unknown log entries (need help)

unknown log entries (need help)

Post by Victo » Thu, 08 Jan 1998 04:00:00



Hello:

I've never seen these log entries before.  They are both
from the same IP so it kinda scares me.  I'm a bit paranoid
these days.  The system is an UltraSPARC running Solaris 2.5.1.

Jan  6 17:44:17 cube ftpd[13270]: setsockopt (SO_OOBINLINE): Broken pipe
Jan  6 17:44:17 cube ftpd[13270]: fcntl F_SETOWN: Broken pipe

Jan  6 17:42:51 cube telnetd[13246]: ttloop:  peer died: Error 0

I use wu-ftpd2.4 and Wietse Venema's stripped down telnet daemon from
his logdaemon package.  Any incite into those entries would be greatly
appreciated.

Thanks,

Victor

 
 
 

unknown log entries (need help)

Post by Tim Newsh » Fri, 09 Jan 1998 04:00:00


: Hello:

: I've never seen these log entries before.  They are both
: from the same IP so it kinda scares me.  I'm a bit paranoid
: these days.  The system is an UltraSPARC running Solaris 2.5.1.

: Jan  6 17:44:17 cube ftpd[13270]: setsockopt (SO_OOBINLINE): Broken pipe
: Jan  6 17:44:17 cube ftpd[13270]: fcntl F_SETOWN: Broken pipe

: Jan  6 17:42:51 cube telnetd[13246]: ttloop:  peer died: Error 0

the broken pipe remark just says that after the connection was
made, the remote side closed the connection unexpectedly and
then your daemon tried to do something with the socket expecting
it to still be open.  This probably happened because the remote
side closed the connection right after opening it.  The peer
died line probably indicates the same.  Perhaps someone was
port scanning you.

: Victor

                                           Tim N.

 
 
 

1. Unknown /var/log/messages entries

What's up with this?  My linux machine has been purring
along nicely for months and this morning I peruse
/var/log/messages and find this:

Oct  1 04:02:01 starfleet PAM_pwdb[9064]: (su) session
opened for user nobody by (uid=99)
Oct  1 04:02:05 starfleet kernel: t=12, limit=4
Oct  1 04:02:05 starfleet kernel: Directory sread (sector
0x18) failed
Oct  1 04:02:05 starfleet kernel: attempt to access beyond
end of device
Oct  1 04:02:05 starfleet kernel: 02:00: rw=0, want=12,
limit=4
Oct  1 04:02:05 starfleet kernel: Directory sread (sector
0x18) failed
Oct  1 04:02:05 starfleet kernel: attempt to access beyond
end of device
Oct  1 04:02:05 starfleet kernel: 02:00: rw=0, want=12,
limit=4
Oct  1 04:02:05 starfleet kernel: Directory sread (sector
0x18) failed
Oct  1 04:02:05 starfleet kernel: attempt to access beyond
end of device
Oct  1 04:02:05 starfleet kernel: 02:00: rw=0, want=12,
limit=4
Oct  1 04:02:05 starfleet kernel: Directory sread (sector
0x18) failed

...and so on for many screens.

Looking back through old logs I can see that it also did
this on 1-Sept-99.  Obviously, it's a cron job doing some
routine maintenance but I'm not sure wwhich job or what it's
trying to do.  I don't see any likely culprits in
/etc/cron.daily|weekly|monthly.  Running RH v5.1 and kernel
2.2.1 here.

--


2. Is there a MS Word (or substitute) for Linux?

3. Need help with Portsentry log entry

4. what is fiber channel?

5. RPM for IP Masq?

6. Message log entry - need help interpreting it.

7. Local Area Network

8. 2.5.73-bk5 -- intermezzo.ko needs unknown symbol set_fs_root, vga16fb.ko needs unknown symbol screen_info

9. Help with some unknown entries in /etc/services

10. Help on some unknown entries in /etc/services

11. Several entries in log into one entry, how?

12. need message log entry explanation