ssh hangs and service ssh stopped

[Karthikeyan.j]

Hi
i had a problem in one of our servers
server got hanged server was not responding.
and ssh was stopped and we tried restarted ssh service on the server but still the server was not reachable thru ssh , server was pingable .

what can be the problem , and also pls let me know is there any way we can find out who has rebooted the server or fiddled with the server .

[Stuart Browne]

Log files. Look through them.

It should give you a reason as to why 'sshd' died, or why it failed to restart.

Use the 'last' to see who was on when the server last restarted.

[Karthikeyan.j]

thx for the reply

i had check the log but no info about ssh failed or hanged .

last doent give any clear details of who rebooted.

Pls let me know if there is any software for finding miuse of the servers.

[Ralph Grothe]

You should look for log messages by sshd.

# grep sshd /var/log/messages

Remember, that if you have logrotation for messages to also look in the already rotated files (they may be zipped, depending on your config).

Check if sshd is configured to be started by init.
If you have a RedHat based distro you can try

# chkconfig --list sshd
sshd 0:off 1:off 2:on 3:on 4:on 5:on 6:off

If it isn't listed it might either be called differently on your system, or simply not yet added.

Did you install sshd as part of a package,
or did you compile it yourself?

On RPM based distros you could try

# rpm -qa | grep ssh

On RHES4 the package name for the server is this, and these are its config files.

# rpm -qc openssh-server
/etc/pam.d/sshd
/etc/rc.d/init.d/sshd
/etc/ssh/sshd_config

If you have a self-built version try locating the config file like

# find /etc /usr /opt -type f -name ssh\*conf\*

Try starting as service (on RH),
or via init like

# service sshd start

or

# /etc/init.d/ssh start

You should definitely find entries in /var/log/messages.

Does your sshd_conf use unusual listen ports?
If not, look if sshd is listening on 22/tcp

# netstat -tlnp | grep :22
tcp 0 0 :::22 :::* LISTEN 2117/sshd

[Basheer_2]

Hello,

w and uptime will give you how long the system is up.

did anybody reboot, check using

last reboot

ssh
check date/time stamps on ssh config files, if anybody modified

ls -ls /etc/ssh/ssh*config