System freeze - logout - login

Rosika · February 6, 2023, 4:27pm

Hi all,

Yesterday I encountered some weird behaviour of my pretty new Linux Lite system. That was at 5:15 PM.

Anything like that had never happened before. So I´d very much like to know what you think about it.

Background:

I was looking at a certain product on amazon making use of the firefox browser (which was running in a sandbox).

On the page there was a link to a pdf file which offered a short manual of the product. As I was interested in taking a look at it I clicked on the link and a new firefox window opened up presenting the manual (pdf).

Yet somehow the process of loading the pdf file got stuck and accordingly the whole system seemed to have frozen.
Taking a look at the clock in the status bar I realized it had stopped too.

I waited for about half a minute to see what would happen and suddenly I got logged out.
I was presented with a black window with some status messages, but I think these were some remnants from the login procedure (I have “noplymouth” configured in

/etc/default/grub: GRUB_CMDLINE_LINUX_DEFAULT="noplymouth"

I waited a bit longer and automatically was presented with the login screen again. I logged in and realized all running programmes of the preceding session were closed of course.

I was wondering: was I just logged out and in again or had it been a case of reboot altogether

So I took a look at:

last -x | grep -E '(reboot)|(shutdown)'
shutdown system down  5.15.0-58-generi Sun Feb  5 18:14 - 09:58  (15:43)
reboot   system boot  5.15.0-58-generi Sun Feb  5 13:50 - 18:14  (04:24)

… which seems to indicate there was no reboot at 5:15 PM (17.15)

Then I looked at:

last -x 
shutdown system down  5.15.0-58-generi Sun Feb  5 18:14 - 09:58  (15:43)
rosika   tty7         :0               Sun Feb  5 17:16 - 18:14  (00:58)
rosika   tty7         :0               Sun Feb  5 13:52 - 17:15  (03:22)
runlevel (to lvl 5)   5.15.0-58-generi Sun Feb  5 13:51 - 18:14  (04:23)
reboot   system boot  5.15.0-58-generi Sun Feb  5 13:50 - 18:14  (04:24)

O.K. I hope to be right in deducing from that it must have been a logout and a subsequent login rather than a reboot.

Of course I was wondering what might have initiated this behaviour.
Why did the system freeze, logout and login again

Does anyone have any ideas at which log files to look

What I did was take a look at what lnav had to say (I guess it´s using /var/log/syslog by default) and
I also looked at journalctl -b .

As the output is quite lengthy I put the relevant lines on: output of "journalctl -b" after sudden OS freeze, logout and login (Linux Lite 6.2.) - extract · GitHub

… in case anyone might want to take a look at it…

There are messages like
systemd[1532]: Stopped target Main User Target
in it.

Thanks a lot in advance for your help and opinions.

Many greetings from Rosika

nevj · February 6, 2023, 10:46pm

Hi Rosika ,
I dont like that .
It is possible for a pdf file to carry malware. Even rhough you were in a sandbox, I think I would run some antimalware program, maybe clam.
You put firefox in a sandbox, but does that mean the software displaying the downloaded pdf is also in a sandbox? I dont know.
It takes a rather drastic fault to initiate a logout. I think it has to be a kill of the login shell to do that. I can understand the pdf display program getting in a mess and killing itself, but to kill the parent shell is rather unusual.
The messages dont tell you much.

Not much help , but take some care, dont be alarmed
Regards
Neville

artytux · February 7, 2023, 12:05am

Hello Rosika

I would retrace the steps taken that led to the freeze logout and see if it happens again
That would eliminate questions and doubts you might have

To have the same results would be very strange on a second time.

sidenote
as a side note I had a pdf open in Gimp to extract some images for wallpapers and walked away for a few minutes when I got back all the right and left mouse action were dead as, tried a different mouse no good, not just in Gimp it was dead mouse actions in Dolphin and main menu everywhere.
Never before
No choice hard reboot x2 and back to normal Phew for Linux

getting back to reproducing the freeze and logout events is something I would do,

Q
Would others do that to find if that was a one off incident or something else. ? . . .

nevj · February 7, 2023, 2:34am

I dont think its risky. So why not? If it doesnt repeat you can forget it.

shamu · February 7, 2023, 2:56am

Good idea, I would probably do. But first I would follow Neville’s advise.

