# suspicious init entries in syslog

## toralf

I do wonder about these entries in my syslog at my server :

```
Dec 28 15:46:17 tor-relay init[1]: Trying to re-exec init

Dec 28 15:46:17 tor-relay init[1]: no more processes left in this runlevel

```

Any hints ?

----------

## khayyam

toralf ...

did you happen to have updated glibc during this timeframe?

```
# qlop -Cl | egrep '^(Sun|Mon) Dec 2(7|8).*2015'
```

... or perhaps some other package update, sys-apps/sysvinit for instance, that might call 'telinit u'?

best ... khay

----------

## toralf

Hhnm, it started around 11th :

```
tor-relay ~ # zgrep 'init\[' /var/log/messages* | cut -f2- -d':' | sort

Dec 11 12:23:47 tor-relay init[1]: no more processes left in this runlevel

Dec 11 12:23:47 tor-relay init[1]: Trying to re-exec init

Dec 12 20:05:03 tor-relay init[1]: Switching to runlevel: 6

Dec 12 20:07:34 tor-relay init[1]: no more processes left in this runlevel

Dec 14 18:38:57 tor-relay init[1]: no more processes left in this runlevel

Dec 14 18:38:57 tor-relay init[1]: Trying to re-exec init

Dec 15 16:45:36 tor-relay init[1]: no more processes left in this runlevel

Dec 15 16:45:36 tor-relay init[1]: Trying to re-exec init

```

and the only upgrade there were to net-misc/tor-0.2.7.6

----------

## khayyam

toralf ...

ok, on the basis of frequency, and the lack of pattern to date/time, I'd be suspicious. What comes prior to those date/times in the log?

best ... khay

----------

## toralf

 *khayyam wrote:*   

> toralf ...
> 
> ok, on the basis of frequency, and the lack of pattern to date/time, I'd be suspicious. What comes prior to those date/times in the log?
> 
> best ... khay

 No picture AFAICS, 

```
zgrep -B 4 -A 4 'init\[' /var/log/messages* | cut -f2- -d':' | wgetpaste
```

is in https://bpaste.net/show/309860c7b9aa

----------

## Anon-E-moose

I would roll back tor and see if the problem goes away.

and are you running systemd or something that would automatically respawn tor?

----------

## toralf

Oh no, I do not run nor I do plan to run systemd on my server.

----------

## khayyam

 *toralf wrote:*   

>  *khayyam wrote:*   on the basis of frequency, and the lack of pattern to date/time, I'd be suspicious. What comes prior to those date/times in the log? 
> 
> No picture AFAICS

 

toralf ... I see a picture, they all occur after cron.hourly/0anacron. Cron is running a number of log-check, sysstat, auditd, and build processes/scripts any of which may be triggering a 'telinit u'.

best ... khay

----------

