I have a redhat 9 machine running ssh, samba, apache and vsftpd. I checked my /var/log/secure file, couldn't understand the following line:

Nov 20 10:02:24 dragon xinetd[928]: START: sgi_fam pid=15536 from=<no address>

It appears several times, of course with different pid. Is it a security problem?

Thanks

Nov 20 10:02:24 dragon xinetd[928]: START: sgi_fam pid=15536 from=<no address>
It roughly translates to: "the process named: xinetd (with PID: 928) (issued the command: START) (for xinetd service entry: sgi_fam, running with PID 15536, where the (requesting) address is unknown)"
You probably have a second line in the logs which you didn't post?


Is it a security problem?
To answer this question you should:
I. Check out what the FAM process does and if you need it,
II. Check the superserver's configuration (Xinetd in this case) for the FAM service configuration (/etc/xinetd.d/fam). It is by default restricted to only accept connections from "localhost" aka IP address 127.0.0.1,
III. Check out your /etc/hosts.deny for a line called "ALL: ALL". In cases where you do not need/want to provide services to world, this will be the only uncommented line,
IV. Check out your /etc/hosts.allow, and add the line "sgi_fam: 127.0.0.1" to explicitly allow localhost to access the FAM service,
* If that doesn't fix the problem possible workarounds are to add a "NOLIBWRAP" flag in /etc/xinetd.d/fam and change "local_only" to "true" in /etc/fam.conf.

Thanks a lot. BTW, what does FAM service do normally?

Thanks a lot.
Np.

BTW, what does FAM service do normally?
Here's #1 I asked you to do: Check out what the FAM process does and if you need it. Don't get accused of being "lazy" while the material is right in front of you! (besides *you* should know what's running on *your* box) so please read the manual/man/info page/package description.

Thanks again. I checked the time when this happened. It seems that every time turn on the monitor and bring up the login window it takes one record. I know xinetd is the login daemon, but don't know what FAM does here.
Where can I find what FAM does for this?

How about man fam or using your package manager to see details about the fam package?

Thanks, buddy. I found I have sgi_fam service running with xinetd. Everytime I log in, I got that message.
Thanks for your help.