Rosika · February 7, 2023, 2:00pm

Hi all,

thanks so much for your replies.

@nevj :

Me neither, Neville. Therefore my wish to examine log files. I really wanted to find out what triggered this behaviour in the first place.

So I gather apart from looking at /var/log/syslog and journalctl -b there´s not much to be done…
Do you know if firefox itself keeps any logs

O.K. I may safely rule that out.

In the meantime I downloaded the respective odf file.

It´s this one form
https://www.amazon.de/gp/product/B01JRZK5GW/ref=ox_sc_act_title_1?smid=A3JWKAKR8XB7XF&psc=1

(the product on sale is a radio clock)

… and ran clamscan on it. Everything´s alright. No malware whasoever.

From that I gather the pdf file itself couldn´t have been the culprit.

Additional info:

Yes, indeed , Neville. Firejail works this way. The pdf file definitively was located and the respective process executed within the sandbox.

Thanks for the info. I still cannot believe there wouldn´t be any logs covering the incident. But unfortunately it seems that way…

@artytux :

Thanks for your suggestion.

In my first post I forgot to mention that the incident occurred the 2nd time I opened the pdf file. In actual fact nothing out of the ordinary happened the 1st time…

Nevertheless I repeated the procedure some minutes ago - just to make sure…
Everything´s o.k. this time.

O.K. I´m glad you could set everything alright again.

If by any chance the sysystem should freeze up:
In order to avoid a hard reboot I try to do it this way:

I apply the REISUB method:

For my German language keybooard layout I have to press Alt and at the same time Print. While keeping them pressed: R - E - I - S - U - B.
(I usually wait a second or so before pressing the next key).
It may be that for English language keyboards Alt Gr is required.

This Magic SysRQ method has always worked for me, and it should be applicable even if you can´t change into a virtual console any more.

But make sure to have the entry
kernel.sysrq = 244
at the end of
/etc/sysctl.d/10-magic-sysrq.conf

In fact that´s one of the first things I do on a fresh OS installation.

reference:

Magic SysRQ › Wiki › ubuntuusers.de # in German, but can be viewed in English with “TranslateLocally for Firefox” add-on
performance - What should I do when Ubuntu freezes? - Ask Ubuntu

@shamu :

thanks to you as well.

Many greetings to all of you
Rosika

don.karon · February 7, 2023, 6:18pm

Here’s a very very low odds (but possible) explanation: cosmic rays. I’m not kidding.

Although they are called “rays” they are actually particles produced by stellar explosions.

artytux · February 7, 2023, 10:07pm

@don.karon
I have heard of this in years gone by and if sun spots, cosmic rays and that other one something waves do screw up the electrical/computer systems on our planet why is there an attitude that is silly talk and dismiss the comment with - yeah shouldn’t feed the gremlins after midnight.
People just don’t listen to the science .

nevj · February 7, 2023, 10:11pm

Hi Rosika,
Look in /var/log. What is there?
There may only be the systemd subdirectory, in which case there is no syslogd running and all the logs will be inside systemd. If that is the case I cant help… dont understand systemd logs.
If you do have some files in /var/log the names should be obvious… messages, auth, Xorg, syslog, … look for firefox there?

You have proved there is nothing wrong with the pdf file. That is a relief. Therefore the fault must be in the software used to display the pdf file or in the X11 software that is rendering the article on your screen. What is your pdf reader? Does it have any logs? Look at the Xorg log. I think firefox is ok … it passes on the pdf job to another app, probably evince.

Sorry if I knew systemd, I could be more help
@Fast.Edi wrote an article on logfiles, it is here

Regards
Neville

artytux · February 7, 2023, 11:21pm

I know about that one I have mine set up in a different way calling it a hard reboot is the only wording to describe although it’s more of a soft reboot if I wrote that there not many that would know what I’m on about.

Thank You
Rosika

Rosika · February 8, 2023, 2:58pm

Hi all,

thanks so much for your new replies.

@don.karon :

Thanks, Don, for the link. I read through the article. Very interesting.
Perhaps cosmic rays were the culprit after all, who knows…

@nevj :

Thanks, Neville, for providing some new ideas.

A lot of things.

Yes, that´s the case with me…
… but sadly no firefox entries.

