debian日志分析

1.

root@dee:/var/log# more kern.log.1
Mar 27 18:25:01 db24 kernel: imklog 4.4.0, log source = /proc/kmsg started.
Mar 28 18:25:01 db24 kernel: imklog 4.4.0, log source = /proc/kmsg started.
Mar 29 18:25:01 db24 kernel: imklog 4.4.0, log source = /proc/kmsg started.
Mar 30 18:25:01 db24 kernel: imklog 4.4.0, log source = /proc/kmsg started.
Mar 31 03:00:21 db24 kernel: [21944411.117618] UDP: bad checksum. From 114.80.134.10:53 to 60.217.236.24:724 ulen 43
Mar 31 03:00:21 db24 kernel: [21944411.357004] UDP: bad checksum. From 114.80.134.10:53 to 60.217.236.24:724 ulen 43
Mar 31 03:00:23 db24 kernel: [21944413.170238] UDP: bad checksum. From 114.80.134.10:53 to 60.217.236.24:724 ulen 43
Mar 31 18:25:01 db24 kernel: imklog 4.4.0, log source = /proc/kmsg started.

 

解决：

1.

一般类的提示
UDP: bad checksum. From 221.200.X.X:50279 to 218.62.X.X:1155 ulen 24
UDP: short packet: 218.2.X.X:3072 3640/217 to 222.168.X.X:57596
218.26.131.X sent an invalid ICMP type 3, code 13 error to a broadcast: 0.1.0.4 on eth0
服务器收到了一个错误的数据包.分别为 UDP校验和错误; 过短的UDP数据包; 一个错误的ICMP类型数据. 这类信息一般情况下也是非法产生的.
但一般问题不大可直接忽略.

 

2.

The message orginates from the udp (udp.c) part of the ipv4 TCP/IP protocol
suite in the Linux kernel.
[udp.c:printk(KERN_DEBUG "UDP: bad checksum. From %d.%d.%d.%d:%d to
%d.%d.%d.%d:%d ulen %d/n",..]
Machine 192.168.1.200 is sending malformed UPD-packets to ip-address
10.1.0.3, port 62516. Size is 25 bytes.
CIPE does not check the UDP checksum, leaving it to the TCP/IP stack.

As far I can see, port 62516 is not used by CIPE, so probably it is not
_directly_ related to CIPE. I also can't find the ip-address 192.168.1.200
in your configs, so it seems that the orginating address isn't related to
the CIPE setup too.

Possibly some network configuration error is causing this.

 

 

2.

root@debian:/var/log# more kern.log.1
Mar 28 06:25:01 web23 kernel: imklog 4.4.0, log source = /proc/kmsg started.
Mar 29 06:25:01 web23 kernel: imklog 4.4.0, log source = /proc/kmsg started.
Mar 30 06:25:01 web23 kernel: imklog 4.4.0, log source = /proc/kmsg started.
Mar 31 06:25:02 web23 kernel: imklog 4.4.0, log source = /proc/kmsg started.
Apr  1 06:25:01 web23 kernel: imklog 4.4.0, log source = /proc/kmsg started.
Apr  2 06:25:03 web23 kernel: imklog 4.4.0, log source = /proc/kmsg started.
Apr  2 06:25:03 web23 kernel: Kernel logging (proc) stopped.

 

 

 

 

3.

root@debian:/var/log# more kern.log
Apr  4 06:25:05 kin kernel: imklog 3.18.6, log sourc