Nextcloud version: 15.04
Operating system and version: Debian 9.8 X64
Apache or nginx version: nginx/1.14.2
PHP version: PHP 7.0.33-0+deb9u1 (fpm-fcgi):
The SFTP function ist very slow. We had this problems since upgrade to version 15. Before my collegues did not complain. The external storage is connected via VPN (300Mbit available, almost only 20 mbit/s average use besides backup at night).
The nextcloud gui shows always: Processing files while uploading, but in fact, it hangs. Sometimes with small files it works. Listing of folders / content works, viewing of files ist slow.
SFTP upload via cli/bash has full bandwidth of~ 280 mbit/s.
Uploads / changes to local storage perform well.
Is this the first time you’ve seen this error?: Y
Steps to replicate it:
- Attach external storage via SFTP
- Upload files via drag & drop
- Upload process hangs
The output of your Nextcloud log in Admin > Logging:
[core] Error: Can't get app storage, app files_external, user not logged in
at 2019-02-21T12:15:21+00:00
{"reqId":"Vzv42tBkL733fDhdAHdX","level":3,"time":"2019-02-21T12:15:20+00:00","remoteAddr":"","user":"--","app":"core","method":"","url":"--","message":"Can't get app storage, app files_external, user not logged in","userAgent":"--","version":"15.0.4.0","id":"5c6ea6cdcb2ff"}
The output of your config.php file in /path/to/nextcloud (make sure you remove any identifiable information!):
<?php
$CONFIG = array (
'instanceid' => 'oc1oray73t98',
'passwordsalt' => 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',
'secret' => 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',
'trusted_domains' =>
array (
0 => 'next.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.de',
1 => 'localhost',
2 => '192.168.125.10',
),
'filelocking.enabled' => true,
'memcache.locking' => '\\OC\\Memcache\\Redis',
'memcache.local' => '\\OC\\Memcache\\APCu',
'redis' =>
array (
'host' => 'localhost',
'port' => 6379,
'timeout' => 0.0,
'password' => '',
),
'trashbin_retention_obligation' => '2,5',
'trusted_proxies' =>
array (
0 => '172.29.1.1',
1 => '192.168.125.11',
),
'forwarded_for_headers' =>
array (
0 => 'HTTP_X_FORWARDED',
1 => 'HTTP_FORWARDED_FOR',
),
'datadirectory' => '/var/www/html/nextcloud/data',
'overwrite.cli.url' => 'http://next.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.de/nextcloud',
'htaccess.RewriteBase' => '/nextcloud',
'dbtype' => 'mysql',
'version' => '15.0.4.0',
'dbname' => 'nextcloud',
'dbhost' => 'localhost',
'dbport' => '',
'dbtableprefix' => 'oc_',
'mysql.utf8mb4' => true,
'dbuser' => 'datastore',
'dbpassword' => 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',
'installed' => true,
'ldapIgnoreNamingRules' => false,
'ldapProviderFactory' => '\\OCA\\User_LDAP\\LDAPProviderFactory',
