I have looked into yast2 and system services, expert. Many services are listed there as 2 3 5 or 3 5

But most of these systems didnt get started in this safe mode. Is this normal? Maybe thats a clue. Whoever is in charge or can prevent systems from starting in general (these apparmor or policy things?) are maybe messed up?

Thanks.

p.s. as I mentioned, I needed to start rcnamed rcsquid rcsshd rcntp manually to get this safe-mode system working in a basic way.


Additionally I have discovered that the /var/log/messages file stopped at last night 03:00, with the following last entries, right before it tried to execute the reboot command, but where it still hang this morning.

------

Apr 30 03:00:34 boxname smartd[3452]: smartd received signal 15: Terminated
Apr 30 03:00:34 boxname smpppd[3139]: terminating on signal 15
Apr 30 03:00:34 boxname smartd[3452]: Device: /dev/sdc [SAT], state written to /var/lib/smartmontools/smartd.SAMSUNG_HD403LJ-S0NFJ1BP400648.ata.state
Apr 30 03:00:34 boxname smartd[3452]: smartd is exiting (exit status 0)
Apr 30 03:00:34 boxname sshd[29979]: Received signal 15; terminating.
Apr 30 03:00:34 boxname avahi-dnsconfd[2510]: Got SIGTERM, quitting.
Apr 30 03:00:35 boxname auditd[2357]: The audit daemon is exiting.
Apr 30 03:00:35 boxname named[29770]: received control channel command 'stop'
Apr 30 03:00:35 boxname named[29770]: shutting down: flushing changes
Apr 30 03:00:35 boxname named[29770]: stopping command channel on 127.0.0.1#953
Apr 30 03:00:35 boxname named[29770]: no longer listening on 127.0.0.1#53
Apr 30 03:00:35 boxname named[29770]: no longer listening on 192.168.15.254#53
Apr 30 03:00:35 boxname named[29770]: no longer listening on 192.168.16.254#53
Apr 30 03:00:35 boxname named[29770]: exiting
Apr 30 03:00:35 boxname avahi-daemon[2473]: Got SIGTERM, quitting.
Apr 30 03:00:35 boxname avahi-daemon[2473]: Leaving mDNS multicast group on interface eth3.IPv4 with address 192.168.16.254.
Apr 30 03:00:35 boxname avahi-daemon[2473]: Leaving mDNS multicast group on interface eth2.IPv4 with address 192.168.15.254.
Apr 30 03:00:35 boxname avahi-daemon[2473]: Leaving mDNS multicast group on interface eth0.IPv4 with address 10.168.15.254.
Apr 30 03:00:35 boxname avahi-daemon[2473]: avahi-daemon 0.6.28 exiting.
Apr 30 03:00:35 boxname saslauthd[29820]: server_exit     : master exited: 29820
Apr 30 03:00:35 boxname squid[3444]: Preparing for shutdown after 415630 requests
Apr 30 03:00:35 boxname squid[3444]: Waiting 30 seconds for active connections to finish
Apr 30 03:00:35 boxname squid[3444]: FD 10 Closing HTTP connection
Apr 30 03:00:35 boxname squid[3444]: FD 12 Closing HTTP connection
Apr 30 03:00:35 boxname squid[3444]: FD 13 Closing HTTP connection
Apr 30 03:00:35 boxname squid[3444]: Shutting down...
Apr 30 03:00:35 boxname squid[3444]: FD 14 Closing ICP connection
Apr 30 03:00:35 boxname squid[3444]: FD 15 Closing SNMP socket
