Вопрос по записе в логеВ

[seoguru]

Всем привет,

Сервер сильно грузится и лог под завязку забит такими записями:

Код: Выделить всё

Dec  8 17:28:41 server sshd(pam_unix)[15836]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.8.170.210
Dec  8 17:28:42 server sshd(pam_unix)[15854]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.8.170.210  user=root
Dec  8 17:28:45 server sshd(pam_unix)[15934]: check pass; user unknown
Dec  8 17:28:45 server sshd(pam_unix)[15934]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.8.170.210
Dec  8 17:28:47 server sshd(pam_unix)[15955]: check pass; user unknown
Dec  8 17:28:47 server sshd(pam_unix)[15955]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.8.170.210
Dec  8 17:28:50 server sshd(pam_unix)[15988]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.8.170.210  user=root
Dec  8 17:27:45 server sshd(pam_unix)[13552]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.8.170.210
Dec  8 17:27:48 server sshd(pam_unix)[13651]: check pass; user unknown
Dec  8 17:27:48 server sshd(pam_unix)[13651]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.8.170.210
Dec  8 17:27:50 server sshd(pam_unix)[13672]: check pass; user unknown
Dec  8 17:27:50 server sshd(pam_unix)[13672]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.8.170.210
Dec  8 17:27:53 server sshd(pam_unix)[13743]: check pass; user unknown
Dec  8 17:27:53 server sshd(pam_unix)[13743]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.8.170.210
Dec  8 17:27:54 server sshd(pam_unix)[13773]: check pass; user unknown
Dec  8 17:27:54 server sshd(pam_unix)[13773]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.8.170.210
Dec  8 17:27:58 server sshd(pam_unix)[13822]: check pass; user unknown
Dec  8 17:27:58 server sshd(pam_unix)[13822]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.8.170.210
Dec  8 17:27:59 server sshd(pam_unix)[13839]: check pass; user unknown
Dec  8 17:27:59 server sshd(pam_unix)[13839]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.8.170.210
Dec  8 17:28:03 server sshd(pam_unix)[13898]: check pass; user unknown
Dec  8 17:28:03 server sshd(pam_unix)[13898]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.8.170.210
Dec  8 17:28:03 server sshd(pam_unix)[13938]: check pass; user unknown
Dec  8 17:28:03 server sshd(pam_unix)[13938]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.8.170.210
Dec  8 17:28:08 server sshd(pam_unix)[14018]: check pass; user unknown
Dec  8 17:28:08 server sshd(pam_unix)[14018]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.8.170.210
Dec  8 17:28:08 server sshd(pam_unix)[14024]: check pass; user unknown
Dec  8 17:28:08 server sshd(pam_unix)[14024]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.8.170.210
Dec  8 17:28:13 server sshd(pam_unix)[14108]: check pass; user unknown
Dec  8 17:28:13 server sshd(pam_unix)[14108]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.8.170.210
Dec  8 17:28:13 server sshd(pam_unix)[14114]: check pass; user unknown
Dec  8 17:28:13 server sshd(pam_unix)[14114]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.8.170.210
Dec  8 17:28:18 server sshd(pam_unix)[14177]: check pass; user unknown
Dec  8 17:28:18 server sshd(pam_unix)[14177]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.8.170.210
Dec  8 17:28:18 server sshd(pam_unix)[14178]: check pass; user unknown
Dec  8 17:28:18 server sshd(pam_unix)[14178]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.8.170.210
Dec  8 17:28:22 server sshd(pam_unix)[14259]: check pass; user unknown
Dec  8 17:28:22 server sshd(pam_unix)[14259]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.8.170.210
Dec  8 17:28:23 server sshd(pam_unix)[14265]: check pass; user unknown
Dec  8 17:28:23 server sshd(pam_unix)[14265]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.8.170.210
Dec  8 17:28:27 server sshd(pam_unix)[15381]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.8.170.210  user=root
Dec  8 17:28:28 server sshd(pam_unix)[15389]: check pass; user unknown
Dec  8 17:28:28 server sshd(pam_unix)[15389]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.8.170.210
Dec  8 17:28:32 server sshd(pam_unix)[15653]: check pass; user unknown
Dec  8 17:28:32 server sshd(pam_unix)[15653]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.8.170.210
Dec  8 17:28:32 server sshd(pam_unix)[15662]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.8.170.210  user=root
Dec  8 17:28:36 server sshd(pam_unix)[15741]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.8.170.210  user=root
Dec  8 17:28:37 server sshd(pam_unix)[15757]: check pass; user unknown
Dec  8 17:28:37 server sshd(pam_unix)[15757]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.8.170.210
Dec  8 17:28:41 server sshd(pam_unix)[15836]: check pass; user unknown
Dec  8 17:28:41 server sshd(pam_unix)[15836]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.8.170.210
Dec  8 17:28:42 server sshd(pam_unix)[15854]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.8.170.210  user=root
Dec  8 17:28:45 server sshd(pam_unix)[15934]: check pass; user unknown
Dec  8 17:28:45 server sshd(pam_unix)[15934]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.8.170.210
Dec  8 17:28:47 server sshd(pam_unix)[15955]: check pass; user unknown
Dec  8 17:28:47 server sshd(pam_unix)[15955]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.8.170.210

Есть ли связь с нагрузкой и о чем говорит лог?

Спасибо

[Bizdelnick]

Лог как бы говорит нам, что хост 121.8.170.210, что в Китае, провинция Гуандонг, пытается подключиться по ssh путём подбора пароля.

[Frank]

Вы думаете, что одно соединение за несколько секунд способно серьёзно нагрузить многомегагерцевый проц? Или у вас процессор от "Ну, погоди"?
Лог говорит о том, что вас брутофорсят китайцы. Ставьте fail2ban или перевешивайте sshd на левый порт.

[seoguru]

Сервер VPSка. Поменял порт, буду смотреть.

Спасибо