'mail_from_address' => 'next',
'mail_smtpmode' => 'smtp',
'mail_smtpauthtype' => 'LOGIN',
'mail_domain' => 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.de',
'maintenance' => false,
'theme' => '',
'loglevel' => 2,
'updater.release.channel' => 'stable',
'mail_smtphost' => '172.29.210.83',
'mail_smtpport' => '25',
);
The output of your Apache/nginx/system log in /var/log/____:
cat /var/log/nginx/error.log
2019/02/21 12:58:32 [warn] 580#580: *273074 an upstream response is buffered to a temporary file /var/cache/nginx/fastcgi_temp/9/02/0000000029 while reading upstream, client: 192.168.125.11, server: next.xxxxxxxxxxxxxxxxxxxxxxx.de, request: "GET /js/files/merged-index.js?v=d2af4764-27 HTTP/1.1", upstream: "fastcgi://unix:/run/php/php7.0-fpm.sock:", host: "next.xxxxxxxxxxxxxxxxxxxxxxx.de"
2019/02/21 12:58:32 [warn] 580#580: *273072 an upstream response is buffered to a temporary file /var/cache/nginx/fastcgi_temp/0/03/0000000030 while reading upstream, client: 192.168.125.11, server: next.xxxxxxxxxxxxxxxxxxxxxxx.de, request: "GET /js/files_texteditor/merged.js?v=d2af4764-27 HTTP/1.1", upstream: "fastcgi://unix:/run/php/php7.0-fpm.sock:", host: "next.xxxxxxxxxxxxxxxxxxxxxxx.de"
2019/02/21 12:58:32 [warn] 580#580: *273075 an upstream response is buffered to a temporary file /var/cache/nginx/fastcgi_temp/1/03/0000000031 while reading upstream, client: 192.168.125.11, server: next.xxxxxxxxxxxxxxxxxxxxxxx.de, request: "GET /js/spreed/merged-files.js?v=d2af4764-27 HTTP/1.1", upstream: "fastcgi://unix:/run/php/php7.0-fpm.sock:", host: "next.xxxxxxxxxxxxxxxxxxxxxxx.de"
2019/02/21 13:04:07 [error] 580#580: *273760 upstream timed out (110: Connection timed out) while reading response header from upstream, client: 192.168.125.11, server: next.xxxxxxxxxxxxxxxxxxxxxxx.de, request: "MOVE /remote.php/dav/uploads/0B9FF5C2-EBA4-41C3-8621-5FC5943FA144/web-file-upload-788c9311b279c20d31e4886b6bd4b7ed-1550750583375/.file HTTP/1.1", upstream: "fastcgi://unix:/run/php/php7.0-fpm.sock", host: "next.xxxxxxxxxxxxxxxxxxxxxxx.de"
2019/02/21 13:20:49 [warn] 580#580: *274216 an upstream response is buffered to a temporary file /var/cache/nginx/fastcgi_temp/2/03/0000000032 while reading upstream, client: 192.168.125.11, server: next.xxxxxxxxxxxxxxxxxxxxxxx.de, request: "GET /js/files/merged-index.js?v=d2af4764-27 HTTP/1.1", upstream: "fastcgi://unix:/run/php/php7.0-fpm.sock:", host: "next.xxxxxxxxxxxxxxxxxxxxxxx.de"
2019/02/21 13:20:49 [warn] 580#580: *274214 an upstream response is buffered to a temporary file /var/cache/nginx/fastcgi_temp/3/03/0000000033 while reading upstream, client: 192.168.125.11, server: next.xxxxxxxxxxxxxxxxxxxxxxx.de, request: "GET /js/files_texteditor/merged.js?v=d2af4764-27 HTTP/1.1", upstream: "fastcgi://unix:/run/php/php7.0-fpm.sock:", host: "next.xxxxxxxxxxxxxxxxxxxxxxx.de"
