On 21 Jan 2010, at 7:21 PM, Mark Andrews wrote:
> In message <6b845b73-065f-4e8b-afa5-408ecdbe7...@govnet.state.vt.us>, David
> Kre
> indler writes:
>> We have BIND 9.6.1-P3 running on several AIX 5.3 servers. On one of them, nam
>> ed is filling /var/adm/wtmp with numerous entries like the following.
>
> This is not named (the program). It may be "su" or some other process that
> is logging changes in uid. Or it could be someone login in as the user
> "named".
>
> Mark
>
>> user pts/1 pts/1 7 1327240 0000 0000 1264089183 host-NN.domain Thu Jan 21 10:
>> 53:03 EST 2010
>> named 8 2572472 0000 0000 1264089217 Thu Jan 21 10:
>> 53:37 EST 2010
>> named 8 2572472 0000 0000 1264089217 Thu Jan 21 10:
>> 53:37 EST 2010
>> named 8 2572472 0000 0000 1264089277 Thu Jan 21 10:
>> 54:37 EST 2010
> --
> Mark Andrews, ISC
> 1 Seymour St., Dundas Valley, NSW 2117, Australia
> PHONE: +61 2 9871 4742 INTERNET: ma...@isc.org
There is no user 'named' on this system.
# su - named
3004-500 User "named" does not exist.
It appears to be the process 'named', but we do not understand what is causing
it to be logged in wtmp constantly.
_______________________________________________
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