Yes, quite so.
Plus: in addition to checking the file with clamscan I also submitted it to virustotal, just to make sure…
Nothing malicious found there either.
For details see here .

It´s evince, like you suggested.

BUT:

normally when clicking on a link pointing to a pdf file within firefox an new tab is opened and the pdf is presented there.

Curiously enough this time it was a different scenario. A new window was created - a second firefox window that is - in which the pdf was displayed.
As the letters were too small to read I maximized that second window and also had to enlarge the fonts with either “CTRL plus +” or the mousewheeel.

It was exactly then when the freeze happened and the subsequent logout was initiated…

But thanks so much for your help, Neville.

P.S.:

thanks also for the link. I´ll have a look at the article.

@artytux :

Sorry then.
I didn´t mean to offend you in any way.
I guess the expression “hard reboot” threw me off the track.

But perhaps the REISUB info might me interesting for someone else reading the thread…

Many greetings to you all.
Rosika

artytux · February 8, 2023, 8:17pm

The softer hard reboot I was referring to is from an oldish thread, I use the in KDE power button, seems to not have caused any harm.

The thread is oldish with the REISUB setting different compared to yours setting

search in the thread for and click on
Light tap on power button (<5 seconds)
then
In KDE > Details

That’s the method that works for me and has done so for long time before the article back when ? SolydK mm about that time.

Not offended at all and no need for sorry es

nevj · February 8, 2023, 10:18pm

Hi Rosika,
If you have those, you have syslogd running. Those are readable old fashioned logs.
You may also have systemd logs in the systemd subdir.
I assume you looked carefully at messages and syslog files?
No special firefox log
Regards
Neville

kovacslt · February 9, 2023, 9:27am

Is it possible you ran out of memory?
The symptoms could be caused by an oom-killer, either systemd-oom or early-oom (if you have it installed & enabled).
Do grep your syslog for ‘oom’ to see if that’s he case.
If you see something like (in keyqords only) “killed slices memory pressure”, chances are systemd-oom kicked in.

Rosika · February 9, 2023, 3:26pm

Hi again,

thanks so much for your further help.

@nevj :

…and I´m glad for that, Neville.

Uh, you got me there, Neville. No idea where that might be.
I see there are entries like

/var/lib/systemd/
/usr/lib/systemd/
/etc/systemd/

Apart from that: yes, I looked as carefully as I could in the other logs (/var/log/syslog and journalctl).

Thanks for the confirmation, Neville.

@kovacslt:

Thanks, László, for the suggestion.

Theoretically that might have been possible.
It´s a bit unfortunate that I maximized the 2nd firefox window (the one displaying the pdf file) as I couldn´t get a look at my conky which I have running at all times.

So I cannot say for sure.

Plus: I´m wondering what would have caused the running-out-of-memory?
Well, I´ve got “just” 4GB of RAM but under normal circumstances I wouldn´t get anywhere near a critical limit.

Furthermore: I couldn´t reproduce the behaviour. No problems for firefox or my OS to handle another firefox window for displaying a pdf…

Thanks. I did that for /var/log/syslog. It covers the date and time in question.

No entires regarding “oom”.

Nothing there either.

The only “kill”-related entries (also matching the time stamp) are these:

Feb  5 17:15:44 rosika-Lenovo-H520e systemd[1]: user@1000.service: State 'stop-sigterm' timed out. Killing.
Feb  5 17:15:44 rosika-Lenovo-H520e systemd[1]: user@1000.service: Killing process 1532 (systemd) with signal SIGKILL.
Feb  5 17:15:44 rosika-Lenovo-H520e systemd[1]: user@1000.service: Killing process 1704 (at-spi-bus-laun) with signal SIGKILL.
Feb  5 17:15:44 rosika-Lenovo-H520e systemd[1]: user@1000.service: Killing process 1705 (gmain) with signal SIGKILL.
Feb  5 17:15:44 rosika-Lenovo-H520e systemd[1]: user@1000.service: Killing process 1706 (n/a) with signal SIGKILL.
Feb  5 17:15:44 rosika-Lenovo-H520e systemd[1]: user@1000.service: Killing process 1708 (gdbus) with signal SIGKILL.
Feb  5 17:15:44 rosika-Lenovo-H520e systemd[1]: user@1000.service: Main process exited, code=killed, status=9/KILL
Feb  5 17:15:44 rosika-Lenovo-H520e systemd[1]: user@1000.service: Failed with result 'timeout'.
Feb  5 17:15:44 rosika-Lenovo-H520e systemd[1]: Stopped User Manager for UID 1000.

