The database died at 03:00. Was it an attack?

PostgreSQL was killed overnight and the on-call asked whether the server was attacked. Read the kernel and cron logs and show it was the out-of-memory killer and a report job.

Terminal mission
Beginner
4 objectives
0 of 4 solved

Briefing

db-04 restarted PostgreSQL at 03:02 and the on-call engineer opened a security incident just in case.

When Linux runs out of memory, the OOM killer picks a process to kill and logs why. The question for triage is not only "what died" but "what was using the memory".

analyst@db-04

db-04 · Linux log triage

Type help for the command list and objectives for your tasks. Everything runs in this browser.

analyst@db-04:~$

Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.