Why the messages to syslog.log? ---> lost connection to localhost [0.0.0.0]

[Angie_1]

I am getting a lot of the following types of messages on my sendmail/ftp server in the syslog.log file. I don't know what they are and possibly one of you do. Anything I need to be concerned about?

Angie
=============================================
Feb 17 13:27:18 ftpd[15457]: lost connection to localhost [0.0.0.0]
Feb 17 13:27:18 ftpd[15457]: FTP session closed
Feb 17 13:27:32 ftpd[15463]: connection from localhost [0.0.0.0]
Feb 17 13:27:32 ftpd[15463]: lost connection to localhost [0.0.0.0]
Feb 17 13:27:32 ftpd[15463]: FTP session closed
Feb 17 13:29:30 ftpd[15508]: connection from localhost [0.0.0.0]
Feb 17 13:29:30 ftpd[15508]: lost connection to localhost [0.0.0.0]
Feb 17 13:29:30 ftpd[15508]: FTP session closed
Feb 17 13:29:45 ftpd[15518]: connection from localhost [0.0.0.0]
Feb 17 13:29:45 ftpd[15518]: lost connection to localhost [0.0.0.0]
Feb 17 13:29:45 ftpd[15518]: FTP session closed
Feb 17 13:31:43 ftpd[15611]: connection from localhost [0.0.0.0]
Feb 17 13:31:43 ftpd[15611]: lost connection to localhost [0.0.0.0]
Feb 17 13:31:43 ftpd[15611]: FTP session closed
Feb 17 13:31:55 ftpd[15624]: connection from localhost [0.0.0.0]
Feb 17 13:31:55 ftpd[15624]: lost connection to localhost [0.0.0.0]
Feb 17 13:31:55 ftpd[15624]: FTP session closed
Feb 17 13:33:55 ftpd[15694]: connection from localhost [0.0.0.0]
Feb 17 13:33:55 ftpd[15694]: lost connection to localhost [0.0.0.0]
Feb 17 13:33:55 ftpd[15694]: FTP session closed
Feb 17 13:34:05 ftpd[15697]: connection from localhost [0.0.0.0]

[RAC_1]

Do you have localhost entry in /etc/hosts??

[Gordon Morrison]

You should have a line like this in /ets/hosts

127.0.0.1 localhost loopback

If you don't, that's your problem.

[Peter Godron]

Angie,
without locahost being defined the system will not be able to translate the system name localhost using /etc/hosts.
It tries by substituting with 0.0.0.0 which fails. Add entry into /etc/hosts.
Regards

[Angie_1]

Yes, there is an entry in /etc/hosts for localhost loopback. Still the messages are appearing in /var/adm/syslog/syslog.log

Angie

127.0.0.1 localhost loopback

Feb 18 07:24:04 ftpd[20058]: connection from localhost [0.0.0.0]
Feb 18 07:24:04 ftpd[20058]: lost connection to localhost [0.0.0.0]
Feb 18 07:24:04 ftpd[20058]: FTP session closed
Feb 18 07:24:32 ftpd[20133]: connection from localhost [0.0.0.0]
Feb 18 07:24:32 ftpd[20133]: lost connection to localhost [0.0.0.0]
Feb 18 07:24:32 ftpd[20133]: FTP session closed
Feb 18 07:26:17 ftpd[20321]: connection from localhost [0.0.0.0]
Feb 18 07:26:17 ftpd[20321]: lost connection to localhost [0.0.0.0]
Feb 18 07:26:17 ftpd[20321]: FTP session closed

[Gary L. Paveza, Jr.]

How is your /etc/nsswitch.conf file setup for hosts?

If you only do DNS resolution, and your DNS server does not have localhost, that may be the issue.

[Peter Godron]

Angie,
you can quickly check whether localhost is being correctly translated with:
ping localhost
Regards

[Angie_1]

What is in nsswitch.conf is the following:

hosts: dns [NOTFOUND=continue UNAVAIL=continue TRYAGAIN=continue] files

I did ping localhost and it resolved just fine.

Angie

[RAC_1]

nsquery hosts localhost
and post the output.

[harry d brown jr]

can you post the output of

(1) cat /etc/resolv.conf

(2) grep -i ftp /etc/inetd.conf

(3) nslookup localhost

(4) nslookup 0.0.0.0

(5) what `which named`

live free or die
harry d brown jr

[Angie_1]

Here are the results... Thanks - Angie

$ more resolv.conf
domain .com
nameserver #This machine which is
nameserver #This is
$
$ hostname

===================
$ grep -i ftp /etc/inetd.conf
ftp stream tcp nowait root /usr/lbin/ftpd ftpd -lda

$ ==================================
$ nslookup localhost
Name Server: ..com
Address:

Trying DNS
Name: localhost..com
Address: 127.0.0.1

$ ===============================
$ nslookup 0.0.0.0
Name Server: ..com
Address:

Trying DNS
looking up FILES
*** No hostname information is available for "0.0.0.0"
$
==================================
$ what `which named`
can't open no (26)
named:
Copyright (c) 1986, 1989, 1990 The Regents of the University of California.
named 8.1.2 Thu Feb 15 05:53:45 GMT 2001 PHNE_23275
can't open in (26)

[RAC_1]

You need to change your nsswitch.conf file.

hosts: dns [NOTFOUND=continue UNAVAIL=continue TRYAGAIN=continue] files

to

hosts: files [NOTFOUND=continue UNAVAIL=continue TRYAGAIN=continue] dns

[harry d brown jr]

when was the last t9ime this machine was patched?

also, it doesn't help when you try to mask hostnames and IP's making lines like this to look bad:

>>>$ nslookup localhost
>>>Name Server: ..com
>>>Address:
>>>
>>>Trying DNS
>>>Name: localhost..com
>>>Address: 127.0.0.1

so does "nslookup localhost" really return
"Name Server: ..com"
like
Name Server: sysadmin.sysadmin.com
???

or "Name: localhost..com"
like Name: localhost.sysadmin.com

???

also, can you post the output of "netstat -rn" and if the IP's are only internal, there's no need to mask them!

live free or die
harry d brown jr