2019/02/21 13:20:49 [warn] 580#580: *274215 an upstream response is buffered to a temporary file /var/cache/nginx/fastcgi_temp/4/03/0000000034 while reading upstream, client: 192.168.125.11, server: next.xxxxxxxxxxxxxxxxxxxxxxx.de, request: "GET /js/spreed/merged-files.js?v=d2af4764-27 HTTP/1.1", upstream: "fastcgi://unix:/run/php/php7.0-fpm.sock:", host: "next.xxxxxxxxxxxxxxxxxxxxxxx.de"
2019/02/21 13:30:04 [warn] 580#580: *274552 an upstream response is buffered to a temporary file /var/cache/nginx/fastcgi_temp/5/03/0000000035 while reading upstream, client: 192.168.125.11, server: next.xxxxxxxxxxxxxxxxxxxxxxx.de, request: "GET /apps/gallery/preview/105321?width=2000&height=2000&c=5c6e97e85742b&requesttoken=TXqChlDz9JEVJl88uN4OeeslL4PPLKxrAThpvbWOcdc%3D%3AC1G383%2B1x%2FRxQwZU96hPK71GbtuOYtsKM08l8dnPC%2B8%3D HTTP/1.1", upstream: "fastcgi://unix:/run/php/php7.0-fpm.sock:", host: "next.xxxxxxxxxxxxxxxxxxxxxxx.de"
2019/02/21 13:34:06 [warn] 580#580: *274762 an upstream response is buffered to a temporary file /var/cache/nginx/fastcgi_temp/6/03/0000000036 while reading upstream, client: 192.168.125.11, server: next.xxxxxxxxxxxxxxxxxxxxxxx.de, request: "GET /js/files_texteditor/merged.js?v=d2af4764-27 HTTP/1.1", upstream: "fastcgi://unix:/run/php/php7.0-fpm.sock:", host: "next.xxxxxxxxxxxxxxxxxxxxxxx.de"
2019/02/21 13:34:06 [warn] 580#580: *274760 an upstream response is buffered to a temporary file /var/cache/nginx/fastcgi_temp/7/03/0000000037 while reading upstream, client: 192.168.125.11, server: next.xxxxxxxxxxxxxxxxxxxxxxx.de, request: "GET /js/spreed/merged-files.js?v=d2af4764-27 HTTP/1.1", upstream: "fastcgi://unix:/run/php/php7.0-fpm.sock:", host: "next.xxxxxxxxxxxxxxxxxxxxxxx.de"
2019/02/21 14:06:15 [error] 580#580: *275809 upstream timed out (110: Connection timed out) while reading response header from upstream, client: 192.168.125.11, server: next.xxxxxxxxxxxxxxxxxxxxxxx.de, request: "MOVE /remote.php/dav/uploads/ima/web-file-upload-222ab06f72a115875cb9e556dcf0591e-1550754313361/.file HTTP/1.1", upstream: "fastcgi://unix:/run/php/php7.0-fpm.sock", host: "next.xxxxxxxxxxxxxxxxxxxxxxx.de"
2019/02/21 14:21:32 [warn] 580#580: *276292 an upstream response is buffered to a temporary file /var/cache/nginx/fastcgi_temp/8/03/0000000038 while reading upstream, client: 192.168.125.11, server: next.xxxxxxxxxxxxxxxxxxxxxxx.de, request: "GET /js/files_texteditor/merged.js?v=d2af4764-27 HTTP/1.1", upstream: "fastcgi://unix:/run/php/php7.0-fpm.sock:", host: "next.xxxxxxxxxxxxxxxxxxxxxxx.de"
