Answer/Solution: IMonitor is monitoring the SMTP service. As you can see it happens every minute, the interval you have set in IMonitor. IMonitor tries to connect to the SMTP (or other service) each time it polls the services (from the localhost address, 127.0.0.1). If the service is recording to the log, that connection is then entered in the log. The port number is incremented for each connection. Since this sequence shows non-consecutive numbers, there are other connections to the SMTP service between the connections caused by IMonitor (probably sending and receiving of mail).
The number after SMTPD (such as, 159F0140) is a sequence number IMail assigns to each new process (connection). This allows you to track all the operations of that process. Document #: Revision Date: IM-19981110-DD09 09/16/02 Return To KnowledgeBase Search Page -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gavin Lawrie Sent: Friday, December 05, 2003 12:58 PM To: [EMAIL PROTECTED] Subject: [IMail Forum] Help interpreting log file entry... Hi Hopefully a simple question. Was looking at the syslog file for some other reason, and noticed loads of entries like this... 12:05 16:43 SMTPD(017500E0) [212.135.236.109] connect 212.135.236.109 port 4801 12:05 16:44 SMTPD(017600E0) [212.135.236.109] connect 212.135.236.109 port 4807 12:05 16:45 SMTPD(017700E0) [212.135.236.109] connect 212.135.236.109 port 4813 Wondered what the server is doing - it looks like it is port scanning - and whether it should be doing so? Regards Gavin Lawrie To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
