Hello Teor
On 4/7/20 11:24 PM, teor wrote:
Hi,
On 7 Apr 2020, at 21:34, ylms tor@yl.ms wrote:
As written above, I run an Exit (for many years, with the current setup since 04.2019) but on 30. March 2020 it stopped, I was unable to determine any reason.
Have you checked tor's logs? They are usually in /var/log/tor/log
The directory /var/log/tor/ is empty, I think the Debian/Ubuntu package logs to syslog per default, but not sure, I cant find anything besides start/stop/reload in the sys log (journalctl to view it).
If you have logrotate configured, they might have already been deleted, because 30 March is more than 1 week ago.
Funnily there is a logrotate job for the folder, it is: /var/log/tor/*log { daily rotate 5 compress delaycompress missingok notifempty create 0640 debian-tor adm sharedscripts postrotate if invoke-rc.d tor status > /dev/null; then invoke-rc.d tor reload > /dev/null fi endscript }
Which would have removed the file as you point out, but still there should be some logs from 3 days ago when it happened again. But as stated above the folder is empty.
So I installed updates and since there were some Kernel updates I also rebooted the machine. The Exit was back up and ran again till ~36h ago. Same situation again, I have no idea why it stopped.
I now activated "Log notice syslog", I think this was in the standard torrc which is installed with the package of Ubuntu 18.04.4 LTS anyway, but there is not entries in journalctl. Only Start/Stop/Reload events are shown in the journal for unit tor.service since 100 day ago.
Have you tried reading /var/log/sys log directly?
Thanks, that was my mistake, I didn't look in the file, but was just looking for tor.service unit entries, but of course the application itself just logs as "tor" or "Tor" and not as tor.service.
So I see some info there, but nothing helpful since I just activated logging yesterday. I will revisit this in a few days when/if the problem occurs again, also I increased the rotation for the log to 14 days and am now logging into /var/log/tor/log.
Could you advise which loglevel I should use to troubleshoot this? I set notice for now, because debug generated too much data.
Can someone help me to troubleshoot this problem, could the fingerprint be blacklisted? In this case would the Exit come back up running for a few days as described above?
Most of the time, blacklisting just makes Tor log a message in its logs. And the directory authorities stop publishing the relay in the consensus.
(We haven't made any changes to required protocols recently. If we do, very old Tor versions may shut down.)
Here's what we need to know to be more helpful:
- your relay fingerprint
- your Tor version
- tor's logs when it shuts down
Thanks again for the help, it is much appreciated.
Regards yl