Operating System - Linux
1833365 Members
3262 Online
110052 Solutions
New Discussion

Regarding "Bad line received" message

 
Minoru Asano
Frequent Advisor

Regarding "Bad line received" message

Hello,

At the customer site, the following messages has appeared:

Jul 22 11:26:01 dbplsrv04 xinetd[21145]: Bad line received from identity server at 133.217.201.72: 1021 , 514 : ERROR :root

[ENVIRONMENT]
RHEL 4 AS update1

[QUESTION]
- What does the message mean ?
- Why does the message appear ?
- If there is possibility to any trouble, please let me know

Thank you for support and advice.
Best Regards.
/Minoru.Asano
2 REPLIES 2
Derek Whigham_1
Trusted Contributor

Re: Regarding "Bad line received" message

I would guess that the server on 133.217.201.72 is trying to remsh,rexec to your redhat server.
R-command as disabled by default so xinetd daemon is bonucing it. I have also seen this line when someone is running nessus against a server so be sure that the ip address 133.217.201.72 is a valid customer ip and grep -i /var/log/messages for "nessus". If its there raise the issue with customer.
Divide and Conquer
Minoru Asano
Frequent Advisor

Re: Regarding "Bad line received" message

Hello,
Thank you for reply and suggestion.

The '133.217.201.72' is Oracle RAC machine.
And according to messages I attached, rsh is enable and
there are many rsh session for service.

And I could not find "nessus" in messages file.
So I guess there is another reason for the message.

[ADDITIONAL INFORMATION]
According to the customer, the message has appeared several times in past time.

# cat messages* | grep Bad
Jul 22 116:26:01 dbplsrv04 xinetd[21145]: Bad line received from identity server at 133.217.201.72: 1021 , 514 : ERROR :root
Jul 15 22:08:57 dbplsrv04 xinetd[10229]: Bad line received from identity server at 133.217.201.75: 1023 , 514 : ERROR :root
Jun 26 12:57:33 dbplsrv04 xinetd[21367]: Bad line received from identity server at 133.217.201.72: 1021 , 514 : ERROR :root
Jun 27 01:02:33 dbplsrv04 xinetd[13276]: Bad line received from identity server at 133.217.201.72: 1021 , 514 : ERROR :root

Is there any idea ?

Thank you for advice.
Best Regards.
/Minoru.Asano