|
Home > Archive > Unix administration > January 2005 > unknown error in messages file - solaris 2.8 sparc
You are viewing an archived Text-only version of the thread.
To view this thread in it's original format and/or if you want to reply to
this thread please [click here]
| Author |
unknown error in messages file - solaris 2.8 sparc
|
|
| frozensalad 2005-01-11, 7:50 am |
| Here are the only entries from yesterday's message log on our Sun Fire
V880:
Jan 10 13:10:45 gandalf rsh[8837]: [ID 365563 daemon.error] can't get
stderr port: Cannot assign requested address
Jan 10 13:11:20 gandalf rsh[15280]: [ID 365563 daemon.error] can't get
stderr port: Cannot assign requested address
Jan 10 13:11:28 gandalf rsh[17533]: [ID 365563 daemon.error] can't get
stderr port: Cannot assign requested address
Jan 10 13:11:28 gandalf rsh[17534]: [ID 365563 daemon.error] can't get
stderr port: Cannot assign requested address
Jan 10 13:12:09 gandalf rsh[26435]: [ID 365563 daemon.error] can't get
stderr port: Cannot assign requested address
Jan 10 13:12:11 gandalf rsh[26936]: [ID 365563 daemon.error] can't get
stderr port: Cannot assign requested address
Jan 10 13:12:12 gandalf rsh[27266]: [ID 365563 daemon.error] can't get
stderr port: Cannot assign requested address
Jan 10 13:12:24 gandalf rsh[29322]: [ID 365563 daemon.error] can't get
stderr port: Cannot assign requested address
Jan 10 13:12:36 gandalf rsh[2021]: [ID 365563 daemon.error] can't get
stderr port: Cannot assign requested address
I cannot find any other reference to this particular message on google
groups. As far as I can tell we have no processes that try to perform
an rsh at that time. No one but myself and one other has access to
this machine, I am now worried that a password has been compromised.
Question 1: how do I tell if the rsh was initiated from this machine or
is an incoming rsh request? Does gandalf rsh mean it was initiated from
gandalf (the host where this messages file comes from)? If so that's
weird.
Question 2: Is there any way to output any more info from rsh, i.e. the
terminal where the command was run from /process name rather than just
pid which now obviously doesn't exist.
Thanks in advance,
jon
Any personal replies to jondottheo@navigantconsulting.nodamnspam.co.uk
dot becomes . remove antispam bit
| |
| Bryan Brock 2005-01-12, 5:55 pm |
| > Question 1: how do I tell if the rsh was initiated from this machine
or
> is an incoming rsh request? Does gandalf rsh mean it was initiated
from
> gandalf (the host where this messages file comes from)? If so that's
> weird.
I don't know, but I googled for this:
stderr port: Cannot assign requested address
and found this link that you might find useful:
http://supportforum.sun.com/network...&rid=0#msg_2244
> Question 2: Is there any way to output any more info from rsh, i.e.
the
> terminal where the command was run from /process name rather than
just
> pid which now obviously doesn't exist.
You might take a look at the man pages for acctsh and acct. They will
tell you how to enable process accounting.
|
|
|
|
|