On Mon, 2003-02-24 at 12:39, Thomas E. Dukes wrote: > > What's the output of > > 'grep "Feb 23 16:3" /var/log/*' ? > > Feb 23 16:23:53 localhost last message repeated 326713 times > Feb 23 16:24:07 localhost last message repeated 70915 times > Feb 23 16:24:07 localhost samba(pam_unix)[1666]: session opened for user > edukes by (uid=0) > Feb 23 16:24:07 localhost portsentry[983]: attackalert: Possible stealth > scan from unknown host to TCP port: 111 (accept failed) > Feb 23 16:24:37 localhost last message repeated 160240 times > Feb 23 16:25:38 localhost last message repeated 316834 times > Feb 23 16:26:24 localhost last message repeated 236839 times > Feb 23 16:26:24 localhost samba(pam_unix)[1666]: session closed for user > edukes > Feb 23 16:26:24 localhost portsentry[983]: attackalert: Possible stealth > scan from unknown host to TCP port: 111 (accept failed) > Feb 23 16:26:54 localhost last message repeated 164387 times > Feb 23 16:27:56 localhost last message repeated 326772 times > > These are the last two entries prior to the beginning of these strange > entries. I installed portsenrty today but samba has been installed for > a while. I un-installed porsentry, but it didn't stop the repeated log > entries. It may be something with samba but I checked previous messages > logs and didn't see these occurrences. > > > > - -- > > - -Michael
I wonder if you blow out the log file and restart the system - it might be easier to track the problem...hate to have huge logfiles with mystical messages pertaining to unknown errors... -- Stephen Kuhn <[EMAIL PROTECTED]> Kuhn Media Australia -- Mon, 24 Feb 2003 13:00:00 +1100 1:00pm up 5 days, 1:43, 7 users, load average: 0.25, 0.53, 0.36 ------------------------------------------------------------------ | __ __ | kuhn media australia | | / ,, /| |'-. | http://kma.0catch.com | | .\__/ || | | |=================================| | _ / `._ \|_|_.-' | stephen kuhn | | | / \__.`=._) (_ | email: [EMAIL PROTECTED] | | |/ ._/ |"""""""""| | email: [EMAIL PROTECTED] | | |'. `\ | | | icq: 5483808 | | ;"""/ / | | | | | smk ) /_/| |.-------.| | mobile: 0410-728-389 | | ' `-`' " " | Berkeley, New South Wales, AU | ------------------------------------------------------------------ linux user:267497 * RH 8.0 * PC/Mac/Linux/Networking/Consulting ------------------------------------------------------------------ Scully: What was that?? Mulder: I don't know - but it ain't no duck. "The X-Files: Quagmire" -- redhat-list mailing list unsubscribe mailto:[EMAIL PROTECTED] https://listman.redhat.com/mailman/listinfo/redhat-list
