Regarding "Bad line received" message

[Minoru Asano]

Hello,

At the customer site, the following messages has appeared:

Jul 22 11:26:01 dbplsrv04 xinetd[21145]: Bad line received from identity server at 133.217.201.72: 1021 , 514 : ERROR :root

[ENVIRONMENT]
RHEL 4 AS update1

[QUESTION]
- What does the message mean ?
- Why does the message appear ?
- If there is possibility to any trouble, please let me know

Thank you for support and advice.
Best Regards.
/Minoru.Asano

[Derek Whigham_1]

I would guess that the server on 133.217.201.72 is trying to remsh,rexec to your redhat server.
R-command as disabled by default so xinetd daemon is bonucing it. I have also seen this line when someone is running nessus against a server so be sure that the ip address 133.217.201.72 is a valid customer ip and grep -i /var/log/messages for "nessus". If its there raise the issue with customer.

[Minoru Asano]

Hello,
Thank you for reply and suggestion.

The '133.217.201.72' is Oracle RAC machine.
And according to messages I attached, rsh is enable and
there are many rsh session for service.

And I could not find "nessus" in messages file.
So I guess there is another reason for the message.

[ADDITIONAL INFORMATION]
According to the customer, the message has appeared several times in past time.

# cat messages* | grep Bad
Jul 22 116:26:01 dbplsrv04 xinetd[21145]: Bad line received from identity server at 133.217.201.72: 1021 , 514 : ERROR :root
Jul 15 22:08:57 dbplsrv04 xinetd[10229]: Bad line received from identity server at 133.217.201.75: 1023 , 514 : ERROR :root
Jun 26 12:57:33 dbplsrv04 xinetd[21367]: Bad line received from identity server at 133.217.201.72: 1021 , 514 : ERROR :root
Jun 27 01:02:33 dbplsrv04 xinetd[13276]: Bad line received from identity server at 133.217.201.72: 1021 , 514 : ERROR :root

Is there any idea ?

Thank you for advice.
Best Regards.
/Minoru.Asano