NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
ReadyNAS 214 - Freezing / Locking Up
Hello, I have a ReadyNAS 214 4 Bay Unit and running Version 6.10.3. On September 3, I was not able to access the unit from my browser. When I checked the unit, the lights were blinking and t...
Hi Stephen,
Thanks very much for the response. Per your note, I downloaded the logs and received the zip file. When I opened the System.log file, it only had 535 bytes of information which was several lines from today only, i.e., less than one day and nothing else. My UI says I have over 3800 entries in the log. Is there something special I need to do to get the complete log downloaded? Also, the Kernal.log file was empty. I can upload the zip file, or other individual files, if you think that would help.
Thanks again,
Terry
It looks like those logs have already rotated, so they're no longer on the NAS. You could perhaps look in disk-info.log, and make sure the SMART stats for your disks are ok.
I suggest capturing the logs again - either the next time you forcibly reboot, or perhaps if you see the restart messages in the log.
Don't post the full logs here - it's ok to cut/paste part of them them, but there is some privacy leakage if you post them all.
Hi Stephen,
Here is what is interesting when I look in the system.log. The very first line in the text file says:
-- Logs begin at Sun 2020-11-22 19:41:48 EST, end at Mon 2020-11-23 09:45:35 EST. --
which would say to me that I had a good amount of information. However, the entry immediately below the one above is:
Nov 23 06:49:48 MajorTom sshd[21462]: SSH: Server;Ltype: Authname;Remote: 120.53.121.178-41702;Name: root [preauth]
If the log really started on 11/22, where is the data?
I looned at the disk-info.log and everything looked good as does the UI dashboard.
Per your note, I will download the log files the next time I see an issue but given what I see above, it looks like the system.log is really not capturing the information as indicated in the first entry.
Thanks mucn,
Terry
Hi Stephen,
Today I discovered my NAS had locked up again, i.e., when I tried to access it from my browser, no response. Also, pushing the power button did not prompt me asking if I wanted to shut down, so I had to pull the plug again, and luckily, it came back up, all fine. The time of the power down and restart is about 09:54:31, I believe.
When the system came back up and I was able to access my browser, I checked the logs and saw that my sync job that runs twice a week to a remove Netgear NAS, worked fine and there were these entries in the log:
Nov 26, 2020 09:57:10 AM System: ReadyNASOS background service started. Nov 26, 2020 09:57:08 AM System: ReadyNASOS service or process (readynasd,snapshot_monito) was restarted. Nov 24, 2020 05:50:08 AM System: Antivirus scanner definition file was updated to 59.25997. Nov 23, 2020 05:59:56 AM System: ReadyNASOS background service started. Nov 23, 2020 05:59:34 AM System: Antivirus scanner definition file update failed due to download failure. Check your Internet connection. Nov 23, 2020 05:59:55 AM System: ReadyNASOS service or process (sysadm) was restarted. Nov 23, 2020 12:14:28 AM Backup: Successfully completed backup job VA_Files --» NJ. You can see that the system was restarted at 05:59, for some reason and there were issues with the anti-virus file but a new virus file was downloaded.
Per you direction, I was able to download all of the log files and looked in the system.log. Luckily there was enough entries in the log that started at about 08:27 and continued to 10:06 and the reboot was 09:56:40, see below
Nov 26 09:54:31 MajorTom connmand[2005]: ntp: adjust (slew): +0.001440 sec
-- Reboot --
Nov 26 09:56:40 MajorTom mdadm[1978]: NewArray event detected on md device /dev/md0In looking at the entries prior to the reboot, I am seeing what appears to be attempted breaches of the device. I am seeing several IP addresses I don't recognize, For example:
Nov 26 08:27:23 MajorTom sshd[29754]: Failed password for root from 112.85.42.183 port 45794 ssh2
Nov 26 08:27:27 MajorTom sshd[29760]: Failed password for invalid user adm from 31.184.199.114 port 64548 ssh2
Nov 26 08:27:29 MajorTom sshd[29762]: SSH: Server;Ltype: Kex;Remote: 38.72.132.186-48692;Enc: aes256-ctr;MAC: hmac-sha1;Comp: none [preauth]
One even reference a site in the UK
Nov 26 08:27:33 MajorTom sshd[29764]: reverse mapping checking getaddrinfo for 89-105-113-254.fluidata.co.uk [89.105.113.254] failed - POSSIBLE BREAK-IN ATTEMPT!
The log says that the NAS anti-virus file was updated at 05:50 and my NAS is behind my Google WiFi router.
The examples above are just a sampling of the IP addresses I don't recognize, i.e., there are others. Not sure if the system is locking up due to the number of attempts, or not.
All that said, not sure if this points us to the root cause, or not, but it is very disturbing to me. If these are attempted break-ins, is there a way in the NAS to only accept IP requests from one place, i.e., my remote identical NAS where I exchange information? Are there other safeguards I can put in place?
The system file is about 570K so can provide that, if it would help. I can also send to you privately, if that is preferred. I can also provide an extract, if that would be better.
Thanks very much for your thoughts and Happy Thanksgiving!
Terry
TS_SML wrote:
Nov 26 08:27:23 MajorTom sshd[29754]: Failed password for root from 112.85.42.183 port 45794 ssh2
Nov 26 08:27:27 MajorTom sshd[29760]: Failed password for invalid user adm from 31.184.199.114 port 64548 ssh2
Nov 26 08:27:29 MajorTom sshd[29762]: SSH: Server;Ltype: Kex;Remote: 38.72.132.186-48692;Enc: aes256-ctr;MAC: hmac-sha1;Comp: none [preauth]
Nov 26 08:27:33 MajorTom sshd[29764]: reverse mapping checking getaddrinfo for 89-105-113-254.fluidata.co.uk [89.105.113.254] failed - POSSIBLE BREAK-IN ATTEMPT!
Have you forwarded port 22 in the router to the NAS?
Or put the NAS in the router's DMZ?
If so, you should undo the forwarding (and take the NAS out of the DMZ).
What protocol are you using for the remote backup?
On the lock-ups perhaps try disabling ClamAV and see if anything changes.
NETGEAR Academy
Boost your skills with the Netgear Academy - Get trained, certified and stay ahead with the latest Netgear technology!
Join Us!
