Hi all,

I have a question. I've been just given the job of managing our mail server running RHE3 with Qmail and squarrelmail. Resently I've been recieving entries into my logs that look like this:


**Unmatched Entries**
xinetd[2154]: START: sgi_fam pid=9160 from=<no address>
xinetd[2154]: START: sgi_fam pid=10234 from=<no address>
xinetd[2154]: START: sgi_fam pid=11281 from=<no address>
xinetd[2154]: START: sgi_fam pid=12315 from=<no address>
xinetd[2154]: START: sgi_fam pid=13213 from=<no address>
xinetd[2154]: START: sgi_fam pid=14287 from=<no address>
xinetd[2154]: START: sgi_fam pid=15195 from=<no address>
xinetd[2154]: START: sgi_fam pid=16411 from=<no address>
xinetd[2154]: START: sgi_fam pid=17533 from=<no address>
xinetd[2154]: START: sgi_fam pid=18420 from=<no address>
xinetd[2154]: START: sgi_fam pid=18449 from=<no address>
xinetd[2154]: START: sgi_fam pid=18492 from=<no address>
xinetd[2154]: START: sgi_fam pid=18520 from=<no address>
xinetd[2154]: START: sgi_fam pid=18551 from=<no address>
xinetd[2154]: START: sgi_fam pid=18608 from=<no address>
xinetd[2154]: START: sgi_fam pid=19625 from=<no address>
xinetd[2154]: START: sgi_fam pid=20944 from=<no address>
xinetd[2154]: START: sgi_fam pid=22467 from=<no address>
xinetd[2154]: START: sgi_fam pid=23762 from=<no address>
xinetd[2154]: START: sgi_fam pid=24716 from=<no address>
xinetd[2154]: START: sgi_fam pid=25628 from=<no address>
xinetd[2154]: START: sgi_fam pid=27111 from=<no address>


I get several hundred in my logs everyday. Is this someone trying to hack my server or am I looking at something else. Thanks for the help.

i think you are looking at something else...

maybe you could disable your fam daemon (if you don't need it)??

http://oss.sgi.com/projects/fam/index.html


from what little i've googled it seems you could also try adding a "flags = NOLIBWRAP" option to your /etc/xinet.d/sgi_fam file:

https://bugzilla.redhat.com/bugzilla....cgi?id=119918

for more info about this: http://www.google.com/linux?&q=flags+nolibwrap

but i might be trippin', though... maybe the nolibwrap thing isn't what you want... either way, i'm sure there's a way to configure either xinetd or fam so as that your logs don't get cluttered... please post the solution if you find it so that others with the same issue can benefit from it...

just my ...

not sure if i do need it but I'm trying the "flags = NOLIBWRAP" and will see what happens in the morning when I get my logs. I will let you know.