Adrian  writes:
> Richard Kettlewell  writes
>>Adrian  writes:
>>> It's happened again.
>>>
>>> sending incremental file list
>>> etc/fake-hwclock.data
>>> home/pi/.cache/lxsession/LXDE-pi/run.log
>>> home/pi/stats/
>>> deleting home/pi/stats/temperature_log_200530.csv
>>> home/pi/stats/temperature_log_200531.csv
>>> packet_write_wait: Connection to 192.168.1.118 port 22: Broken pipe
>>
>> packet_write_wait suggests that (from the point of view of the local
>> SSH endpoint) the remote SSH endpoint terminated. So, logs on that
>> system would be worth a look.
>
> Looking at the target Pi, there is nothing of note in either syslog or
> messages, however, auth.log has the following :
>
> 04:05:02 sshd[13415]: Nasty PTR record "192.168.1.18" is set up for
> 192.168.1.18, ignoring
> 04:05:02 sshd[13145]: Accepted publickey for root from 192.168.1.18
> port 49632 ssh2
> 04:05:02 sshd[13145]: pam_unix(sshd:session): session opened for user
> root by (uid=0)
> 04:06:14 sshd[13145]: Received disconnect from 192.168.1.18: 11:
> disconnected by user

That looks like a normal SSH disconnect[1]. There’s quite a few reasons
the OpenSSH client might send that with the most obvious being rsync
closing the pipe to the SSH client.

There’s an apparent inconsistency here, assuming that these log traces
reflect the same session:

* The client reports that server has closed the TCP session when it
  still had something to write.

* The server thinks the client has sent it a disconnect in the SSH
  session.

The former could be faked by an intermediate router but I think you said
there wasn’t one, and the latter is not practical to fake.

Are you familiar with strace? At this point that’s definitely the tool
I’d reach for.

  [1] https://tools.ietf.org/html/rfc4253#section-11.1

--
https://www.greenend.org.uk/rjk/

--- SoupGate-Win32 v1.05