topic Re: Error Logs from inetd in syslog file in Operating System - HP-UX

Error Logs from inetd in syslog file

Jorge Mel — Wed, 02 Aug 2006 10:21:57 GMT

Aug 2 08:16:38 hpmtest inetd[29355]: ftp/tcp: Connection from unknown (172.23.200.77) at Wed Aug 2 08:16:38 2006
Aug 2 08:16:38 hpmtest inetd[29356]: telnet/tcp: Connection from unknown (172.23.200.77) at Wed Aug 2 08:16:38 2006
Aug 2 08:16:38 hpmtest telnetd[29356]: getpid: peer died: Error 0
Aug 2 08:17:36 hpmtest inetd[29377]: registrar/tcp: Connection from hpmtest (172.23.200.97) at Wed Aug 2 08:17:36 2006

I am not sure how to stop these errors. I am currently running inetd -l so I can record errors in syslog. One of the IP address is from the server itself (172.23.200.97).

thank you,

Re: Error Logs from inetd in syslog file

Mel Burslan — Wed, 02 Aug 2006 10:27:34 GMT

if you do not want to see these inetd messages, all you need to do is to restart inetd without -l (logging) option as follows

/usr/sbin/inetd -k
/usr/sbin/inetd

Re: Error Logs from inetd in syslog file

Jorge Mel — Wed, 02 Aug 2006 10:37:27 GMT

Do I need to be concern of the errors. I have never seen these errors on my other Unix servers? Is it a configuration issue?
Errors without logging:
Aug 2 08:31:31 hpmtest telnetd[29787]: getpid: peer died: Error 0
Aug 2 08:33:14 hpmtest telnetd[29822]: getpid: peer died: Error 0
Aug 2 08:35:33 hpmtest telnetd[29880]: getpid: peer died: Error 0

Re: Error Logs from inetd in syslog file

Mel Burslan — Wed, 02 Aug 2006 10:48:34 GMT

these errors can be attributed to people telneting in and not doing the login in a timely nammer and their session timing out or plain they decide they will not login this time and kill their telnet session. Nothing worth worrying about.

the unknown in the string means, no username has been specified but from the IP address you can figure out who or where they are coming from.

Again if these IP addresses are from your internal network or authorized location IP addresses, it is okay. Nothing to worry about. If not, start and investigation with your security people as they may escalate to something more than just probing.

Re: Error Logs from inetd in syslog file

Jorge Mel — Wed, 02 Aug 2006 11:04:57 GMT

I stop and started the inetd and I am still recording messages in the syslog. One of the IP address is from the server itself:
hpmtest inetd[2075]: registrar/tcp: Connection from hpmtest (172.23.200.97) at Wed Aug 2 09:03:37 2006

Re: Error Logs from inetd in syslog file

inventsekar_1 — Wed, 02 Aug 2006 11:06:27 GMT

Take care with "Connection from unknown " msg's.

To disable inetd logging:
in /etc/rc.config.d/netdaemons

export INETD_ARGS="" ----> logging disabled.
export INETD_ARGS="-1" ---> logging enabled.

and Better keep the inetd logging enabled. that will give you information like this.

Re: Error Logs from inetd in syslog file

Patrick Wallek — Wed, 02 Aug 2006 11:06:44 GMT

The message:

Aug 2 08:17:36 hpmtest inetd[29377]: registrar/tcp: Connection from hpmtest (172.23.200.97) at Wed Aug 2 08:17:36 2006

is generated by the EMS software and is perfectly normal. You don't need to worry about it.

Re: Error Logs from inetd in syslog file

Steven E. Protter — Wed, 02 Aug 2006 11:09:28 GMT

Shalom,

I think you should leave those messages enabled.

If you have SOX or similar audit requirements you should keep this information and try to figure out why "from unknown" is showing up in your logs.

SEP

Re: Error Logs from inetd in syslog file

inventsekar_1 — Wed, 02 Aug 2006 11:16:09 GMT

/* I stop and started the inetd and I am still recording messages in the syslog. */
------------------------------------------

restarting the inetd is not the solution. in my previous reply u can find how to do that.

after editing the config file. u can simply run:
#inetd -c --> to re-read the config file.
this will avoid the inetd restarting.

Re: Error Logs from inetd in syslog file

Jorge Mel — Wed, 02 Aug 2006 11:20:30 GMT

That is where I am puzzle, the 'unknown IP is the IP assigned to the host getting the errors.
I prefer not to disable inetd logging.

Re: Error Logs from inetd in syslog file

Jorge Mel — Wed, 02 Aug 2006 11:30:24 GMT

I wanted to add that these errors are recorded every couple of minutes in the syslog file.

Re: Error Logs from inetd in syslog file

inventsekar_1 — Wed, 02 Aug 2006 11:35:26 GMT

/* the 'unknown IP is the IP assigned to the host getting the errors. */

hpmtest ip is 172.23.200.97
unknown system's ip is 172.23.200.77 isnt?

Re: Error Logs from inetd in syslog file

Mel Burslan — Wed, 02 Aug 2006 11:47:59 GMT

I bet if you lookup the name for IP address 172.23.200.77, it will not return anything. That is why you see it is unknown. even if you assign this address to another interface on the same server, unless it can resolve its name by a reverse lookup, it will show as "unknown" in the syslog.

the protocol, ftp/telnet or what have you, shhows you what type of connection got originated from this ip address.

hope this helps a bit.

Re: Error Logs from inetd in syslog file

Jorge Mel — Wed, 02 Aug 2006 12:14:56 GMT

I found the 'unknown' IP. It was coming from a monitoring server. I removed my host from the monitoring server and it cleaned up the syslog file.

Thank you all.