Think this is the first time I've seen an OOM on the fork. I'm definitely not versed in reading the dump, but from your log attachment it may be pointing at dnsmasq. Are you running any scripts that interface with dnsmasq or trying to load a huge hosts file for example?
This is usually due to one of two things....
- you are trying to connect from two clients simultaneously over HTTPS (this can sometimes cause a deadlock in httpd and this detects it and restarts httpd). It could be someone trying to hack your system. Do you have HTTPS WAN access enabled?
- your HTTPS certificate is corrupt or not installed correctly
It's just an easy setup, WAN is PPPoE and i have 3 outdoor APs and 1 surveillance camera wired to the 4 Port Switch with DHCP reservations, there are no custom scripts. At the time the router crashed, there was not much going on, at best there were 5-6 wireless clients surfing the internet, nothing that could have overloaded the router. Even the port scan neighbors left:
Aug 6 18:19:21 dropbear[12577]: Exit before auth: Disconnect received
Aug 6 18:57:05 dropbear[12745]: Child connection from 112.85.42.102:37061
Aug 6 18:57:18 dropbear[12745]: Exit before auth: Disconnect received
Aug 6 19:02:03 ntp: start NTP update
Aug 6 19:02:33 ntp: NTP update successful after 2 attempt(s)
Aug 6 20:02:28 ntp: start NTP update
Aug 6 20:02:33 ntp: NTP update successful after 2 attempt(s)
Aug 6 21:02:33 ntp: start NTP update
Aug 6 21:03:03 ntp: NTP update successful after 2 attempt(s)
Aug 6 21:08:19 dropbear[13344]: Child connection from 123.20.185.199:7451
Aug 6 21:08:19 dropbear[13344]: Exit before auth: Exited normally
Aug 6 21:56:42 kernel: OOMkill: task 388 (usbled) got 14 points
Yes, i have enabled SSH and Web access from WAN side for remote management purposes. Usually i do it from SSH but while on route i tend to connect to the GUI from my phone, feels easier. I will consider disabling the Web access in case i see it abused a lot.
Does one know an easy method to block the port scan abusers wihtout putting serious stress on the router? I mean it's an old device and i really like to keep the traffic flowing without bottlenecking it with intensive firewall rules...