Troubleshooting 73
General Considerations
The general issues to take into consideration when troubleshooting your OpenVZ system are
listed below. You should read them carefully before trying to solve more specific problems.
You should always remember where you are located now in your terminal. Check it
periodically using the
pwd
,
hostname
,
ifconfig
,
cat /proc/vz/veinfo
commands. One and the same command executed inside a VPS and at the HN can lead to
very different results! You can also set up the
PS1
environment variable to show the full
path in the
bash
prompt. To do that, add these lines to
/root/.bash_profile
:
PS1="[\u@\h \w]$ "
export PS1
If the Hardware Node slows down, use
vmstat
,
ps
(
ps axfw
),
dmesg
,
top
to find out
what is happening, never reboot the machine without investigation. If no thinking helps
restore the normal operation, use the Alt+SysRq sequences to dump the memory
(
showMem
) and processes (
showPc
). See
Using ALT+SYSRQ Keyboard Sequences
section
for more information.
If the Hardware Node was incorrectly brought down, on its next startup all the partitions
will be checked and quota recalculated for each VPS, which dramatically increases the
startup time.
Do not run any binary or script that belongs to a VPS directly from the Hardware Node, for
example,
do not
ever do that:
cd /vz/root/99/etc/init.d
./httpd status
Any script inside a VPS could have been changed to whatever the VPS owner chooses: it could
have been trojaned, replaced to something like
rm -rf
, etc. You can use only
vzctl exec
or
vzctl enter
to execute programs inside a VPS.
Do not use init scripts at the Hardware Node. An init script may use
killall
to stop a
service, which means that all similar processes will be killed in all VPSs! You can check
/var/run/
service
.pid
and kill the correspondent process explicitly.
You must be able to detect any rootkit inside a VPS. It is recommended to use the
chkrootkit
package for detection (you can download the latest version from
www.chkrootkit.org
), or at least run
rpm -Va|grep "S.5"
to check up if the MD5 sum has changed for any RPM file.
You can also run
nmap
, for example:
# nmap -p 1-65535 192.168.0.1
Starting nmap V. 2.54BETA22 ( www.insecure.org/nmap/ )
Interesting ports on (192.168.0.1):
(The 65531 ports scanned but not shown below are in
state: closed)
Port State Service
21/tcp open ftp
22/tcp open ssh
80/tcp open http
111/tcp open sunrpc