Aus den Angeln hebender Reinfall bei Backup ins Internet - Beweise

Sep 13, 2026 Last reply: 7 hours ago 3 Replies

Ich habe Beweise gesammelt, um dem Provider IONOS einen Report zukommen lassen zu können. Bilder werde ich noch nachreichen. Unten 'forced close' bedeutet Abbruch der Verbindung durch remote Host.



Nun werde ich chinesisches Essen besorgen (Asia Wok) und damit in einen anderen Ort fahren.



====================================================================================================================== Sep 3 17:35:25 15.31.57.0 u7654321 session opened for local user u7654321 from [15.31.57.0] Sep 3 17:40:49 15.31.57.0 u7654321 open "/sriysvdf/fattmp.tar.ehu" flags WRITE,CREATE,TRUNCATE mode 0600 Sep 3 18:05:32 15.31.57.0 u7654321 forced close "/sriysvdf/fattmp.tar.ehu" bytes read 0 written 3865620480 Sep 3 18:05:32 15.31.57.0 u7654321 [15.31.57.0|put|1483|3865620480|0|0|0|2f73726979737664662f666174746d702e7461722e647853|] Sep 3 18:05:32 15.31.57.0 u7654321 session closed for local user u7654321 from [15.31.57.0] Sep 3 18:10:13 15.31.57.0 u7654321 session opened for local user u7654321 from [15.31.57.0] Sep 3 18:12:13 15.31.57.0 u7654321 open "/sriysvdf/fattmp.tar.ehu" flags WRITE,CREATE,TRUNCATE mode 0600 Sep 3 18:40:22 15.31.57.0 u7654321 forced close "/sriysvdf/fattmp.tar.ehu" bytes read 0 written 4294640640 Sep 3 18:40:22 15.31.57.0 u7654321 [15.31.57.0|put|1689|4294640640|0|0|0|2f73726979737664662f666174746d702e7461722e647853|] Sep 3 18:40:22 15.31.57.0 u7654321 session closed for local user u7654321 from [15.31.57.0] Sep 3 18:47:36 15.31.57.0 u7654321 session opened for local user u7654321 from [15.31.57.0] Sep 3 18:49:51 15.31.57.0 u7654321 open "/sriysvdf/fattmp.tar.ehu" flags WRITE,CREATE,TRUNCATE mode 0600 Sep 3 18:58:45 15.31.57.0 u7654321 session opened for local user u7654321 from [15.31.57.0] Sep 3 18:58:45 15.31.57.0 u7654321 open "/sriysvdf/u.tar.ehu" flags WRITE,CREATE mode 0600 Sep 3 19:17:42 15.31.57.0 u7654321 forced close "/sriysvdf/fattmp.tar.ehu" bytes read 0 written 3829585920 Sep 3 19:17:42 15.31.57.0 u7654321 [15.31.57.0|put|1671|3829585920|0|0|0|2f73726979737664662f666174746d702e7461722e647853|] Sep 3 19:17:42 15.31.57.0 u7654321 session closed for local user u7654321 from [15.31.57.0] Sep 3 19:22:58 15.31.57.0 u7654321 session opened for local user u7654321 from [15.31.57.0] Sep 3 19:22:58 15.31.57.0 u7654321 open "/sriysvdf/fattmp.tar.ehu" flags WRITE,CREATE mode 0600 Sep 3 19:28:52 15.31.57.0 u7654321 forced close "/sriysvdf/u.tar.ehu" bytes read 0 written 5419806720 Sep 3 19:28:52 15.31.57.0 u7654321 [15.31.57.0|put|1807|5419806720|0|0|0|2f73726979737664662f752e7461722e647853|] Sep 3 19:28:52 15.31.57.0 u7654321 session closed for local user u7654321 from [15.31.57.0] Sep 3 19:53:02 15.31.57.0 u7654321 forced close "/sriysvdf/fattmp.tar.ehu" bytes read 0 written 5998970880 Sep 3 19:53:02 15.31.57.0 u7654321 [15.31.57.0|put|1804|5998970880|0|0|0|2f73726979737664662f666174746d702e7461722e647853|] Sep 3 19:53:02 15.31.57.0 u7654321 session closed for local user u7654321 from [15.31.57.0] Sep 3 21:29:20 15.31.57.0 u7654321 session opened for local user u7654321 from [15.31.57.0] Sep 3 21:29:50 15.31.57.0 u7654321 session closed for local user u7654321 from [15.31.57.0] Sep 3 21:30:30 15.31.57.0 u7654321 session opened for local user u7654321 from [15.31.57.0] Sep 3 21:30:30 15.31.57.0 u7654321 open "/sriysvdf/fattmp.tar.ehu" flags WRITE,CREATE mode 0600 Sep 3 22:00:32 15.31.57.0 u7654321 forced close "/sriysvdf/fattmp.tar.ehu" bytes read 0 written 6006282240 Sep 3 22:00:32 15.31.57.0 u7654321 [15.31.57.0|put|1802|6006282240|0|0|0|2f73726979737664662f666174746d702e7461722e647853|] Sep 3 22:00:32 15.31.57.0 u7654321 session closed for local user u7654321 from [15.31.57.0] Sep 4 04:55:48 15.31.57.0 u7654321 Connection from 15.31.57.0 port 16618 on 82.165.81.179 port 22 rdomain "" Sep 4 04:55:48 15.31.57.0 u7654321 Accepted publickey for u7654321 from 15.31.57.0 port 16618 ssh2: ECDSA SHA256:Sfws9sRMJ/7RwaW/QIx7WKJGq4jE5KVNdk7eeac