repeated FTP session closed messages

[Richard Mertz]

The following is excerpted from the syslog on one of our servers. No other FTP related messages. This occurs 24X7. Any ideas as to what could be causing this?

Feb 26 23:33:39 ziff ftpd[21868]: FTP session closed
Feb 26 23:34:19 ziff ftpd[21869]: FTP session closed
Feb 26 23:38:38 ziff ftpd[21874]: FTP session closed
Feb 26 23:39:05 ziff ftpd[21875]: FTP session closed
Feb 26 23:43:38 ziff ftpd[21880]: FTP session closed
Feb 26 23:44:06 ziff ftpd[21881]: FTP session closed
Feb 26 23:48:52 ziff ftpd[21886]: FTP session closed
Feb 26 23:49:32 ziff ftpd[21887]: FTP session closed
Feb 26 23:53:39 ziff ftpd[21892]: FTP session closed
Feb 26 23:54:06 ziff ftpd[21893]: FTP session closed

[James A. Donovan · Accepted solution]

Based on the time stamps provided, I'd hazard a guess that there were at least 4 cron-type jobs running somewhere that were attempting to establish FTP connections with your server every 10 minutes. You may be able to catch the IP address of the originating servers by using the netstat command.

You may want to look into intrusion detection software like PortSentry or HP's IDS/9000 software.

[Richard Mertz]

Thanks for the netstat idea. DUH!!! It turns out that our network guy has a monitor program he just put in that verifies that ftp is up on my server and it does it every few minutes.

[James A. Donovan]

No, no, thank you for getting me my new hat! :-)