼠标和键盘都没反应，服务好象还没停，FTP可以传送文件但速度较慢，不知从何下手

ipaddr

看Log： /var/log/

ljiayu-nj

死机后，手动重启后的日志：
Nov 21 11:05:20 ns named[2815]: unexpected RCODE (SERVFAIL) resolving 'ns1.gslb.
taobao.com/AAAA/IN': 218.108.237.196#53
Nov 21 11:05:20 ns named[2815]: unexpected RCODE (SERVFAIL) resolving 'ns2.gslb.
taobao.com/AAAA/IN': 218.108.237.196#53
Nov 21 11:05:21 ns named[2815]: unexpected RCODE (SERVFAIL) resolving 'alimama.g
slb.taobao.com/AAAA/IN': 60.191.55.39#53
Nov 21 11:05:21 ns named[2815]: unexpected RCODE (SERVFAIL) resolving 'alimama.g
slb.taobao.com/AAAA/IN': 218.108.237.196#53
Nov 21 11:05:24 ns named[2815]: lame server resolving '153.140.118.125.broad.hz.
zj.dynamic.163data.com.cn' (in '163data.com.cn'?): 202.97.7.17#53
Nov 21 11:06:22 ns sshd(pam_unix)[26287]: check pass; user unknown
Nov 21 11:06:22 ns sshd(pam_unix)[26287]: authentication failure; logname= uid=0
euid=0 tty=ssh ruser= rhost=75.102-246-81.adsl-static.isp.belgacom.be
Nov 21 11:06:36 ns named[2815]: lame server resolving '26.5.20.218.broad.gz.gd.d
ynamic.163data.com.cn' (in '163data.com.cn'?): 202.97.7.17#53
Nov 21 11:14:22 ns telnetd[26888]: ttloop: peer died: EOF
Nov 21 11:15:26 ns syslogd 1.4.1: restart.
Nov 21 11:15:26 ns syslog: syslogd 启动 succeeded



Nov 21 11:50:02 ns named[2824]: named.local:7: using RFC1035 TTL semantics
Nov 21 11:50:02 ns named[2824]: zone localhost/IN: loaded serial 2004081201
Nov 21 11:50:02 ns named[2824]: running
Nov 21 11:50:02 ns named[2824]: zone 0.0.127.in-addr.arpa/IN: sending notifies (
serial 20050330)
Nov 21 11:50:05 ns lsb_log_message:  succeeded
Nov 21 11:50:19 ns gdm(pam_unix)[3665]: session opened for user root by (uid=0)
Nov 21 11:50:20 ns gconfd (root-3797): 正在启动(版本 2.8.1)，pid 3797 用户“root
”
Nov 21 11:50:20 ns gconfd (root-3797): 地址“xml:readonly:/etc/gconf/gconf.xml.m
andatory”解析为位于 0 的只读配置源
Nov 21 11:50:20 ns gconfd (root-3797): 地址“xml:readwrite:/root/.gconf”解析为
位于 1 的可写入配置源
Nov 21 11:50:20 ns gconfd (root-3797): 地址“xml:readonly:/etc/gconf/gconf.xml.d
efaults”解析为位于 2 的只读配置源
Nov 21 11:50:22 ns htt_server[2534]: Client shut down the connection owned by im
_id(1).
Nov 21 11:50:27 ns gconfd (root-3797): 地址“xml:readwrite:/root/.gconf”解析为
位于 0 的可写入配置源
Nov 21 11:53:03 ns htt_server[2534]: Invalid message(IC normal state):55
Nov 21 11:53:03 ns htt_server[2534]: Invalid message(IC normal state):41
Nov 21 11:53:14 ns htt_server[2534]: Client shut down the connection owned by im
_id(1).
Nov 21 11:53:14 ns kernel: tg3: eth0: Link is up at 1000 Mbps, full duplex.
Nov 21 11:53:14 ns kernel: tg3: eth0: Flow control is on for TX and on for RX.
Nov 21 11:53:37 ns named[2824]: clients-per-query increased to 11


121.14.73.115#53ns named[2785]: FORMERR resolving 'photo.store.qq.com/AAAA/IN':
Nov 21 14:22:49 ns named[2785]: FORMERR resolving 'photo.store.qq.com/AAAA/IN':
61.135.157.157#53
Nov 21 14:22:49 ns named[2785]: FORMERR resolving 'photo.store.qq.com/AAAA/IN':
60.28.14.124#53
Nov 21 14:22:51 ns sshd(pam_unix)[9855]: check pass; user unknown
Nov 21 14:22:51 ns sshd(pam_unix)[9855]: authentication failure; logname= uid=0
euid=0 tty=ssh ruser= rhost=202.108.34.239
Nov 21 14:22:54 ns sshd(pam_unix)[9866]: check pass; user unknown
Nov 21 14:22:54 ns sshd(pam_unix)[9866]: authentication failure; logname= uid=0
euid=0 tty=ssh ruser= rhost=202.108.34.239
Nov 21 14:22:57 ns sshd(pam_unix)[9869]: check pass; user unknown
Nov 21 14:22:57 ns sshd(pam_unix)[9869]: authentication failure; logname= uid=0
euid=0 tty=ssh ruser= rhost=202.108.34.239
Nov 21 14:23:01 ns sshd(pam_unix)[9872]: authentication failure; logname= uid=0
euid=0 tty=ssh ruser= rhost=202.108.34.239  user=root
Nov 21 14:23:04 ns sshd(pam_unix)[9909]: authentication failure; logname= uid=0
euid=0 tty=ssh ruser= rhost=202.108.34.239  user=root
Nov 21 14:23:06 ns named[2785]: unexpected RCODE (SERVFAIL) resolving '20.238.18
4.199.in-addr.arpa/PTR/IN': 207.59.153.241#53
Nov 21 14:23:07 ns sshd(pam_unix)[9937]: check pass; user unknown
Nov 21 14:23:07 ns sshd(pam_unix)[9937]: authentication failure; logname= uid=0
euid=0 tty=ssh ruser= rhost=202.108.34.239

ljiayu-nj

下午又恢复正常。是被别人黑了吗？应该从哪里看这些相关的日志信息？