Large number of rlpdaemon is running

[Dhananjaya Amarakoon]

Dear Friends

In our office environment I have three HP Integrity rx7620 servers that are running HP-UX 11.23.
Server one and two run under cluster environment and other is running separately.

In previous two days I got following problem simultaneously for all three servers. Large number of rlpdaemon -l processes was running in three servers without user interaction. May around 2000 processes each server.

I want to know why that is happened.
Is that some third party activate this?
Or some intrusion attack?
What is the procedure to know how this process activates automatically?

Please help me

Thanks & Regards
Dhananjaya Amarakoon

[Dennis Handly]

If you look at rlpdaemon(1M) it says -l is logging to /var/adm/lp/lpd.log.
http://docs.hp.com/en/B2355-60130/rlpdaemon.1M.html

[Dhananjaya Amarakoon]

Hi,
sorry. it was rlpdaemon -i not the -l. I check the /var/adm/lp/lpd.log. it shows large number of following lines

Lost connection: Address of the peer socket could not be got
Lost connection: Address of the peer socket could not be got
Lost connection: Address of the peer socket could not be got
Lost connection: Address of the peer socket could not be got
...


Plese help.
Thanks & Regards
Dhananjaya Amarakoon

[skt_skt]

Does that process attached to any particular print queue.

If it lists any queue name; being a remote printer try connecting to port 515 an check.

[Dhananjaya Amarakoon]

Hi Santhosh

What do you mean by "Does that process attached to any particular print queue ? " I didn't get it.

This server connect to canan printer via windows printer server. Other than that this servers not confiure for act as print server.
But I telnet to server via port 515 and it is possible.

Is that mean this server act as remote print server ?

If that so that mean some thired party person has sending a large number of print requrest to this server ?

or something else heppend ?

Please help me regarding this

Thanks & Regards
Dhananjaya Amarakoon.

[Dennis Handly]

Does lpstat indicate a lot of printing to that printer?

All of those socket errors may be causing a loop?