Apr 30 03:00:35 boxname squid[3444]: Closing unlinkd pipe on FD 11
Apr 30 03:00:35 boxname squid[3444]: storeDirWriteCleanLogs: Starting...
Apr 30 03:00:35 boxname squid[3444]:   Finished.  Wrote 8526 entries.
Apr 30 03:00:35 boxname squid[3444]:   Took 0.0 seconds (1429098.2 entries/sec).
Apr 30 03:00:35 boxname squid[3444]: logfileClose: closing log /var/log/squid/store.log
Apr 30 03:00:35 boxname squid[3444]: logfileClose: closing log /var/log/squid/access.log
Apr 30 03:00:35 boxname kernel: [4339442.458622] audit_printk_skb: 48 callbacks suppressed
Apr 30 03:00:35 boxname kernel: [4339442.458627] type=1400 audit(1304125235.643:28): apparmor="STATUS" operation="profile_remove" name="/bin/ping" pid=17113 comm="boot.apparmor"
Apr 30 03:00:35 boxname kernel: [4339442.458760] type=1400 audit(1304125235.643:29): apparmor="STATUS" operation="profile_remove" name="/sbin/klogd" pid=17113 comm="boot.apparmor"
Apr 30 03:00:35 boxname kernel: [4339442.458853] type=1400 audit(1304125235.643:30): apparmor="STATUS" operation="profile_remove" name="/sbin/syslog-ng" pid=17113 comm="boot.apparmor"
Apr 30 03:00:35 boxname kernel: [4339442.458941] type=1400 audit(1304125235.643:31): apparmor="STATUS" operation="profile_remove" name="/sbin/syslogd" pid=17113 comm="boot.apparmor"
Apr 30 03:00:35 boxname kernel: [4339442.459089] type=1400 audit(1304125235.644:32): apparmor="STATUS" operation="profile_remove" name="/usr/lib/apache2/mpm-prefork/apache2" pid=17113 comm="boot.apparmor"
Apr 30 03:00:35 boxname kernel: [4339442.459189] type=1400 audit(1304125235.644:33): apparmor="STATUS" operation="profile_remove" name="/usr/lib/dovecot/deliver" pid=17113 comm="boot.apparmor"
Apr 30 03:00:35 boxname kernel: [4339442.459295] type=1400 audit(1304125235.644:34): apparmor="STATUS" operation="profile_remove" name="/usr/lib/dovecot/dovecot-auth" pid=17113 comm="boot.apparmor"
Apr 30 03:00:35 boxname kernel: [4339442.459391] type=1400 audit(1304125235.644:35): apparmor="STATUS" operation="profile_remove" name="/usr/lib/dovecot/imap" pid=17113 comm="boot.apparmor"
Apr 30 03:00:35 boxname kernel: [4339442.459494] type=1400 audit(1304125235.644:36): apparmor="STATUS" operation="profile_remove" name="/usr/lib/dovecot/imap-login" pid=17113 comm="boot.apparmor"
Apr 30 03:00:35 boxname kernel: [4339442.459601] type=1400 audit(1304125235.644:37): apparmor="STATUS" operation="profile_remove" name="/usr/lib/dovecot/managesieve-login" pid=17113 comm="boot.apparmor"
Apr 30 03:00:35 boxname squid[3444]: Squid Cache (Version 2.7.STABLE6): Exiting normally.
Apr 30 03:00:35 boxname squid[3442]: Squid Parent: child process 3444 exited with status 0
Apr 30 03:00:37 boxname rpcbind: rpcbind terminating on signal. Restart with "rpcbind -w"
Apr 30 03:00:37 boxname kernel: Kernel logging (proc) stopped.
Apr 30 03:00:37 boxname rsyslogd: [origin software="rsyslogd" swVersion="5.6.5" x-pid="12325" x-info="http://www.rsyslog.com"] exiting on signal 15.


