Re: [cobalt-users] What does this mean?

["H.P. Stroebel" <hpstr@xxxxxxxxxxxxx>]

Howard schrieb:

> It does appear that these lines happen every 15 mins. Is that normal?

the active monitor checks the running services every 15 minutes; normal

> Not sure what this also means:
> Jun 19 20:36:58 cia in.qpopper[12080]: apop "email"

someone connected to your pop3 server using apop (pop3 protocol, but /w
password encryption); in /var/log/secure you should see his ip adress

> Unusual System Events
> =-=-=-=-=-=-=-=-=-=-=
> Jun 19 20:15:01 cia proftpd[11643]: www.hostservice.com
> (localhost[127.0.0.1]) - FTP session closed.

active monitor on your box (127.0.0.1) connects to ftp server to see if
it`s running, then closes the connection

> Jun 19 20:15:05 cia in.qpopper[11666]: Active_Monitor_69@localhost:
> -ERR POP EOF received

active monitor on your box (localhost = 127.0.0.1) connects to pop
server to see if it`s running, then closes the connection

> Jun 19 20:15:05 cia telnetd[11668]: ttloop: read: Broken pipe

seems to be : active monitor on your box connects to telnet server to
see if it`s running, then closes the connection
check /var/log/secure to see from which ip the connect came from; if
it`s 127.0.0.1, it`s your box

i don`t know where the broken pipe comes from, however. 


logcheck interprets this as unusual system events, because it doesn`t
know the messages; and by default it mails any unknown message for
security reasons (so YOU decide, not your server)

you can "educate" logcheck by adding entries (regular expressions)  the
two *.ignore files in your config directory


cu
-- 

H. P.  Ströbel

PGP Digital Fingerprint :
58E0 6ECB 620A A689 E206 
BCA8 300F BC45 6EEC F7C3

Yes, I do. But not Yahoo.