topic Re: Unknown syslog entries in Operating System - HP-UX

Unknown syslog entries

Simon R Wootton — Mon, 02 Jun 2003 12:13:17 GMT

I am getting thousands upon thousands of the following error messages in the syslog over a period of days :

Jun 2 14:08:27 n4000 popper: -ERR Unknown command : "uidl".
Jun 2 14:08:27 n4000 popper: -ERR Unknown command : "capa".

It's suggesting it's sendmail related with the popper statement (n4000 is our host name).

Has anyone seen these before ?
Does anyone know how to stop them ?

All help appreciated and rewarded !!

Regards
Simon

Re: Unknown syslog entries

Bruno Vidal — Mon, 02 Jun 2003 12:19:44 GMT

Hi,
It sound like you have pop3 running on your server, take a look to see if it is running as a deamon (ps -ef | grep pop) or if it is launch by inetd (vi /etc/inetd.conf). But the real problem is that pop3 is recieving some bad connection on port 110. You can stop it by removing from inetd.conf or killing the deamon, but the most important I think is tu use nettl to trace which IP adress is trying to send so much bad thing on port 110.

Cheers.

Re: Unknown syslog entries

Bill Douglass — Mon, 02 Jun 2003 12:29:19 GMT

The messages indicate that you are running the pop3 daemon, popper.

The error messages relate to newer pop3 commands uidl and capa, which are used by some pop3 client (such a Eudora). Older pop3 daemons, such as the one you are running, do not support these commands, and log the resulting error message in syslog.

You can either upgrade your pop3 daemon

(http://www.eudora.com/qpopper/)

or change the location that popper is logging error messages to (log-facility option in the configuration file).

Re: Unknown syslog entries

Michael Steele_2 — Mon, 02 Jun 2003 12:49:24 GMT

Sounds like you're running 'qpopper':

http://hpux.cict.fr/hppd/hpux/Networking/Mail/qpopper-2.53/

'qpopper' guide:

ftp://ftp.qualcomm.com/eudora/servers/unix/popper/GUIDE.pdf

uidl:

UIDL. Unique Identifier List. See UID (Unique Identifier).

capa:

CAPA. CAPA is a new POP extension (RFC 2449) which permits a POP server to give information
to a client about other supported POP extensions, optional server behavior, and
site policy.

In short, you're command set is incomplete and further installation and / or configuration are needed.