----------

everything as of logs stopped at 03:00 last night until I tried the several reboot attempts this morning.

stolen console rings a bell..

hmm, do you use systemd?

did you reboot the system any time in the weeks before?

smells like https://bugzilla.novell.com/show_bug.cgi?id=642289

Can you roughly browse through my bugreports from the more recent past? I think there was a systemd stuff discussion around. Dont remember.

Maybe I am confusing things. There is this new mechanism in suse 11.4 instead of these rcnamed commands and rcyournamehere there was this newer project that some recent linux distributions have switched to. It had to do with big dumps of kernel logs in /var/log/messages on a kernel update. I think i reported this or participated in the beta stages of 11.4. There were many confusing logs filling up the disk back then in that bugreport.

Maybe it has to do something with it. But to say in general, I never switched anything severe or deep in my opensuse distributions in the recent years. I have always used the default opensuse stuff that came with every release. Whenever you guys made changes I guess I have received those changes in settings and daemons and mechanisms how opensuse works.


p.s. inside the safe mode via ssh it says:
rpm -aq | grep -i systemd
(no results)

box:/tmp # rpm -aq | grep -i systemd
box:/tmp # rpm -aq | grep -i system
systemtap-runtime-1.4-1.2.3.i586
filesystem-11.4-11.14.1.i586
box:/tmp # rpm -aq | grep -i log
libqdialogsolver1-1.3.0-8.2.i586
rsyslog-5.6.5-1.3.1.i586
syslog-ng-3.2.2-5.1.i586
klogd-1.4.1-730.1.i586
login-4.0-7.10.1.i586
libevtlog0-0.2.9-6.1.i586
dialog-1.1-42.1.i586
logrotate-3.7.9-5.1.i586
syslogd-1.4.1-730.1.i586

rpm -aq | grep -i sys
systemtap-runtime-1.4-1.2.3.i586
rsyslog-5.6.5-1.3.1.i586
sysconfig-0.74.5-5.1.i586
syslog-ng-3.2.2-5.1.i586
sysvinit-tools-2.88-37.45.1.i586
kdebase4-workspace-ksysguardd-4.6.0-10.15.1.i586
filesystem-11.4-11.14.1.i586
sysvinit-2.88-37.45.1.i586
sysfsutils-2.1.0-139.1.i586
yast2-sysconfig-2.17.0-62.2.noarch
syslogd-1.4.1-730.1.i586

btw, as I said its a long-term system being updated and upgraded for a long time, I am still coming from reiser filesystems if thats supposed to matter....

# mount
devtmpfs on /dev type devtmpfs (rw,relatime,size=1009332k,nr_inodes=214648,mode=755)
tmpfs on /dev/shm type tmpfs (rw,relatime)
/dev/sda3 on / type reiserfs (rw,relatime)
proc on /proc type proc (rw,relatime)
sysfs on /sys type sysfs (rw,relatime)
debugfs on /sys/kernel/debug type debugfs (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,gid=5,mode=620,ptmxmode=000)
/dev/sda2 on /boot type ext3 (rw,relatime,errors=continue,barrier=1,data=ordered)
securityfs on /sys/kernel/security type securityfs (rw,relatime)
proc on /var/lib/named/proc type proc (ro,nosuid,nodev,noexec,relatime)
proc on /var/lib/ntp/proc type proc (ro,nosuid,nodev,relatime)

Created attachment 427417 [details]
zypper.log extract from last nights zypper events

zip file.
zypper.log extract from last nights zypper events

rcsyslog wasnt started either. I started it in this safemode and a few messages arrived, also the most recent boot.msg
any more information needed?

is my bug also the same bug you linked above about sysvinittools?
also: i cannot access that swamp url you posted in the other bug
https://swamp.suse.de/webswamp/swamp/template/DisplayWorkflow.vm/workflowid/40537
it just times out on me. server never replies. i think i have come across swamp urls a number of times in the past. most of those times i tried to access it, the server never replied back and no website was being displayed. is that swamp server overloaded that it cant cope with load?
thanks.

the swamp url is not relevant (internal update tracking only)

The symptoms just read very much the same to me, so I suspect this is the same.
Havent investigated.

you could try moving /sbin/blogd  away, or the test aaa_base package from:

https://build.opensuse.org/package/binaries?arch=x86_64&package=aaa_base&project=home%3AWernerFink%3Abranches%3AopenSUSE%3A11.4%3AUpdate%3ATest&repository=standard

yep that helped. renamed the file /sbin/blogd
system starts up in normal non-safe mode normally now.

does this have any effects on the system when there is no /sbin/blogd?
is the bug already figured out with /sbin/blogd or whatever interaction there is with it with other parts?

also before i rebooted right now: there was the blogd: console screen stolen at line 266 or whatever it was in red color on the screen on alt+f1.

thanks for this information. is it better to install the build.opensuse.org url you mentioned above or should i wait for a normal update via zypper/you mechanisms?

