topic Re: error in syslog for telnetd in Operating System - HP-UX

error in syslog for telnetd

fg_1 — Thu, 14 Nov 2002 15:16:06 GMT

Hello all

Can anyone shed some light to this error, that
appears about 1000 times a day in my syslog.

Thank you.
Nov 14 09:37:55 mmdcux02 telnetd[20973]: getpid: peer died: Error 0

Re: error in syslog for telnetd

Kellogg Unix Team — Thu, 14 Nov 2002 15:19:17 GMT

Hi,

Just a quick search showed that you might have to increase npty and nstrpty parameters.

(I can see users screaming as you are about to reboot! :-)

HTH
...Manjeet

Re: error in syslog for telnetd

S.K. Chan — Thu, 14 Nov 2002 15:20:10 GMT

The message means that the TCP/IP connection has terminated abnormally. Well, it could be due to communication problem between the telnetd process and the telnet-client process. For example a PC telnet-client that simply shutdown the PC without terminating the telnetd process gracefully could cause this message being generated. What you can do is enable inetd with "-l" so that all telnet-client IP can be logged (syslog.log) which would give you some clue where are those connection coming from.

Re: error in syslog for telnetd

Kellogg Unix Team — Thu, 14 Nov 2002 15:22:40 GMT

Oh one more parameter to change if you are running hpux 11.0 - nstrtels

...Manjeet

Re: error in syslog for telnetd

steven Burgess_2 — Thu, 14 Nov 2002 15:23:47 GMT

Hi

An abnormal disconnection from a session. such as hitting the 'x' as opposed to the exit

HTH

Steve

Re: error in syslog for telnetd

Ron Kinner — Thu, 14 Nov 2002 15:27:01 GMT

Seems that it just means the user killed the program without disconnecting first.

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x78dfa848deccd61190050090279cd0f9,00.html

Nothing wrong with your system unless you think this was some sort of automatic hacker attempt.

Ron

Re: error in syslog for telnetd

steven Burgess_2 — Thu, 14 Nov 2002 15:32:45 GMT

Hi

From online Doc :

If you want to proceed further with the investigation, you can identify the
client name or ip address that causes the message.

Enable verbose logging with #inetd -l. The telnet client ip address or
hostname is logged to /var/adm/syslog/syslog.log when the telnet client
makes the connection and inetd starts the telnetd pid. When the getpid error
is logged, check the pid number to see where the connection came from.

If the problem were insufficient npty, there would be an error message logged
by the telnetd pid in syslog: "Cannot allocate pty" and an error
message sent to the telnet client.

HTH

Steve

Re: error in syslog for telnetd

Dave Chamberlin — Thu, 14 Nov 2002 17:19:29 GMT

Hi there,

Ever since we started using wireless scanners in our warehouse, I have been plagued with these failed sessions. There seem to be a number of things that cause the client to drop the connection - like weak batteries, rf interference etc. We have also had "storms" from that equipment that spawned up to 5000 sessions in a period of half an hour! I agree that you need to turn on the more verbose logging (inetd -l) to see where the sessions are originating.

Re: error in syslog for telnetd

Sanjay_6 — Thu, 14 Nov 2002 18:04:08 GMT

Hi,

Try this link,

http://www1.itrc.hp.com/service/cki/docDisplay.do?docLocale=en_US&docId=200000062906551

This is from hp itrc. Doc id no BHERRKBRC00006815.

Hope this helps.

Regds

Re: error in syslog for telnetd

Gerhard Roets — Fri, 15 Nov 2002 13:53:59 GMT

I would also look at crude network monitoring. Some programs connect to say port 23(Telnet). If they can establish a connection they assume telnet is running on the machine they are testing.

This could lead to interisting effects on the monitored machine i.e. the log file entries you are seeing

Regards
Gerhard

Re: error in syslog for telnetd

Bill Thorsteinson — Fri, 15 Nov 2002 14:27:36 GMT

The standard mon service to check if a port is up connects, then disconnect if nothing happens. I would expect this kind of entry in the log. I suspect other servers to do the same.

If you are using ssh, disable the telenet daemon. Whoever, is monitoring should contact you fairly quickly.