root connect/disconnect by SSH many times per second

[Glorious1]

I just happened to look at /var/log/auth.log and found a constant stream of these:

Code:

Aug 29 07:26:08 Tabernacle sshd[36571]: Accepted publickey for root from 127.0.0.1 port 41301 ssh2: RSA b0:ba:9f:a3:bd:08:aa:b1:44:20:37:76:d4:28:e1:c2
Aug 29 07:26:08 Tabernacle sshd[36571]: Received disconnect from 127.0.0.1: 11: disconnected by user
Aug 29 07:27:07 Tabernacle sshd[36651]: Accepted publickey for root from 127.0.0.1 port 61709 ssh2: RSA b0:ba:9f:a3:bd:08:aa:b1:44:20:37:76:d4:28:e1:c2
Aug 29 07:27:07 Tabernacle sshd[36651]: Received disconnect from 127.0.0.1: 11: disconnected by user
Aug 29 07:27:08 Tabernacle sshd[36658]: Accepted publickey for root from 127.0.0.1 port 29685 ssh2: RSA b0:ba:9f:a3:bd:08:aa:b1:44:20:37:76:d4:28:e1:c2
Aug 29 07:27:08 Tabernacle sshd[36658]: Received disconnect from 127.0.0.1: 11: disconnected by user
Aug 29 07:27:08 Tabernacle sshd[36665]: Accepted publickey for root from 127.0.0.1 port 14298 ssh2: RSA b0:ba:9f:a3:bd:08:aa:b1:44:20:37:76:d4:28:e1:c2
Aug 29 07:27:08 Tabernacle sshd[36665]: Received disconnect from 127.0.0.1: 11: disconnected by user
Aug 29 07:27:08 Tabernacle sshd[36672]: Accepted publickey for root from 127.0.0.1 port 30548 ssh2: RSA b0:ba:9f:a3:bd:08:aa:b1:44:20:37:76:d4:28:e1:c2
Aug 29 07:27:08 Tabernacle sshd[36672]: Received disconnect from 127.0.0.1: 11: disconnected by user

It looks like root is logging in and getting logged out constantly at a fast rate. I don't understand what's going on here or why. It may be related to the fact that I have FreeNAS setup to replicate one volume to another volume locally (the remote hostname for the replication task is localhost), but that only happens once per day. This isn't normal, is it?

 

[Robert Trevellyan]

There have been reports of problems with replication tasks with the 9.3.1 update. Have you tried rolling back?

 

[Glorious1]

No, haven't tried rolling back. I just read this bug https://bugs.freenas.org/issues/11130 and saw a similar problem with someone who added a comment. The original bug reporter tried rolling back and it seemed things just got more screwed up. Would it be OK to wait until a fix for the bug comes out?

As in the bug report, it appears my replication is taking place, but the GUI in Replication Tasks screen reports the last snapshot sent to 'remote' side was before the update.

 

[Robert Trevellyan]

Would it be OK to wait until a fix for the bug comes out?

Sorry, I can't answer that.

If it were me, I would consider disabling the replication task until I saw something definitive from iX. Maybe @dlavigne could comment.

 

[dlavigne]

Last I heard, the bug was being worked on and it was expected that a new SU would be available shortly after the fix is found as replication is important and affects a lot of users.

 

[Glorious1]

If it were me, I would consider disabling the replication task until I saw something definitive from iX. Maybe @dlavigne could comment.

Good idea, thanks. I did that and the barrage of auth.log entries stopped.