error in syslog for telnetd

[fg_1]

Hello all

Can anyone shed some light to this error, that
appears about 1000 times a day in my syslog.

Thank you.
Nov 14 09:37:55 mmdcux02 telnetd[20973]: getpid: peer died: Error 0

[Kellogg Unix Team]

Hi,

Just a quick search showed that you might have to increase npty and nstrpty parameters.

(I can see users screaming as you are about to reboot! :-)

HTH
...Manjeet

[S.K. Chan]

The message means that the TCP/IP connection has terminated abnormally. Well, it could be due to communication problem between the telnetd process and the telnet-client process. For example a PC telnet-client that simply shutdown the PC without terminating the telnetd process gracefully could cause this message being generated. What you can do is enable inetd with "-l" so that all telnet-client IP can be logged (syslog.log) which would give you some clue where are those connection coming from.

[Kellogg Unix Team]

Oh one more parameter to change if you are running hpux 11.0 - nstrtels

...Manjeet

[steven Burgess_2]

Hi

An abnormal disconnection from a session. such as hitting the 'x' as opposed to the exit

HTH

Steve

[Ron Kinner]

Seems that it just means the user killed the program without disconnecting first.

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x78dfa848deccd61190050090279cd0f9,00.html

Nothing wrong with your system unless you think this was some sort of automatic hacker attempt.

Ron

[steven Burgess_2]

Hi

From online Doc :

If you want to proceed further with the investigation, you can identify the
client name or ip address that causes the message.

Enable verbose logging with #inetd -l. The telnet client ip address or
hostname is logged to /var/adm/syslog/syslog.log when the telnet client
makes the connection and inetd starts the telnetd pid. When the getpid error
is logged, check the pid number to see where the connection came from.

If the problem were insufficient npty, there would be an error message logged
by the telnetd pid in syslog: "Cannot allocate pty" and an error
message sent to the telnet client.

HTH

Steve

[Dave Chamberlin]

Hi there,

Ever since we started using wireless scanners in our warehouse, I have been plagued with these failed sessions. There seem to be a number of things that cause the client to drop the connection - like weak batteries, rf interference etc. We have also had "storms" from that equipment that spawned up to 5000 sessions in a period of half an hour! I agree that you need to turn on the more verbose logging (inetd -l) to see where the sessions are originating.

[Sanjay_6]

Hi,

Try this link,

http://www1.itrc.hp.com/service/cki/docDisplay.do?docLocale=en_US&docId=200000062906551

This is from hp itrc. Doc id no BHERRKBRC00006815.

Hope this helps.

Regds

[Gerhard Roets]

I would also look at crude network monitoring. Some programs connect to say port 23(Telnet). If they can establish a connection they assume telnet is running on the machine they are testing.

This could lead to interisting effects on the monitored machine i.e. the log file entries you are seeing

Regards
Gerhard

[Bill Thorsteinson]

The standard mon service to check if a port is up connects, then disconnect if nothing happens. I would expect this kind of entry in the log. I suspect other servers to do the same.

If you are using ssh, disable the telenet daemon. Whoever, is monitoring should contact you fairly quickly.