Saturday, July 10, 2021

Re: pf rules after crash

On Sat, Jul 10, 2021, at 11:30 AM, Stuart Henderson wrote:
> On 2021-07-10, Peter Nicolai Mathias Hansteen <peter@bsdly.net> wrote:
> > For whatever reason your pf.conf did not parse to a valid config, so rc's own default rules were kept in place.
>
> Yep. dmesg -s might give a clue.

Thank you both, I suspected it might be default startup rules but I didn't know they were in /etc/rc.

Since I've rebooted again since the crash I don't think dmesg -s is helpful now, but there are other indicators in /var/log/messages that something wasn't right:

...
Jul 9 17:13:58 ********** ntpd[24315]: constraints configured but none available
Jul 9 17:14:14 ********** ntpd[24954]: no reply received in time, skipping initial time setting
Jul 9 17:14:14 ********** savecore: no core dump
Jul 9 17:14:24 ********** reorder_kernel: kernel relinking done
Jul 9 17:28:58 ********** ntpd[24315]: constraints configured but none available
Jul 9 17:43:58 ********** ntpd[24315]: constraints configured but none available
Jul 9 17:58:58 ********** ntpd[24315]: constraints configured but none available
...

For now I'll chalk it up to an issue with the KVM host (I have a ticket open with the hosting provider asking about the event, since both my VMs on that node crashed at the same time).

If it happens again I will try dmesg -s.

Allan

No comments:

Post a Comment