2019/02/21 14:21:32 [warn] 580#580: *276287 an upstream response is buffered to a temporary file /var/cache/nginx/fastcgi_temp/9/03/0000000039 while reading upstream, client: 192.168.125.11, server: next.xxxxxxxxxxxxxxxxxxxxxxx.de, request: "GET /js/spreed/merged-files.js?v=d2af4764-27 HTTP/1.1", upstream: "fastcgi://unix:/run/php/php7.0-fpm.sock:", host: "next.xxxxxxxxxxxxxxxxxxxxxxx.de"
2019/02/21 14:22:43 [error] 580#580: *276380 access forbidden by rule, client: 192.168.125.11, server: next.xxxxxxxxxxxxxxxxxxxxxxx.de, request: "GET /data/.ocdata?t=1550755362470 HTTP/1.1", host: "next.xxxxxxxxxxxxxxxxxxxxxxx.de"
2019/02/21 14:22:49 [error] 580#580: *276368 access forbidden by rule, client: 192.168.125.11, server: next.xxxxxxxxxxxxxxxxxxxxxxx.de, request: "GET /data/.ocdata?t=1550755368075 HTTP/1.1", host: "next.xxxxxxxxxxxxxxxxxxxxxxx.de"
2019/02/21 14:26:53 [error] 580#580: *276525 access forbidden by rule, client: 192.168.125.11, server: next.xxxxxxxxxxxxxxxxxxxxxxx.de, request: "GET /data/.ocdata?t=1550755611894 HTTP/1.1", host: "next.xxxxxxxxxxxxxxxxxxxxxxx.de"
2019/02/21 14:27:10 [error] 580#580: *276552 access forbidden by rule, client: 192.168.125.11, server: next.xxxxxxxxxxxxxxxxxxxxxxx.de, request: "GET /data/.ocdata?t=1550755629015 HTTP/1.1", host: "next.xxxxxxxxxxxxxxxxxxxxxxx.de"
2019/02/21 14:27:38 [warn] 580#580: *276582 an upstream response is buffered to a temporary file /var/cache/nginx/fastcgi_temp/0/04/0000000040 while reading upstream, client: 192.168.125.11, server: next.xxxxxxxxxxxxxxxxxxxxxxx.de, request: "GET /settings/apps/list HTTP/1.1", upstream: "fastcgi://unix:/run/php/php7.0-fpm.sock:", host: "next.xxxxxxxxxxxxxxxxxxxxxxx.de"
cat /var/log/nginx/access.log
192.168.125.11 - xxxxxxxx [21/Feb/2019:14:33:36 +0100] "PROPFIND /remote.php/dav/files/B7F299E7-A1F6-40F8-99C0-0F2CBF80258D/ HTTP/1.1" 207 428 "-" "Mozilla/5.0 (Windows) mirall/2.3.3 (build 1) (Nextcloud)" "172.29.210.78"
192.168.125.11 - xxxxxxxx [21/Feb/2019:14:34:06 +0100] "PROPFIND /remote.php/dav/files/B7F299E7-A1F6-40F8-99C0-0F2CBF80258D/ HTTP/1.1" 207 428 "-" "Mozilla/5.0 (Windows) mirall/2.3.3 (build 1) (Nextcloud)" "172.29.210.78"
192.168.125.11 - xxxxxxxx [21/Feb/2019:14:34:36 +0100] "PROPFIND /remote.php/dav/files/B7F299E7-A1F6-40F8-99C0-0F2CBF80258D/ HTTP/1.1" 207 428 "-" "Mozilla/5.0 (Windows) mirall/2.3.3 (build 1) (Nextcloud)" "172.29.210.78"
192.168.125.11 - xxxxxxxx [21/Feb/2019:14:35:06 +0100] "PROPFIND /remote.php/dav/files/B7F299E7-A1F6-40F8-99C0-0F2CBF80258D/ HTTP/1.1" 207 428 "-" "Mozilla/5.0 (Windows) mirall/2.3.3 (build 1) (Nextcloud)" "172.29.210.78"
192.168.125.11 - xxxxxxxx [21/Feb/2019:14:35:36 +0100] "PROPFIND /remote.php/dav/files/B7F299E7-A1F6-40F8-99C0-0F2CBF80258D/ HTTP/1.1" 207 428 "-" "Mozilla/5.0 (Windows) mirall/2.3.3 (build 1) (Nextcloud)" "172.29.210.78"
