topic Strange message in syslog in Operating System - HP-UX

Strange message in syslog

haneps — Fri, 05 Sep 2008 07:16:26 GMT

Hi All,

Good day to all!

I need your assistance regarding below error messages in syslog. The messages repeated for about 15-25 lines each. Because of this(I believe), the server is going really slow until it goes back to normal condition in 4 hours time. Any idea what went wrong?

[root@iks90][/var/adm/syslog]# uname -a;uptime
HP-UX iks90 B.11.11 U 9000/800 unknown unknown HP-UX
10:28am up 20 days 19:56, 18 users, load average: 0.23, 0.31, 0.37
[root@iks90][/var/adm/syslog]#

Sep 5 08:49:25 iks90 inetd[16065]: exec/tcp: Connection from pc194_104 (10.235.194.104) at Fri Sep 5 08:49:25 2008
Sep 5 08:49:25 iks90 inetd[16067]: exec/tcp: Connection from pc194_104 (10.235.194.104) at Fri Sep 5 08:49:25 2008
Sep 5 08:49:25 iks90 inetd[16069]: exec/tcp: Connection from pc194_104 (10.235.194.104) at Fri Sep 5 08:49:25 2008
Sep 5 08:49:25 iks90 inetd[16071]: exec/tcp: Connection from pc194_104 (10.235.194.104) at Fri Sep 5 08:49:25 2008
Sep 5 08:49:25 iks90 inetd[16073]: exec/tcp: Connection from pc194_104 (10.235.194.104) at Fri Sep 5 08:49:25 2008
Sep 5 08:49:25 iks90 inetd[16075]: exec/tcp: Connection from pc194_104 (10.235.194.104) at Fri Sep 5 08:49:25 2008
Sep 5 08:49:26 iks90 inetd[16078]: exec/tcp: Connection from pc194_104 (10.235.194.104) at Fri Sep 5 08:49:26 2008
Sep 5 08:49:26 iks90 inetd[16080]: exec/tcp: Connection from pc194_104 (10.235.194.104) at Fri Sep 5 08:49:26 2008
Sep 5 08:49:26 iks90 inetd[16083]: exec/tcp: Connection from pc194_104 (10.235.194.104) at Fri Sep 5 08:49:26 2008

Sep 5 10:02:49 iks90 inetd[1278]: registrar/tcp: Connection from iks90 (130.171.226.90) at Fri Sep 5 10:02:49 2008
Sep 5 10:04:49 iks90 inetd[1494]: registrar/tcp: Connection from iks90 (130.171.226.90) at Fri Sep 5 10:04:49 2008
Sep 5 10:06:49 iks90 inetd[2219]: registrar/tcp: Connection from iks90 (130.171.226.90) at Fri Sep 5 10:06:49 2008

Sep 5 07:42:38 iks90 inetd[4025]: registrar/tcp: Connection from iks90 (130.171.226.90) at Fri Sep 5 07:42:38 2008
Sep 5 07:44:38 iks90 inetd[4370]: registrar/tcp: Connection from iks90 (130.171.226.90) at Fri Sep 5 07:44:38 2008
Sep 5 07:46:39 iks90 inetd[4611]: registrar/tcp: Connection from iks90 (130.171.226.90) at Fri Sep 5 07:46:39 2008
Sep 5 07:48:39 iks90 inetd[4752]: registrar/tcp: Connection from iks90 (130.171.226.90) at Fri Sep 5 07:48:39 2008

Sep 5 03:00:04 iks90 remshd[6280]: PAM Status - 10, PAM Error Message - Get new authentication token
Sep 5 03:00:04 iks90 inetd[6286]: shell/tcp: Connection from iks90 (130.171.226.90) at Fri Sep 5 03:00:04 2008
Sep 5 03:00:04 iks90 remshd[6286]: PAM Status - 10, PAM Error Message - Get new authentication token
Sep 5 03:00:04 iks90 inetd[6288]: shell/tcp: Connection from iks90 (130.171.226.90) at Fri Sep 5 03:00:04 2008
Sep 5 03:00:04 iks90 remshd[6288]: PAM Status - 10, PAM Error Message - Get new authentication token
Sep 5 03:00:05 iks90 inetd[6305]: shell/tcp: Connection from iks90 (130.171.226.90) at Fri Sep 5 03:00:05 2008

Re: Strange message in syslog

Jeeshan — Fri, 05 Sep 2008 09:20:45 GMT

>>PAM Status - 10, PAM Error Message - Get new authentication token

The PAM error indicates the user password ( which is being referred as "token") should be changed because the password is either NULL or it has aged.

The error is given by remshd because it does use PAM authentication for the user who is trying to access this system for trying to run commands through remsh from remote system.

check your /etc/nsswitch.conf file.

Re: Strange message in syslog

TTr — Fri, 05 Sep 2008 11:51:47 GMT

What OS version is thi son?These are 3 separate incidents.
1. exec/tcp: Check the pc194_104. It is running rexec-s repeatedly. How many of these do you get? It could be normal, or it could be some user process gone bad or it could be an attack.
2. registrar: Have you set up any EMS monitoring related processes from within this server? How many of these mesaages do you get? The registrar service is used by EMS. Run "netstat -a" to see all the registrar port connections. You could use lsof to see which processes are using these ports. Typically it is disabled in inetd.conf. Check and install EMS patches.
3. This is a remsh process runing at 3:00am. Check which script runs at that time in cron and find out what the script is doing. The problem with this one is that the remsh is taking place within the same server. This script was probably runing fine on another server because it was using remsh to iks90 to do something. But when you moved it to iks90 the remsh fails.

Re: Strange message in syslog

SUDHAKAR_18 — Fri, 05 Sep 2008 12:00:13 GMT

Hi,

Is there any botleneck condition.
check #top , #glance
also check file system space using #bdf.