inetd: registrar/tcp: Connection from xxxx.com

[Sandip Ghosh]

OS : HP-UX 10.20
Model: HP K460

In our environment we have enabled the inetd logging by "inetd -l". In the syslog file, after 2 min I am getting the following message:

Jun 6 13:55:56 xxxx inetd[15096]: registrar/tcp: Connection from xxxx


where xxxx is the host name. I have checked the crontab there is nothing in the crontab. I have checked the crontablog also, I haven't got any trace over there also.

Can any of you please let me know the possible sources from where I can search out the reason of these messages?

Sandip

[Mark Greene_1]

does netstat -anv show the host name anywhere in the listing?

Mark

[Helen French · Accepted solution]

These messages might be coming from EMS monitor tools !

Check this document for more information (TKB #A5541335):

http://support1.itrc.hp.com/service/cki/docDisplay.do?docLocale=en_US&docId=200000034057902

[Sandip Ghosh]

Wherever the TCP connection has been established it is showing the IP add of the host.

Actually it is doing on self address.

Sandip

[Jon Mattatall]

Check the "xxxx" machine's /etc/inetd.conf for the "register" entry. Actually, it may be in the target machine's as well. There may be some comments there.

Jon

[Helen French]

Again, check this document about EMS and Registrar (TKB #DFQKBCA00000366):

http://support1.itrc.hp.com/service/cki/docDisplay.do?docLocale=en_US&docId=200000055530098

[Sandip Ghosh]

Yes Shiju,

You are right. I have seen the other server also where EMS is enabled. There also the same thing. It is coming from the EMS.

Thanks a lot.

Sandip