On Tue, Sep 24, 2002 at 10:57:22PM -0400, James K. Lowden wrote:
> Hi all, 
> 
> AFAICT, my ancient 1.4.2 i386 firewall-cum-mailhub went south at 6:04 AM
> today.  That's the last mail I received, the last message from named, the
> end of /var/log/messages.  I don't find evidence anywhere that anyone else
> logged in.  When I looked at the console, it was in the kernel debugger. 
> OK, I don't know, 100 days uptime or something, I'm not complaining.  
> 
> I didn't realize anything was wrong until 13 hours later, at ~19:00.  
> 
> What puzzles me is that on restarting, the system still thought it was
> 6:04 (or so).  I killed ntpd, ran date(1) to approximate the time,
> ntpdate(8) to fix it, and restarted ntpd.  
> 
> Is the TOD clock initialized from time information on the root filesystem,
> or is it possible my system was compromised and tampered with?  

Did you reboot it typing reboot at the db> prompt, or something like that ?
while in db> interrupts are blocked, to the kernel's idea of time of day
won't change. But I think it will write its idea of time of day back to
CMOS on reboot from ddb.
I already ran in this several times when playing with ddb on i386.

-- 
Manuel Bouyer <bouyer@antioche.eu.org>
--