192.168.125.11 - xxxxxxxx [21/Feb/2019:14:36:05 +0100] "GET /ocs/v2.php/apps/notifications/api/v1/notifications?format=json HTTP/1.1" 200 74 "-" "Mozilla/5.0 (Windows) mirall/2.3.3 (build 1) (Nextcloud)" "172.29.210.78"
192.168.125.11 - xxxxxxxx [21/Feb/2019:14:36:05 +0100] "PROPFIND /remote.php/dav/files/B7F299E7-A1F6-40F8-99C0-0F2CBF80258D/ HTTP/1.1" 207 428 "-" "Mozilla/5.0 (Windows) mirall/2.3.3 (build 1) (Nextcloud)" "172.29.210.78"
192.168.125.11 - xxxxxxxx [21/Feb/2019:14:36:36 +0100] "PROPFIND /remote.php/dav/files/B7F299E7-A1F6-40F8-99C0-0F2CBF80258D/ HTTP/1.1" 207 428 "-" "Mozilla/5.0 (Windows) mirall/2.3.3 (build 1) (Nextcloud)" "172.29.210.78"
192.168.125.11 - xxxxxxxx [21/Feb/2019:14:37:06 +0100] "PROPFIND /remote.php/dav/files/B7F299E7-A1F6-40F8-99C0-0F2CBF80258D/ HTTP/1.1" 207 428 "-" "Mozilla/5.0 (Windows) mirall/2.3.3 (build 1) (Nextcloud)" "172.29.210.78"
192.168.125.11 - xxxxxxxx [21/Feb/2019:14:37:36 +0100] "PROPFIND /remote.php/dav/files/B7F299E7-A1F6-40F8-99C0-0F2CBF80258D/ HTTP/1.1" 207 428 "-" "Mozilla/5.0 (Windows) mirall/2.3.3 (build 1) (Nextcloud)" "172.29.210.78"
192.168.125.11 - xxxxxxxx [21/Feb/2019:14:38:06 +0100] "PROPFIND /remote.php/dav/files/B7F299E7-A1F6-40F8-99C0-0F2CBF80258D/ HTTP/1.1" 207 428 "-" "Mozilla/5.0 (Windows) mirall/2.3.3 (build 1) (Nextcloud)" "172.29.210.78"
192.168.125.11 - xxxxxxxx [21/Feb/2019:14:38:36 +0100] "PROPFIND /remote.php/dav/files/B7F299E7-A1F6-40F8-99C0-0F2CBF80258D/ HTTP/1.1" 207 428 "-" "Mozilla/5.0 (Windows) mirall/2.3.3 (build 1) (Nextcloud)" "172.29.210.78"
192.168.125.11 - xxxxxxxx [21/Feb/2019:14:38:36 +0100] "GET /ocs/v2.php/apps/notifications/api/v1/notifications?format=json HTTP/1.1" 200 74 "-" "Mozilla/5.0 (Windows) mirall/2.3.3 (build 1) (Nextcloud)" "172.29.210.78"
192.168.125.11 - xxxxxxxx [21/Feb/2019:14:38:37 +0100] "PROPFIND /remote.php/dav/files/B7F299E7-A1F6-40F8-99C0-0F2CBF80258D/ HTTP/1.1" 207 6879 "-" "Mozilla/5.0 (Windows) mirall/2.3.3 (build 1) (Nextcloud)" "172.29.210.78"
192.168.125.11 - xxxxxxxx [21/Feb/2019:14:39:34 +0100] "PROPFIND /remote.php/dav/files/B7F299E7-A1F6-40F8-99C0-0F2CBF80258D/ HTTP/1.1" 207 429 "-" "Mozilla/5.0 (Windows) mirall/2.3.3 (build 1) (Nextcloud)" "172.29.210.78"
192.168.125.11 - xxxxxxxx [21/Feb/2019:14:39:35 +0100] "PROPFIND /remote.php/dav/files/B7F299E7-A1F6-40F8-99C0-0F2CBF80258D/ HTTP/1.1" 207 428 "-" "Mozilla/5.0 (Windows) mirall/2.3.3 (build 1) (Nextcloud)" "172.29.210.78"
Log SFTP manual transfer:
sftp> put 1GB
Uploading 1GB to /opt/1GB
1GB 1GB 100% 1024MB 30.4MB/s 00:33
Syslog external storage:
Feb 21 14:29:35 xxxxxxxx systemd[8944]: Listening on GnuPG cryptographic agent and passphrase cache (restricted).
