Strange enrty in syslog (FTPD)

[Khalid A. Al-Tayaran]

Hi all,

I keep getting this enrty in my syslog:

Nov 30 11:19:34 earth ftpd[5076]: FTP session closed
Nov 30 11:29:34 earth ftpd[6017]: FTP session closed
Nov 30 11:39:33 earth ftpd[7000]: FTP session closed
Nov 30 11:49:36 earth ftpd[7886]: FTP session closed
Nov 30 11:59:34 earth ftpd[8823]: FTP session closed
Nov 30 12:09:34 earth ftpd[9742]: FTP session closed
Nov 30 12:19:38 earth ftpd[10678]: FTP session closed
Nov 30 12:29:39 earth ftpd[11614]: FTP session closed
Nov 30 12:39:34 earth ftpd[12534]: FTP session closed
Nov 30 12:49:37 earth ftpd[17251]: FTP session closed

also on amother machine:
Nov 30 11:13:51 venus ftpd[6240]: FTP session closed
Nov 30 11:23:51 venus ftpd[7153]: FTP session closed
Nov 30 11:33:54 venus ftpd[9196]: FTP session closed
Nov 30 11:43:52 venus ftpd[10524]: FTP session closed
Nov 30 11:53:55 venus ftpd[11439]: FTP session closed
Nov 30 12:03:54 venus ftpd[12340]: FTP session closed
Nov 30 12:13:58 venus ftpd[13268]: FTP session closed
Nov 30 12:23:56 venus ftpd[14192]: FTP session closed
Nov 30 12:33:54 venus ftpd[15091]: FTP session closed
Nov 30 12:58:40 venus ftpd[16125]: FTP session closed

It is occuring avery 10 min. ! No body is doing FTP and ps -e | grep ftp shows nothing. No cron jobs also. We did FTP to the systems to update some patches but we are done.

Thanks in advance.......

(HP-UX 11.0)

[Robert-Jan Goossens]

Hello Khalid,

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x35bf6af52b04d5118fef0090279cd0f9,00.html

Hope it helps.

Robert-Jan.

[T G Manikandan]

Also check this doc

http://www2.itrc.hp.com/service/cki/docDisplay.do?docLocale=en_US&docId=200000063201628

get the lsof 64 bit from

ftp://vic.cc.purdue.edu/pub/tools/unix/lsof/

32 bit is available here

http://hpux.cs.utah.edu/hppd/hpux/Sysadmin/lsof-4.64/


Thanks

[Wodisch]

HI,

do you (or somebody else) *monitor* your FTP-service?
Like checking for availability or responsetime?
Then that could be the culprit...
How about using the "-l" option onto your "ftpd" line in your "/etc/inetd.conf"?

FWIW,
Wodisch