as you have a working workaround, wait for the official updates I would say.

there is no large drawback, it is basically just for boot logging according to the manpa.ge

thanks again. will wait for the official package then. have some other 11.4 boxes waiting as well before i can go for those kernel and other recent update packages

Already know and fixed

*** This bug has been marked as a duplicate of bug 642289 ***

can i safely now rename/move back my previously present  /sbin/blogd  binary file?

the aaa_ updates didnt bring it back or replace it with a new build, and this blogd file was also belonging to these sysvinit-tools if i am not mistaken. i have still my renamed disabled file in sbin from this incident.

is sysvinit-tools now working again normally with the new aaa_ updates?

thanks.

-----

# rpm -aq | grep -i sysvinit
sysvinit-tools-2.88-37.45.1.i586
sysvinit-2.88-37.45.1.i586

# ls *log* -lart
-rwxr-xr-x 1 root root   2119 Aug 18  2010 save_y2logs
-rwxr-xr-x 1 root root  43936 Feb 18 01:00 syslogd
-rwxr-xr-x 1 root root  30544 Feb 18 01:00 klogd
-rwxr-xr-x 1 root root   9864 Feb 18 15:53 logsave
-rwxr-xr-x 1 root root 250288 Feb 18 18:18 jfs_logdump
-rwxr-xr-x 1 root root 204620 Feb 18 18:18 jfs_fscklog
-rwxr-xr-x 1 root root  18508 Feb 19 01:07 syslog-ng
-rwxr-xr-x 1 root root   5672 Feb 22 17:44 nologin
lrwxrwxrwx 1 root root     18 Mar 10 20:44 rcsyslog -> /etc/init.d/syslog
-rwxr-xr-x 1 root root 379908 Mar 25 17:52 rsyslogd
-rwx------ 1 root root   9800 Apr  6 13:38 blogger
-rwx------ 1 root root  38904 Apr  6 13:38 blogd.sysvinit-tools-2.88-37.45.1.i586.badshit
-rwxr-xr-x 1 root root  14076 Apr  6 13:38 sulogin

Make sure that aaa_base is at least aaa_base-11.4-54.64.1
then you should be safe to restore  /sbin/blogd

i had some other 11.4 machine waiting and i tried it all there, first going to the current aaa_ packages and only then going for the recent kernel update. the machine came back normally after reboot.

# rpm -aq | grep -i sysvin
sysvinit-2.88-37.45.1.i586
sysvinit-tools-2.88-37.45.1.i586
tux:~ # rpm -aq | grep -i aaa_
aaa_base-extras-11.4-54.64.1.i586
aaa_base-11.4-54.64.1.i586
tux:~ # rpm -aq | grep -i kernel
kernel-firmware-2.6.38-1.2.1.noarch
kernel-desktop-2.6.37.6-0.5.1.i586
nfs-kernel-server-1.2.3-11.14.1.i586


/sbin # ls -lart *log*
-rwxr-xr-x 1 root root   2119 Aug 18  2010 save_y2logs
-rwxr-xr-x 1 root root  30544 Feb 18 01:00 klogd
-rwxr-xr-x 1 root root   9864 Feb 18 15:53 logsave
-rwxr-xr-x 1 root root 250288 Feb 18 18:18 jfs_logdump
-rwxr-xr-x 1 root root 204620 Feb 18 18:18 jfs_fscklog
-rwxr-xr-x 1 root root  18508 Feb 19 01:07 syslog-ng
-rwxr-xr-x 1 root root   5672 Feb 22 17:44 nologin
-rwxr-xr-x 1 root root 379908 Mar 25 17:52 rsyslogd
-rwx------ 1 root root   9800 Apr  6 13:38 blogger
-rwx------ 1 root root  38904 Apr  6 13:38 blogd
-rwxr-xr-x 1 root root  14076 Apr  6 13:38 sulogin
lrwxrwxrwx 1 root root     18 Apr 16 23:17 rcsyslog -> /etc/init.d/syslog

and the blogd file on that machine was never altered.
thanks for the fixes.