Feb 21 14:29:35 xxxxxxxx systemd[8944]: Listening on GnuPG cryptographic agent and passphrase cache.
Feb 21 14:29:35 xxxxxxxx systemd[8944]: Reached target Sockets.
Feb 21 14:29:35 xxxxxxxx systemd[8944]: Reached target Basic System.
Feb 21 14:29:35 xxxxxxxx systemd[8944]: Reached target Default.
Feb 21 14:29:35 xxxxxxxx systemd[8944]: Startup finished in 17ms.
Feb 21 14:29:35 xxxxxxxx systemd[1]: Started User Manager for UID 1004.
Feb 21 14:29:35 xxxxxxxx systemd[1]: Started Session 543 of user xxxxxxxx.
Feb 21 14:29:35 xxxxxxxx systemd[1]: Stopping User Manager for UID 1004...
Feb 21 14:29:35 xxxxxxxx systemd[8944]: Stopped target Default.
Feb 21 14:29:35 xxxxxxxx systemd[8944]: Stopped target Basic System.
Feb 21 14:29:35 xxxxxxxx systemd[8944]: Stopped target Paths.
Feb 21 14:29:35 xxxxxxxx systemd[8944]: Stopped target Sockets.
Feb 21 14:29:35 xxxxxxxx systemd[8944]: Closed GnuPG cryptographic agent and passphrase cache (restricted).
Feb 21 14:29:35 xxxxxxxx systemd[8944]: Closed GnuPG cryptographic agent (ssh-agent emulation).
Feb 21 14:29:35 xxxxxxxx systemd[8944]: Closed GnuPG cryptographic agent (access for web browsers).
Feb 21 14:29:35 xxxxxxxx systemd[8944]: Closed GnuPG cryptographic agent and passphrase cache.
Feb 21 14:29:35 xxxxxxxx systemd[8944]: Reached target Shutdown.
Feb 21 14:29:35 xxxxxxxx systemd[8944]: Starting Exit the Session...
Feb 21 14:29:35 xxxxxxxx systemd[8944]: Stopped target Timers.
Feb 21 14:29:35 xxxxxxxx systemd[8944]: Received SIGRTMIN+24 from PID 8963 (kill).
Feb 21 14:29:35 xxxxxxxx systemd[1]: Stopped User Manager for UID 1004.
Feb 21 14:29:35 xxxxxxxx systemd[1]: Removed slice User Slice of xxxxxxxx.
Feb 21 14:29:40 xxxxxxxx systemd[1]: Created slice User Slice of xxxxxxxx.
Feb 21 14:29:40 xxxxxxxx systemd[1]: Starting User Manager for UID 1004...
Feb 21 14:29:40 xxxxxxxx systemd[1]: Started Session 544 of user xxxxxxxx.
Feb 21 14:29:40 xxxxxxxx systemd[8971]: Listening on GnuPG cryptographic agent and passphrase cache.
Feb 21 14:29:40 xxxxxxxx systemd[8971]: Listening on GnuPG cryptographic agent and passphrase cache (restricted).
Feb 21 14:29:40 xxxxxxxx systemd[8971]: Reached target Paths.
Feb 21 14:29:40 xxxxxxxx systemd[8971]: Listening on GnuPG cryptographic agent (ssh-agent emulation).
Feb 21 14:29:40 xxxxxxxx systemd[8971]: Reached target Timers.
Feb 21 14:29:40 xxxxxxxx systemd[8971]: Listening on GnuPG cryptographic agent (access for web browsers).
Feb 21 14:29:40 xxxxxxxx systemd[8971]: Reached target Sockets.
Feb 21 14:29:40 xxxxxxxx systemd[8971]: Reached target Basic System.
Feb 21 14:29:40 xxxxxxxx systemd[8971]: Reached target Default.
Feb 21 14:29:40 xxxxxxxx systemd[8971]: Startup finished in 15ms.
