ftp user reconnects twice to logon to hpux server ?why ?

[Sammy_2]

hpux 11.11 (trusted system)
See log below. Source server is abc.domain.com
IP address of abc.domain.com is 10.34.5.23
Don't know why log says "Hostname is paranoid" since I don't know of anyserver by that name.


ftp user unable to connect first time but
Turns around and reconnects and it lets him ftp fine. WHY ? Later I see allowed message in the log as well.

user is in /etc/passwd
# grep ftpuser /etc/passwd
ftpuser:*:390:125:Mass Dti Ftp User:/users/escript/dti/prod/input/mass:/usr/bin/false
Thanks

=============
syslog.log from the time ftp user tries to connect
=============

Mar 15 12:18:36 inbphes6 ftpd[3305]: HostName is paranoid
Mar 15 12:18:36 inbphes6 ftpd[3305]: HostAddr is 10.34.5.23
Mar 15 12:18:36 inbphes6 ftpd[3305]: RemoteUser is unknown
Mar 15 12:18:36 inbphes6 ftpd[3305]: refused connect from 10.34.5.23
Mar 15 12:18:36 inbphes6 syslogd: read funix: Resource temporarily unavailable
Mar 15 12:19:10 inbphes6 ftpd[3532]: HostName is abc.domain.com
.com
Mar 15 12:19:10 inbphes6 syslogd: read funix: Resource temporarily unavailable
Mar 15 12:19:10 inbphes6 ftpd[3532]: Checking /etc/hosts.allow file
Mar 15 12:19:10 inbphes6 syslogd: read funix: Resource temporarily unavailable
Mar 15 12:19:10 inbphes6 syslogd: read funix: Resource temporarily unavailable

Mar 15 12:19:10 inbphes6 ftpd[3532]: RemoteUser is unknown
Mar 15 12:19:10 inbphes6 ftpd[3532]: allowed connection from abc.domain.com
Mar 15 12:19:10 inbphes6 syslogd: read funix: Resource temporarily unavailable
============================


ftp Client ftp log
=========================

FTP DATE FTP_RETURN_CODE FTP_MESSAGE
3/15/06 12:18 PM 12 Error 6: To get description lookup Winlnet error codes
==========================

[Alex Glennie · Accepted solution]

a guess but https://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=67390

maybe worth checking

[Sammy_2]

Alex,
you may have a point. I see multiple syslogd running. I 've followed the link and seems like that could be my solution too. I will check with the client tommorow.
THanks for the link