syslog restarts and other wierdness

[Mike Rambo]

Yesterday we got called out for problems at one of the elementary
schools and was surprised to find that the server was the source of at
least part of the problems.  The complaint was that server resources
couldn't be accessed - and turned out to be true.

The server is a file & printer server for win3x and win9x clients using
Samba.  It also handles dhcp services for the network with ISC's dhcp
server.  OS is Mandrake 7.1.

I checked /var/log/messages and found the syslog was restarting itself
every 15 seconds or so and had been for the last three days.  Couldn't
figure out why.  There wasn't anything else in the logs that stuck me as
significant to the current trouble.

We started working with the complaint that the classes were unable to
access resources and ended up rebooting the server (restarting various
services - network, smb - didn't help).  This seemed to correct access
at first but then we started getting dhcp address expirations on all the
clients.  I found that the box refused to start the dhcp server daemon
with the error that it couldn't bind to the IP address because it was
already in use.  There is and was nothing else on the same IP address as
the server but the only way I found to resolve that problem was to put
the server on a different IP address.  That's a wierd one I've never
seen before.

Now this morning I'm starting to get more complaints that the access
problem has returned to some degree.  Only a few computers in the school
can access one of the important programs.

Though I haven't been to the server console yet today, I have telnet'd
in but didn't really find much.  All the important services appear to be
up and there aren't any unusual messages in the logs.  Syslog is not
restarting like it was when we were there yesterday.

I'm wondering about record locking problems or something.  The main app
they're having trouble with is Accelerated Reader.  It was previously on
a Novell server that we have replaced with this mandrake server.  We
saved the files from the old server and ftp'd them to the new server. 
The novell server had no problems sharing this data but the error
appears that it may be one of access to either the data or temp
directories both of which have to be write enabled for updates.  At
least two computers are using this program with no trouble giving the
students tests and updating records but most everybody else is locked
out.  The error (as I recall) is something to the effect of "error
opening files" which of course doesn't give much to go on.

Any idea what's happening here or where I can look for clues?


-- 
Mike Rambo
mrambo@lsd.k12.mi.us