Feb 21 14:29:40 xxxxxxxx systemd[1]: Started User Manager for UID 1004.
Feb 21 14:29:40 xxxxxxxx systemd[1]: Stopping User Manager for UID 1004...
Feb 21 14:29:40 xxxxxxxx systemd[8971]: Stopped target Default.
Feb 21 14:29:40 xxxxxxxx systemd[8971]: Stopped target Basic System.
Feb 21 14:29:40 xxxxxxxx systemd[8971]: Stopped target Timers.
Feb 21 14:29:40 xxxxxxxx systemd[8971]: Stopped target Sockets.
Feb 21 14:29:40 xxxxxxxx systemd[8971]: Closed GnuPG cryptographic agent (ssh-agent emulation).
Feb 21 14:29:40 xxxxxxxx systemd[8971]: Closed GnuPG cryptographic agent (access for web browsers).
Feb 21 14:29:40 xxxxxxxx systemd[8971]: Closed GnuPG cryptographic agent and passphrase cache (restricted).
Feb 21 14:29:40 xxxxxxxx systemd[8971]: Closed GnuPG cryptographic agent and passphrase cache.
Feb 21 14:29:40 xxxxxxxx systemd[8971]: Reached target Shutdown.
Feb 21 14:29:40 xxxxxxxx systemd[8971]: Starting Exit the Session...
Feb 21 14:29:40 xxxxxxxx systemd[8971]: Stopped target Paths.
Feb 21 14:29:40 xxxxxxxx systemd[8971]: Received SIGRTMIN+24 from PID 8981 (kill).
Feb 21 14:29:40 xxxxxxxx systemd[1]: Stopped User Manager for UID 1004.
Feb 21 14:29:40 xxxxxxxx systemd[1]: Removed slice User Slice of xxxxxxxx.
auth.log external storage
Feb 21 14:44:36 xxxxxxxx sshd[11789]: Disconnected from 172.29.222.225 port 36776
Feb 21 14:44:36 xxxxxxxx sshd[11797]: Received disconnect from 172.29.222.225 port 36778:11:
Feb 21 14:44:36 xxxxxxxx sshd[11797]: Disconnected from 172.29.222.225 port 36778
Feb 21 14:44:36 xxxxxxxx sshd[11780]: pam_unix(sshd:session): session closed for user xxxxxxxx
Feb 21 14:44:36 xxxxxxxx sshd[11791]: pam_unix(sshd:session): session closed for user xxxxxxxx
Feb 21 14:44:36 xxxxxxxx systemd-logind[589]: Removed session 744.
Feb 21 14:44:36 xxxxxxxx systemd-logind[589]: Removed session 742.
Feb 21 14:44:40 xxxxxxxx sshd[11806]: Accepted publickey for xxxxxxxx from 172.29.222.225 port 36782 ssh2: RSA SHA256:17UyofbuB123123123123123123HSE94qds5fbU/7g7JU
Feb 21 14:44:40 xxxxxxxx sshd[11806]: pam_unix(sshd:session): session opened for user xxxxxxxx by (uid=0)
Feb 21 14:44:40 xxxxxxxx systemd: pam_unix(systemd-user:session): session opened for user xxxxxxxx by (uid=0)
Feb 21 14:44:40 xxxxxxxx systemd-logind[589]: New session 745 of user xxxxxxxx.
Feb 21 14:44:40 xxxxxxxx sshd[11816]: Received disconnect from 172.29.222.225 port 36782:11:
Feb 21 14:44:40 xxxxxxxx sshd[11816]: Disconnected from 172.29.222.225 port 36782
Feb 21 14:44:40 xxxxxxxx sshd[11806]: pam_unix(sshd:session): session closed for user xxxxxxxx
Feb 21 14:44:40 xxxxxxxx systemd-logind[589]: Removed session 745.
Feb 21 14:44:40 xxxxxxxx systemd: pam_unix(systemd-user:session): session closed for user xxxxxxxx
Feb 21 14:45:01 xxxxxxxx CRON[11824]: pam_unix(cron:session): session opened for user root by (uid=0)
Feb 21 14:45:01 xxxxxxxx CRON[11825]: pam_unix(cron:session): session opened for user root by (uid=0)
Feb 21 14:45:01 xxxxxxxx CRON[11824]: pam_unix(cron:session): session closed for user root
Feb 21 14:45:01 xxxxxxxx CRON[11825]: pam_unix(cron:session): session closed for user root
Feb 21 14:45:05 xxxxxxxx sshd[11834]: Accepted publickey for xxxxxxxx from 172.29.222.225 port 36802 ssh2: RSA SHA256:17Uyofb1231232132132132134qds5fbU/7g7JU
Feb 21 14:45:05 xxxxxxxx sshd[11834]: pam_unix(sshd:session): session opened for user xxxxxxxx by (uid=0)
Feb 21 14:45:05 xxxxxxxx systemd-logind[589]: New session 749 of user xxxxxxxx.
Feb 21 14:45:05 xxxxxxxx systemd: pam_unix(systemd-user:session): session opened for user xxxxxxxx by (uid=0)
Feb 21 14:45:05 xxxxxxxx sshd[11845]: Accepted publickey for xxxxxxxx from 172.29.222.225 port 36804 ssh2: RSA SHA256:BMc0123213213213213FOrDoHVA9TC/pyMjK3y30
Feb 21 14:45:05 xxxxxxxx sshd[11845]: pam_unix(sshd:session): session opened for user xxxxxxxx by (uid=0)
Feb 21 14:45:05 xxxxxxxx systemd-logind[589]: New session 751 of user xxxxxxxx.
Feb 21 14:45:05 xxxxxxxx sshd[11843]: Received disconnect from 172.29.222.225 port 36802:11:
Feb 21 14:45:05 xxxxxxxx sshd[11843]: Disconnected from 172.29.222.225 port 36802
Feb 21 14:45:05 xxxxxxxx sshd[11851]: Received disconnect from 172.29.222.225 port 36804:11:
Feb 21 14:45:05 xxxxxxxx sshd[11834]: pam_unix(sshd:session): session closed for user xxxxxxxx
Feb 21 14:45:05 xxxxxxxx sshd[11851]: Disconnected from 172.29.222.225 port 36804
Feb 21 14:45:05 xxxxxxxx sshd[11845]: pam_unix(sshd:session): session closed for user xxxxxxxx
Feb 21 14:45:05 xxxxxxxx systemd-logind[589]: Removed session 749.
Feb 21 14:45:05 xxxxxxxx systemd-logind[589]: Removed session 751.
Feb 21 14:45:10 xxxxxxxx sshd[11861]: Accepted publickey for xxxxxxxx from 172.29.222.225 port 36808 ssh2: RSA SHA256:17U1231232132123123SE94qds5fbU/7g7JU
Feb 21 14:45:10 xxxxxxxx sshd[11861]: pam_unix(sshd:session): session opened for user xxxxxxxx by (uid=0)
Feb 21 14:45:10 xxxxxxxx systemd: pam_unix(systemd-user:session): session opened for user xxxxxxxx by (uid=0)
Feb 21 14:45:10 xxxxxxxx systemd-logind[589]: New session 752 of user xxxxxxxx.
Feb 21 14:45:10 xxxxxxxx sshd[11870]: Received disconnect from 172.29.222.225 port 36808:11:
Feb 21 14:45:10 xxxxxxxx sshd[11870]: Disconnected from 172.29.222.225 port 36808
Feb 21 14:45:10 xxxxxxxx sshd[11861]: pam_unix(sshd:session): session closed for user xxxxxxxx
Feb 21 14:45:10 xxxxxxxx systemd-logind[589]: Removed session 752.