Re: [tor-relays] Exit stops after one year, then again after few days

[ylms <tor@xxxxx>]

Hello Teor


On 4/7/20 11:24 PM, teor wrote:
> Hi,
> 
>> On 7 Apr 2020, at 21:34, ylms <tor@xxxxx> wrote:
>>
>> As written above, I run an Exit (for many years, with the current setup
>> since 04.2019) but on 30. March 2020 it stopped, I was unable to
>> determine any reason.
> 
> Have you checked tor's logs?
> They are usually in /var/log/tor/log

The directory /var/log/tor/ is empty, I think the Debian/Ubuntu package
logs to syslog per default, but not sure, I cant find anything besides
start/stop/reload in the sys log (journalctl to view it).

> 
> If you have logrotate configured, they might have already been deleted,
> because 30 March is more than 1 week ago.

Funnily there is a logrotate job for the folder, it is:
/var/log/tor/*log {
        daily
        rotate 5
        compress
        delaycompress
        missingok
        notifempty
        create 0640 debian-tor adm
        sharedscripts
        postrotate
                if invoke-rc.d tor status > /dev/null; then
                        invoke-rc.d tor reload > /dev/null
                fi
        endscript
}

Which would have removed the file as you point out, but still there
should be some logs from 3 days ago when it happened again. But as
stated above the folder is empty.

> 
>> So I installed updates and since there were some Kernel updates I also
>> rebooted the machine. The Exit was back up and ran again till ~36h ago.
>> Same situation again, I have no idea why it stopped.
>>
>> I now activated "Log notice syslog", I think this was in the standard
>> torrc which is installed with the package of Ubuntu 18.04.4 LTS anyway,
>> but there is not entries in journalctl. Only Start/Stop/Reload events
>> are shown in the journal for unit tor.service since 100 day ago.
> 
> Have you tried reading /var/log/sys log directly?

Thanks, that was my mistake, I didn't look in the file, but was just
looking for tor.service unit entries, but of course the application
itself just logs as "tor" or "Tor" and not as tor.service.

So I see some info there, but nothing helpful since I just activated
logging yesterday. I will revisit this in a few days when/if the problem
occurs again, also I increased the rotation for the log to 14 days and
am now logging into /var/log/tor/log.

Could you advise which loglevel I should use to troubleshoot this? I set
notice for now, because debug generated too much data.

> 
>> Can someone help me to troubleshoot this problem, could the fingerprint
>> be blacklisted? In this case would the Exit come back up running for a
>> few days as described above?
> 
> Most of the time, blacklisting just makes Tor log a message in its logs.
> And the directory authorities stop publishing the relay in the consensus.
> 
> (We haven't made any changes to required protocols recently. If we do,
> very old Tor versions may shut down.)
> 
> Here's what we need to know to be more helpful:
> * your relay fingerprint
> * your Tor version
> * tor's logs when it shuts down

Thanks again for the help, it is much appreciated.

Regards
yl

_______________________________________________
tor-relays mailing list
tor-relays@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays