topic Re: Syslogd messages in Operating System - Linux

Syslogd messages

Edwin Ruiz_2 — Tue, 03 Feb 2004 10:47:53 GMT

Hi!

I am receiving constantly this messages in my linux console.. is this a problem? thanks

Message from syslogd@salato-apl10 at Tue Feb 3 09:40:00 2004 ...
salato-apl10

Re: Syslogd messages

Olivier Drouin — Tue, 03 Feb 2004 11:02:13 GMT

Did you truncate the message or its all you get ?
Do you have anything related in /var/log/messages ?

salato-apl10 : is it your localhost or a remote box ?

Re: Syslogd messages

Edwin Ruiz_2 — Tue, 03 Feb 2004 11:19:37 GMT

This is all the messages... This is one tail of /var/log/messages:

[32446]: FTP session closed
Feb 3 10:10:35 salato-apl10 ftpd[32501]: FTP LOGIN FROM 57.234.98.17 [57.234.98.17], iasuser
Feb 3 10:10:36 salato-apl10 ftpd[32504]: FTP LOGIN FROM 57.234.98.17 [57.234.98.17], iasuser
Feb 3 10:12:09 salato-apl10 ftpd[826]: FTP LOGIN FROM 57.234.98.17 [57.234.98.17], iasuser
Feb 3 10:12:13 salato-apl10 ftpd[826]: FTP session closed
Feb 3 10:15:00 salato-apl10
Feb 3 10:15:00 salato-apl10 78>Feb 3 10:15:00 CROND[2240]: (root) CMD (/usr/bin/mrtg /etc/mrtg/mrtg.cfg)
Feb 3 10:15:00 salato-apl10

Re: Syslogd messages

Alexander Chuzhoy — Tue, 03 Feb 2004 11:26:07 GMT

Try to edit the file /etc/syslog.conf

see if the line with /dev/console isn't remarked and if it's so -just mark it with #

Best Regards.

Re: Syslogd messages

Edwin Ruiz_2 — Tue, 03 Feb 2004 11:35:01 GMT

Line is comment with #

[root@salato-apl10 etc]# more syslog.conf
# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.* /dev/console

this is the line.

Re: Syslogd messages

Alexander Chuzhoy — Tue, 03 Feb 2004 11:39:56 GMT

How often do you receive this message?

try to see if there's a respective job in crontab....

Re: Syslogd messages

Sergejs Svitnevs — Tue, 03 Feb 2004 11:52:26 GMT

If syslog cannot pass the message to syslogd it will attempt to write the message to the console (/dev/console).
You need to check /etc/syslog.conf for it's contents (man syslog.conf).

Regards,
Sergejs

Re: Syslogd messages

Edwin Ruiz_2 — Tue, 03 Feb 2004 12:06:10 GMT

i receive this messages 5 minutes

Re: Syslogd messages

Alexander Chuzhoy — Tue, 03 Feb 2004 12:14:20 GMT

let's try to isolate the problem

try to shutdown the syslogd service
service syslog stop

and see if the message comes again....

Re: Syslogd messages

Edwin Ruiz_2 — Tue, 03 Feb 2004 12:34:22 GMT

i dont receive messages again... i can not to connect with root to my system.. i can not make a new conection ... i have many problemas now... command ps give this error

Signal 17 caught by ps (procps version .).
Please send bug reports to

/var/log/messages show
Feb 1 04:02:04 salato-apl10 modprobe: modprobe: Can't locate module ppp0
Feb 1 04:02:04 salato-apl10 modprobe: modprobe: Can't locate module ppp0
Feb 1 04:02:05 salato-apl10 modprobe: modprobe: Can't locate module ppp0
Feb 1 04:02:05 salato-apl10 modprobe: modprobe: Can't locate module ppp0
Feb 1 04:02:06 salato-apl10 modprobe: modprobe: Can't locate module ppp0
Feb 1 04:02:07 salato-apl10 modprobe: modprobe: Can't locate module ppp0
Feb 1 04:22:00 salato-apl10 modprobe: modprobe: Can't locate module ppp0

Re: Syslogd messages

Alexander Chuzhoy — Tue, 03 Feb 2004 12:40:04 GMT

did you compile your kernel recently and now booted with new kernel?

look s like your system can't find a module for modem ....

Re: Syslogd messages

Edwin Ruiz_2 — Tue, 03 Feb 2004 12:48:01 GMT

i did not compile my kernel.. i install other kernel but no in that date.

last month i had that messages, when i reboot my system this cant bring up lo.. i reinstall my OS

Re: Syslogd messages

Alexander Chuzhoy — Tue, 03 Feb 2004 12:51:46 GMT

was your system connected directly to the internet?
Maybe it was hacked..

Re: Syslogd messages

Edwin Ruiz_2 — Tue, 03 Feb 2004 12:56:24 GMT

yes i am direct to internet.... oh my god!

Re: Syslogd messages

Edwin Ruiz_2 — Tue, 03 Feb 2004 13:02:35 GMT

can i do something for repair that?

Re: Syslogd messages

Alexander Chuzhoy — Tue, 03 Feb 2004 13:10:20 GMT

if you didn't "backup" it-then I suggest you to reinstall everything from scratch.
If you didn't use firewall/iptables on your machine with some thorough configuration then your machine was like a honeypot.
Never do it again in the future unless you wish to make your machine a honeypot to see what can be done by some "nice" cracker.

Re: Syslogd messages

Alexander Chuzhoy — Tue, 03 Feb 2004 14:05:15 GMT

One more point:
It could also be a result of virus or some other malicious code that can be actually removed with antivirus or removal tool.
Sorry for this (important) notice coming late -maybe too late...

Re: Syslogd messages

Edwin Ruiz_2 — Tue, 03 Feb 2004 14:09:11 GMT

Are ther virus for linux?

Re: Syslogd messages

Alexander Chuzhoy — Tue, 03 Feb 2004 14:16:33 GMT

there sure are .
I use trendmicro's antivirus for protection but it costs money-there's free antivirus for linux-go here to download it:
http://www.ravantivirus.com/

Re: Syslogd messages

Edwin Ruiz_2 — Tue, 03 Feb 2004 16:22:49 GMT

I install Mc Afee AV (uv scan for linux), but when i can scan my file systems i get this error

The program has been altered; please replace it with a good copy.