Re: Strange entry in syslog
Mailing List wrote:
>
> Interestingly, I've been seeing that on many servers we operate.
> We run unstable though...
>
> Sometimes we get hundreds of those messages, with exactly the same problems
> you experienced.
> We always thought some script-kiddie was trying to find some buffer overflow
> shxt on us. Is it?
Well, I checked thru auth.log - nobody was sitting on my system at the
moment.
It wasn't cron either.
The entry mentioned in my first mail, was also logged to messages.
Earlier (in syslog) I noticed:
Jan 26 01:24:01 myhost ippl: sunrpc connection attempt from
208.184.140.109.vovida.com [208.184.140.109]
It happened twice.
I don't know if this connection was allowed, but maybe this caused the
entry.
What do you think ?
--
Regards,
Marek L. Kozak
Reply to: