A similar thing happened to me last night. It continued until the /tmp file for logwatch took the whole disk and ran out of space. Really fu..ed up my system. I guess it was a denial of service attack.
Irwin On Sunday 23 February 2003 05:39 pm, you wrote: > On Sun, 2003-02-23 at 20:24, Michael Fratoni wrote: > > -----BEGIN PGP SIGNED MESSAGE----- > > Hash: SHA1 > > > > On Sunday 23 February 2003 08:00 pm, Thomas E. Dukes wrote: > > > I was looking at /var/log/messages and saw this. This is just a very > > > short snippet of the log file. What the heck is this about? > > > > > > TIA > > > > > > Feb 23 16:39:07 localhost last message repeated 325960 times > > > Feb 23 16:40:08 localhost last message repeated 319264 times > > > > Something stuck in a serious loop at about 5000 instances/second, I'd > > guess. The important log entries would be from just before this appeared. > > What's the output of > > 'grep "Feb 23 16:3" /var/log/*' ? > > Feb 23 16:23:53 localhost last message repeated 326713 times > Feb 23 16:24:07 localhost last message repeated 70915 times > Feb 23 16:24:07 localhost samba(pam_unix)[1666]: session opened for user > edukes by (uid=0) > Feb 23 16:24:07 localhost portsentry[983]: attackalert: Possible stealth > scan from unknown host to TCP port: 111 (accept failed) > Feb 23 16:24:37 localhost last message repeated 160240 times > Feb 23 16:25:38 localhost last message repeated 316834 times > Feb 23 16:26:24 localhost last message repeated 236839 times > Feb 23 16:26:24 localhost samba(pam_unix)[1666]: session closed for user > edukes > Feb 23 16:26:24 localhost portsentry[983]: attackalert: Possible stealth > scan from unknown host to TCP port: 111 (accept failed) > Feb 23 16:26:54 localhost last message repeated 164387 times > Feb 23 16:27:56 localhost last message repeated 326772 times > > These are the last two entries prior to the beginning of these strange > entries. I installed portsenrty today but samba has been installed for > a while. I un-installed porsentry, but it didn't stop the repeated log > entries. It may be something with samba but I checked previous messages > logs and didn't see these occurrences. > > > - -- > > - -Michael -- redhat-list mailing list unsubscribe mailto:[EMAIL PROTECTED] https://listman.redhat.com/mailman/listinfo/redhat-list