Sep 4 04:55:48 15.31.57.0 u7654321 Starting session: subsystem 'sftp' for u7654321 from 15.31.57.0 port 16618 id 0 Sep 4 04:55:48 15.31.57.0 u7654321 session opened for local user u7654321 from [15.31.57.0] Sep 4 04:55:48 15.31.57.0 u7654321 open "/sriysvdf/fattmp.tar.ehu" flags WRITE,CREATE mode 0600 Sep 4 05:25:56 15.31.57.0 u7654321 forced close "/sriysvdf/fattmp.tar.ehu" bytes read 0 written 2315351040 Sep 4 05:25:56 15.31.57.0 u7654321 [15.31.57.0|put|1808|2315351040|0|0|0|2f73726979737664662f666174746d702e7461722e647853|] Sep 4 05:25:56 15.31.57.0 u7654321 session closed for local user u7654321 from [15.31.57.0] Sep 4 06:25:45 15.31.57.0 u7654321 Connection from 15.31.57.0 port 53622 on 82.165.81.179 port 22 rdomain "" Sep 4 06:25:45 15.31.57.0 u7654321 Accepted publickey for u7654321 from 15.31.57.0 port 53622 ssh2: ECDSA SHA256:Sfws9sRMJ/7RwaW/QIx7WKJGq4jE5KVNdk7eeac Sep 4 06:25:45 15.31.57.0 u7654321 Starting session: subsystem 'sftp' for u7654321 from 15.31.57.0 port 53622 id 0 Sep 4 06:25:45 15.31.57.0 u7654321 session opened for local user u7654321 from [15.31.57.0] Sep 4 06:25:45 15.31.57.0 u7654321 open "/sriysvdf/fattmp1.tar.ehu" flags WRITE,CREATE mode 0644 Sep 4 06:36:43 15.31.57.0 u7654321 set "/sriysvdf/fattmp1.tar.ehu" size 2147483648 Sep 4 06:36:43 15.31.57.0 u7654321 [15.31.57.0|ftruncate|0|0|2147483648|0|0|2f73726979737664662f666174746d70312e7461722e647853|] Sep 4 06:36:43 15.31.57.0 u7654321 set "/sriysvdf/fattmp1.tar.ehu" mode 0644 Sep 4 06:36:43 15.31.57.0 u7654321 [15.31.57.0|fchmod|0|0|420|0|0|2f73726979737664662f666174746d70312e7461722e647853|] Sep 4 06:36:43 15.31.57.0 u7654321 set "/sriysvdf/fattmp1.tar.ehu" modtime 20260904-08:23:16 Sep 4 06:36:43 15.31.57.0 u7654321 [15.31.57.0|futimes|0|0|1788502996|0|0|2f73726979737664662f666174746d70312e7461722e647853|] Sep 4 06:36:43 15.31.57.0 u7654321 close "/sriysvdf/fattmp1.tar.ehu" bytes read 0 written 2147483648 Sep 4 06:36:43 15.31.57.0 u7654321 [15.31.57.0|put|658|2147483648|0|0|0|2f73726979737664662f666174746d70312e7461722e647853|] Sep 4 06:36:43 15.31.57.0 u7654321 session closed for local user u7654321 from [15.31.57.0] Sep 4 06:36:43 15.31.57.0 u7654321 Received disconnect from 15.31.57.0 port 53622:11: disconnected by user Sep 4 06:37:01 15.31.57.0 u7654321 Connection from 15.31.57.0 port 34234 on 82.165.81.179 port 22 rdomain "" Sep 4 06:37:01 15.31.57.0 u7654321 Accepted publickey for u7654321 from 15.31.57.0 port 34234 ssh2: ECDSA SHA256:Sfws9sRMJ/7RwaW/QIx7WKJGq4jE5KVNdk7eeac Sep 4 06:37:01 15.31.57.0 u7654321 Starting session: subsystem 'sftp' for u7654321 from 15.31.57.0 port 34234 id 0 Sep 4 06:37:01 15.31.57.0 u7654321 session opened for local user u7654321 from [15.31.57.0] Sep 4 06:37:54 15.31.57.0 u7654321 session closed for local user u7654321 from [15.31.57.0] Sep 4 06:37:54 15.31.57.0 u7654321 Received disconnect from 15.31.57.0 port 34234:11: disconnected by user Sep 5 16:32:37 15.31.57.0 u7654321 Connection from 15.31.57.0 port 40922 on 82.165.81.179 port 22 rdomain "" Sep 5 16:32:37 15.31.57.0 u7654321 Accepted publickey for u7654321 from 15.31.57.0 port 40922 ssh2: ECDSA SHA256:Sfws9sRMJ/7RwaW/QIx7WKJGq4jE5KVNdk7eeac Sep 5 16:32:37 15.31.57.0 u7654321 Starting session: subsystem 'sftp' for u7654321 from 15.31.57.0 port 40922 id 0 Sep 5 16:32:37 15.31.57.0 u7654321 session opened for local user u7654321 from [15.31.57.0] Sep 5 16:34:35 15.31.57.0 u7654321 open "/sriysvdf/u.tar.ehu" flags WRITE,CREATE,TRUNCATE mode 0600 Sep 5 16:58:15 15.31.57.0 u7654321 close "/sriysvdf/u.tar.ehu" bytes read 0 written 7472465240 Sep 5 16:58:15 15.31.57.0 u7654321 [15.31.57.0|put|1420|7472465240|0|0|0|2f73726979737664662f752e7461722e647853|] Sep 5 16:59:35 15.31.57.0 u7654321 session closed for local user u7654321 from [15.31.57.0] Sep 5 16:59:35 15.31.57.0 u7654321 Received disconnect from 15.31.57.0 port 40922:11: disconnected by user ======================================================================================================================



