In message , Richard Kettlewell
 writes
>Adrian  writes:
>> Adrian  writes
>>>>Are you familiar with strace? At this point that’s definitely the tool
>>>>I’d reach for.
>>>>
>>>>  [1] https://tools.ietf.org/html/rfc4253#section-11.1
>>>>
>>>
>>>I've heard of it, but I haven't (yet) had a reason to use it.
>>>
>>
>> Following another failure overnight, I've tried strace.
>>
>[....]
>
>You need to trace the ssh processes, on both hosts, not (just)
>rsync. Locally you could use ‘strace -tt -f’ to follow trace
>subprocesses as
>well. Remotely the easiest way is probably to attach the trace after
>things have started, with ‘strace -f -tt -p PID’.
>
>Attaching after things start means we don’t quite get the complete
>picture but since we’re looking for hints as to why things stop (or not)
>that may not matter.
>
>(-tt asks for timestamps, which makes it easier to match up events
>across the two hosts, assuming they both have correctly set clocks.)
>

strace on the target was started first.

 From the source :

strace: Process 14192 attached
10:37:20.669664 _newselect(7, [3 4], [], NULL, NULL) = 1 (in [3])
10:52:56.729985 clock_gettime(CLOCK_BOOTTIME, {tv_sec=1368051,
tv_nsec=670518415}) = 0
10:52:56.730243 read(3, 0x7ee59f44, 8192) = -1 ETIMEDOUT (Connection
timed out)
10:52:56.730478 rt_sigaction(SIGWINCH, NULL, {sa_handler=0x1f200,
sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x76b496b0}, 8) = 0
10:52:56.730684 rt_sigaction(SIGWINCH, {sa_handler=SIG_DFL, sa_mask=[],
sa_flags=SA_RESTORER, sa_restorer=0x76b496b0}, NULL, 8) = 0
10:52:56.730900 getpid()                = 14192
10:52:56.731099 write(3,
"\0i\201\205\372Zs\335\20\200\344\252'E8(\346\321\241\2155\341\274\235\37
1S\230je\25\222U"..., 56) = -1 EPIPE (Broken pipe)
10:52:56.731323 --- SIGPIPE {si_signo=SIGPIPE, si_code=SI_USER,
si_pid=14192, si_uid=0} ---
10:52:56.731464 write(2, "packet_write_wait: Connection to"..., 69) = 69
10:52:56.731706 exit_group(255)         = ?
10:52:56.733946 +++ exited with 255 +++

 From the target :
Process 27119 attached - interrupt to quit
10:36:56.750037 select(12, [3 5 9 11], [], NULL, NULL) = 1 (in [3])
12:36:52.914438 rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0
12:36:52.915121 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
12:36:52.915631 read(3, 0xbe8f7054, 16384) = -1 ECONNRESET (Connection
reset by peer)
12:36:52.916369 getuid32()              = 0
12:36:52.916998 gettimeofday({1591274212, 917209}, NULL) = 0
12:36:52.917571 send(4, "Jun  4 12:36:52 sshd[27119]:"..., 85,
MSG_NOSIGNAL) = 85
12:36:52.919113 open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 7
12:36:52.919787 _llseek(7, 0, [0], SEEK_CUR) = 0
12:36:52.920301 fstat64(7, {st_mode=S_IFREG|0644, st_size=1302, ...}) =
0
12:36:52.920963 mmap2(NULL, 1302, PROT_READ, MAP_SHARED, 7, 0) =
0xb6fee000
12:36:52.921599 _llseek(7, 1302, [1302], SEEK_SET) = 0
12:36:52.922215 munmap(0xb6fee000, 1302) = 0
12:36:52.922749 close(7)                = 0
12:36:52.923590 open("/etc/security/pam_env.conf", O_RDONLY|O_LARGEFILE)
= 7
12:36:52.924284 fstat64(7, {st_mode=S_IFREG|0644, st_size=2980, ...}) =
0
12:36:52.924954 mmap2(NULL, 4096, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb6fee000
12:36:52.925473 read(7, "#\n# This is the configuration fi"..., 4096) =
2980
12:36:52.926186 read(7, "", 4096)       = 0
12:36:52.926678 close(7)                = 0
12:36:52.927189 munmap(0xb6fee000, 4096) = 0
12:36:52.927764 open("/etc/environment", O_RDONLY|O_LARGEFILE) = 7
12:36:52.928499 fstat64(7, {st_mode=S_IFREG|0644, st_size=0, ...}) = 0
12:36:52.929185 mmap2(NULL, 4096, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb6fee000
12:36:52.929813 read(7, "", 4096)       = 0
12:36:52.930305 close(7)                = 0
12:36:52.930818 munmap(0xb6fee000, 4096) = 0
12:36:52.931381 open("/etc/security/pam_env.conf", O_RDONLY|O_LARGEFILE)
= 7
12:36:52.932051 fstat64(7, {st_mode=S_IFREG|0644, st_size=2980, ...}) =
0
12:36:52.932713 mmap2(NULL, 4096, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb6fee000
12:36:52.933356 read(7, "#\n# This is the configuration fi"..., 4096) =
2980
12:36:52.934075 read(7, "", 4096)       = 0
12:36:52.934572 close(7)                = 0
12:36:52.935085 munmap(0xb6fee000, 4096) = 0
12:36:52.935665 open("/etc/default/locale", O_RDONLY|O_LARGEFILE) = 7
12:36:52.936250 fstat64(7, {st_mode=S_IFREG|0644, st_size=52, ...}) = 0
12:36:52.936917 mmap2(NULL, 4096, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb6fee000
12:36:52.937544 read(7, "#  File generated by update-loca"..., 4096) =
52
12:36:52.938214 read(7, "", 4096)       = 0
12:36:52.938707 close(7)                = 0
12:36:52.939216 munmap(0xb6fee000, 4096) = 0
12:36:52.940182 munmap(0xb693a000, 45200) = 0
12:36:52.940992 munmap(0xb6909000, 127468) = 0
12:36:52.941771 munmap(0xb68ff000, 36904) = 0
12:36:52.942519 munmap(0xb68f5000, 36912) = 0
12:36:52.943399 munmap(0xb68eb000, 36952) = 0
12:36:52.944152 munmap(0xb68e1000, 36972) = 0
12:36:52.944890 munmap(0xb68d6000, 41080) = 0
12:36:52.945764 munmap(0xb68c9000, 49360) = 0
12:36:52.946589 exit_group(255)         = ?
Process 27119 detached


Adrian
--
To Reply :
replace "bulleid" with "adrian" - all mail to bulleid is rejected
Sorry for the rigmarole, If I want spam, I'll go to the shops
Every time someone says "I don't believe in trolls", another one dies.

--- SoupGate-Win32 v1.05