Error Logs from inetd in syslog file

[Jorge Mel]

Aug 2 08:16:38 hpmtest inetd[29355]: ftp/tcp: Connection from unknown (172.23.200.77) at Wed Aug 2 08:16:38 2006
Aug 2 08:16:38 hpmtest inetd[29356]: telnet/tcp: Connection from unknown (172.23.200.77) at Wed Aug 2 08:16:38 2006
Aug 2 08:16:38 hpmtest telnetd[29356]: getpid: peer died: Error 0
Aug 2 08:17:36 hpmtest inetd[29377]: registrar/tcp: Connection from hpmtest (172.23.200.97) at Wed Aug 2 08:17:36 2006


I am not sure how to stop these errors. I am currently running inetd -l so I can record errors in syslog. One of the IP address is from the server itself (172.23.200.97).

thank you,

[Mel Burslan]

if you do not want to see these inetd messages, all you need to do is to restart inetd without -l (logging) option as follows

/usr/sbin/inetd -k
/usr/sbin/inetd

[Jorge Mel]

Do I need to be concern of the errors. I have never seen these errors on my other Unix servers? Is it a configuration issue?
Errors without logging:
Aug 2 08:31:31 hpmtest telnetd[29787]: getpid: peer died: Error 0
Aug 2 08:33:14 hpmtest telnetd[29822]: getpid: peer died: Error 0
Aug 2 08:35:33 hpmtest telnetd[29880]: getpid: peer died: Error 0

[Mel Burslan]

these errors can be attributed to people telneting in and not doing the login in a timely nammer and their session timing out or plain they decide they will not login this time and kill their telnet session. Nothing worth worrying about.

the unknown in the string means, no username has been specified but from the IP address you can figure out who or where they are coming from.

Again if these IP addresses are from your internal network or authorized location IP addresses, it is okay. Nothing to worry about. If not, start and investigation with your security people as they may escalate to something more than just probing.

[Jorge Mel]

I stop and started the inetd and I am still recording messages in the syslog. One of the IP address is from the server itself:
hpmtest inetd[2075]: registrar/tcp: Connection from hpmtest (172.23.200.97) at Wed Aug 2 09:03:37 2006

[inventsekar_1]

Take care with "Connection from unknown " msg's.

To disable inetd logging:
in /etc/rc.config.d/netdaemons

export INETD_ARGS="" ----> logging disabled.
export INETD_ARGS="-1" ---> logging enabled.

and Better keep the inetd logging enabled. that will give you information like this.

[Patrick Wallek]

The message:

Aug 2 08:17:36 hpmtest inetd[29377]: registrar/tcp: Connection from hpmtest (172.23.200.97) at Wed Aug 2 08:17:36 2006

is generated by the EMS software and is perfectly normal. You don't need to worry about it.

[Steven E. Protter]

Shalom,

I think you should leave those messages enabled.

If you have SOX or similar audit requirements you should keep this information and try to figure out why "from unknown" is showing up in your logs.

SEP

[inventsekar_1]

/* I stop and started the inetd and I am still recording messages in the syslog. */
------------------------------------------

restarting the inetd is not the solution. in my previous reply u can find how to do that.

after editing the config file. u can simply run:
#inetd -c --> to re-read the config file.
this will avoid the inetd restarting.

[Jorge Mel]

That is where I am puzzle, the 'unknown IP is the IP assigned to the host getting the errors.
I prefer not to disable inetd logging.

[Jorge Mel]

I wanted to add that these errors are recorded every couple of minutes in the syslog file.

[inventsekar_1]

/* the 'unknown IP is the IP assigned to the host getting the errors. */

hpmtest ip is 172.23.200.97
unknown system's ip is 172.23.200.77 isnt?

[Mel Burslan · Accepted solution]

I bet if you lookup the name for IP address 172.23.200.77, it will not return anything. That is why you see it is unknown. even if you assign this address to another interface on the same server, unless it can resolve its name by a reverse lookup, it will show as "unknown" in the syslog.

the protocol, ftp/telnet or what have you, shhows you what type of connection got originated from this ip address.

hope this helps a bit.

[Jorge Mel]

I found the 'unknown' IP. It was coming from a monitoring server. I removed my host from the monitoring server and it cleaned up the syslog file.

Thank you all.