Das ist ein Log von deinem Webserver? Welcher Dienst loggt das?

Was sagt tcpdump vom gleichen Zeitraum?

Grüße Marc

--

---------------------------------------------------------------------------- Marc Haber | " Questions are the | Mailadresse im Header Rhein-Neckar, DE | Beginning of Wisdom " | Nordisch by Nature | Lt. Worf, TNG "Rightful Heir" | Fon: *49 6224 1600402

Existiert nicht oder wird nicht benutzt.

IONOS trägt hauptsächlich Traffic-Infos in das Verzeichnis /logs ein. Es gibt nur ein paar sftp-log-Dateien dort.

Ich kann diesen Log problemlos innerhalb von wenigen Minuten analysieren. Mein vergangenes Verhalten kann ich darin voll wiedererkennen. Du hingegen scheinst totale Probleme zu haben, so daß dieser Log für Dich wohl unnutzbar ist. Das ist gar nicht überraschend.

Helmut Schellong wrote on 13.09.2026 12:15:

Nun die Bilder:

formatting link
formatting link
formatting link
formatting link
Ich habe meine logische Beurteilung zu den Abbrüchen geändert, weil ich aktuell einen Abbruch hatte bei hoher Rate von 5,0 MB/s nach bereits wenigen Minuten. Es gab Abbruch nach nur etwa 600 MB Transfer. Es gab Abbruch, dann aber bei dem nachfolgenden gleichen Transfer keinen Abbruch.

Mein Fazit: Die Abbrüche sind zufallsgesteuert.

Am 13.Juli gab es 0 Abbrüche trotz vollständigem, langzeitigem Upload bei nur 1,4 MB/s.

Join the Discussion

Have something to add? Share your thoughts — no account required.

Didn't find your answer?

Ask the community — no account required