https://community.hpe.com/t5/operating-system-hp-ux/user-mail/m-p/3741328#M740558 hy, <BR /><BR />I monitor on lines in the /var/adm/syslog/syslog.log<BR />Depening on how You normaly monitor your system you need a adisional script, tng, tivoly and hpopenview can be configured to monitor this lines.<BR />the lines are:<BR /><BR />rexecd[28617]: read: Connection refused<BR />DBLISTENER[28853]: .CADB_F_999 Pid=28853: Interrupted child process is being terminated<BR /> remshd[28952]: Connection from 0.0.0.0 on illegal port<BR />telnetd[29024]: getpid: peer died: Error 0<BR /> ftpd[10504]: FTP LOGIN REFUSED (ftp not in /etc/passwd) FROM manual-1.1.1.1, anonymous<BR /> Wed, 01 Mar 2006 04:05:53 GMT F Verschuren 2006-03-01T04:05:53Z https://community.hpe.com/t5/operating-system-hp-ux/user-mail/m-p/3741327#M740557 Hi everyone,<BR /><BR />I am wondering if anyone has put together a script that will monitor user mail for signs of anomolies such as an attack. Thanks in advance for sharing!!! Wed, 01 Mar 2006 00:03:27 GMT https://community.hpe.com/t5/operating-system-hp-ux/user-mail/m-p/3741327#M740557 TheJuiceman 2006-03-01T00:03:27Z https://community.hpe.com/t5/operating-system-hp-ux/user-mail/m-p/3741328#M740558 hy, <BR /><BR />I monitor on lines in the /var/adm/syslog/syslog.log<BR />Depening on how You normaly monitor your system you need a adisional script, tng, tivoly and hpopenview can be configured to monitor this lines.<BR />the lines are:<BR /><BR />rexecd[28617]: read: Connection refused<BR />DBLISTENER[28853]: .CADB_F_999 Pid=28853: Interrupted child process is being terminated<BR /> remshd[28952]: Connection from 0.0.0.0 on illegal port<BR />telnetd[29024]: getpid: peer died: Error 0<BR /> ftpd[10504]: FTP LOGIN REFUSED (ftp not in /etc/passwd) FROM manual-1.1.1.1, anonymous<BR /> Wed, 01 Mar 2006 04:05:53 GMT https://community.hpe.com/t5/operating-system-hp-ux/user-mail/m-p/3741328#M740558 F Verschuren 2006-03-01T04:05:53Z