Re: /var/log growing rapidly

[Ron Johnson <ron.l.johnson@cox.net>]

On 11/18/08 06:03, Paul Cartwright wrote:
> On Tue November 18 2008, Ron Johnson wrote:
> > First, "tail -f /var/log/messages" to see exactly what all the new
> > log entries are.  That should point you towards the offender.
>
> I rebooted, and it stopped doing it. I went back into messages.0 , which was 
> the LARGE file, and found lots, and lots, and lots of these lines:
> Nov 17 07:53:24 paulandcilla kernel: [68956.446825] Unknown InputIN=lo OUT= 
> MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.0.0.1 DST=127.0.0.1 
> LEN=972 TOS=0x00 PREC=0x00 TTL=64 ID=1103 DF PROTO=UDP SPT=53543 DPT=53543 
> LEN=952 
> Nov 17 07:53:24 paulandcilla kernel: [68956.446825] Unknown OutputIN= OUT=lo 
> SRC=127.0.0.1 DST=127.0.0.1 LEN=788 TOS=0x00 PREC=0x00 TTL=64 ID=1104 DF 
> PROTO=UDP SPT=53543 DPT=53543 LEN=768 
> Nov 17 07:53:24 paulandcilla kernel: [68956.446825] Unknown InputIN=lo OUT= 
> MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.0.0.1 DST=127.0.0.1 
> LEN=788 TOS=0x00 PREC=0x00 TTL=64 ID=1104 DF PROTO=UDP SPT=53543 DPT=53543 
> LEN=768 

Looks like iptables logging IP packets to the loop interface on port 
53543.  Very weird.

> I did a CTRL-ALT-F9 earlier that day, thinking I was switching to my OTHER 
> user logged in, and those lines were on the screen, instead of the gdm login 
> screen. Then did a CTRL-ALT-F7 to get back to where I was, and was back to my 
> logged in account. Looks like gdm didn't like me going to that screen without 
> starting a new login session through the menus?


--
Ron Johnson, Jr.
Jefferson LA  USA

If you don't agree with me, you are worse than Hitler!!!