I have noticed some bizarre behavior on one of my relays.
I logged into the server hosting particlefive (bridge) on November 15 and noticed that the tor process had crashed (not a clean exit). I had accounting set up, so it had hibernated from 11/07 00:00 UTC to 11/07 00:44 UTC. After that, it appeared to be running normally, but it crashed sometime after 11/07 06:25 UTC. I don't have crash dumps enabled, so I don't have any information on the crash. I restarted it and it appeared to have been working normally. I checked on it again on the 16th and all was well. On December 2nd, it suddenly stopped receiving client connections. According to the metrics page, it hasn't passed any traffic since then, though the logs show 20 - 60 GB per heartbeat interval. The log rotation has gone strange as well. As of today:
notices.log - 12/29 06:25 to 12/29 12:20 notices.log.1 - 12/28 06:25 to 12/29 06:20 notices.log.2 - 11/06 06:25 to 11/07 06:25 notices.log.3 - 12/26 06:25 to 12/27 06:25 notices.log.4 - 12/25 06:25 to 12/26 06:25 notices.log.5 - 12/23 06:25 to 12/24 06:25
So, the log from the day before the crash is still hanging around with no unusual activity shown, and I'm missing the log file for 12/24. At this point, it seems to be running normally, but it is not receiving any new connections.
Yesterday, I changed the configuration from accounting to bandwidth limiting, so notices.log.1 has the hup I sent to reload the configuration. However, notices.log.3 also shows a hup signal at 06:25 UTC that I did not send.
I should probably report this on the tor-dev list, but moderation on that list appears to be pretty slow, and this list is more active. I was wondering if anyone else has seen this kind of odd activity on a bridge before. My paranoia alarm is in yellow status, so I'm about to dump this relay, get a new IP, and start over.
Any advice is appreciated.
No me preguntas nada, no te digo una mentira. Enrollado
Sent with ProtonMail Secure Email.