Hi,

Every day morning am checking the mail for root user in our server. But today mail shows too much **Unmatched Entries** 'pam_succeed_if(sshd:auth): error retrieving information about user', Normaly 50 to 80 lines appears for **Unmatched Entries** but today 2662 line appears, Is it any issue in my server.

Could anyone clarify this.

Listed below the messages for detailed information. Please find the attachment file tm.txt for detailed analysis.

**Unmatched Entries**
pam_succeed_if(sshd:auth): error retrieving information about user florian : 1 time(s)
pam_succeed_if(sshd:auth): error retrieving information about user elisabeth : 1 time(s)
pam_succeed_if(sshd:auth): error retrieving information about user montiel : 1 time(s)
pam_succeed_if(sshd:auth): error retrieving information about user zorro : 1 time(s)
pam_succeed_if(sshd:auth): error retrieving information about user vasconcelos : 1 time(s)
pam_succeed_if(sshd:auth): error retrieving information about user calvin : 1 time(s)
pam_succeed_if(sshd:auth): error retrieving information about user pam : 1 time(s)
pam_succeed_if(sshd:auth): error retrieving information about user pay : 1 time(s)
pam_succeed_if(sshd:auth): error retrieving information about user handsome : 1 time(s)
pam_succeed_if(sshd:auth): error retrieving information about user pizza : 1 time(s)
pam_succeed_if(sshd:auth): error retrieving information about user rachel : 2 time(s)
.....
pam_succeed_if(sshd:auth): error retrieving information about user lucas : 2 time(s)
pam_succeed_if(sshd:auth): error retrieving information about user darren : 1 time(s)
pam_succeed_if(sshd:auth): error retrieving information about user portmap : 1 time(s)


Thanks & Regards
Durai

Are they valid names on your system?
If not, I suspect its an automatic break-in attempt that tries a long list of possible usernames.
It may be the case anyway... can you get the src IP address(es) ?

No, they are not valid names in my server.