Thanks a lot, László.

@artytux :

thank you for providing the Manjaro link.

I had no idea the Manjaro forum offers such good posts.
There´s certainly a lot to be learned from those.

Yes, I´ve found it, thanks to your good directions.

Many thanks to all of you.
Best regards
Rosika

Rosika · February 10, 2023, 1:37pm

@nevj :

Hi Neville,

So I Iooked around but couldn´t find anything new.

But it occurred to me to look in auth logs. For the respective time and date
(Feb 5, 5:15 PM = 17:15 and following) I found those entries in /var/log/auth.log.1 :

Feb  5 17:15:12 rosika-Lenovo-H520e CRON[25559]: pam_unix(cron:session): session opened for user rosika(uid=1000) by (uid=0)
Feb  5 17:15:26 rosika-Lenovo-H520e polkitd(authority=local): Unregistered Authentication Agent for unix-session:c2 (system bus name :1.57, object path /org/gnome/PolicyKit1/AuthenticationAgent, locale de_DE.UTF-8) (disconnected from bus)
Feb  5 17:15:26 rosika-Lenovo-H520e lightdm: pam_unix(lightdm:session): session closed for user rosika
Feb  5 17:15:28 rosika-Lenovo-H520e systemd-logind[794]: Removed session c2.
Feb  5 17:15:43 rosika-Lenovo-H520e CRON[25559]: pam_unix(cron:session): session closed for user rosika
Feb  5 17:15:44 rosika-Lenovo-H520e lightdm: pam_unix(lightdm-greeter:session): session opened for user lightdm(uid=110) by (uid=0)
Feb  5 17:15:44 rosika-Lenovo-H520e systemd-logind[794]: New session c3 of user lightdm.
Feb  5 17:15:44 rosika-Lenovo-H520e systemd: pam_unix(systemd-user:session): session opened for user lightdm(uid=110) by (uid=0)
Feb  5 17:15:54 rosika-Lenovo-H520e lightdm: pam_succeed_if(lightdm:auth): requirement "user ingroup nopasswdlogin" not met by user "rosika"
Feb  5 17:16:03 rosika-Lenovo-H520e lightdm: pam_unix(lightdm:session): session opened for user rosika(uid=1000) by (uid=0)
Feb  5 17:16:03 rosika-Lenovo-H520e systemd-logind[794]: New session c4 of user rosika.
Feb  5 17:16:03 rosika-Lenovo-H520e systemd: pam_unix(systemd-user:session): session opened for user rosika(uid=1000) by (uid=0)
Feb  5 17:16:03 rosika-Lenovo-H520e systemd-logind[794]: Removed session c3.
Feb  5 17:16:14 rosika-Lenovo-H520e polkitd(authority=local): Registered Authentication Agent for unix-session:c4 (system bus name :1.131 [/usr/lib/policykit-1-gnome/polkit-gnome-authentication-agent-1], object path /org/gnome/PolicyKit1/AuthenticationAgent, locale de_DE.UTF-8)
Feb  5 17:16:16 rosika-Lenovo-H520e dbus-daemon[778]: [system] Failed to activate service 'org.bluez': timed out (service_start_timeout=25000ms)
Feb  5 17:17:16 rosika-Lenovo-H520e sudo:   rosika : TTY=pts/0 ; PWD=/home/rosika ; USER=root ; COMMAND=/usr/sbin/hdparm -B /dev/sdb
Feb  5 17:17:16 rosika-Lenovo-H520e sudo: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=1000)
Feb  5 17:17:16 rosika-Lenovo-H520e sudo: pam_unix(sudo:session): session closed for user root

So there are two entries which sound suspicious:

Feb  5 17:15:26 rosika-Lenovo-H520e lightdm: pam_unix(lightdm:session): session closed for user rosika
Feb  5 17:15:28 rosika-Lenovo-H520e systemd-logind[794]: Removed session c2.

Perhaps I´m all mistaken there.

Anyway, that´s all I could come up with.

I think we´d have to let it go as we surely have done everything we could, I guess.

Thank you all for your great help.

Many greetings from Rosika