|
North American Network Operators Group
Date Prev | Date Next |
Date Index |
Thread Index |
Author Index |
Historical
Future timestamps in /var/log/secure
- From: Wade Peacock
- Date: Fri Feb 26 13:20:39 2010
I found a while ago in /var/log/secure that for an invalid ssh login attempt the ssh Bye Bye line is in the
future. I have searched the web and can not find a reason for the future time in the log.
Here is a sample. Repeated lines are shown once in first part
grep "210.212.145.152" /var/log/secure
Feb 26 09:43:13 mx sshd[18117]: Did not receive identification string from 210.212.145.152
Feb 26 09:50:33 mx sshd[19100]: Invalid user 0admin from 210.212.145.152
Feb 26 09:50:36 mx sshd[19106]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh
ruser= rhost=210.212.145.152
Feb 26 09:50:38 mx sshd[19102]: Failed password for invalid user 0admin from 210.212.145.152 port 39902 ssh2
Feb 26 17:50:38 mx sshd[19113]: Received disconnect from 210.212.145.152: 11: Bye Bye
grep -A1 -B1 "sshd\[19118\]: Received disconnect from 210.212.145.152: 11: Bye Bye" /var/log/secure
Feb 26 17:50:38 mx sshd[19115]: Received disconnect from 210.212.145.152: 11: Bye Bye
Feb 26 17:50:38 mx sshd[19118]: Received disconnect from 210.212.145.152: 11: Bye Bye
Feb 26 09:52:39 mx proftpd[17297]: mx.example.com (208.xxx.xxx.xxx[208.xxx.xxx.xxx]) - FTP no transfer
timeout, disconnected
Can anyone explain the future time stamp on the Bye Bye lines?
OS is Centos 5.4, FYI
--
Wade Peacock
Network Administrator
Sun Country Cablevision Ltd
Sunwave Internet Department
Tel: (250) 832-9711 or (250) 546-9667
Web: http://www.sunwave.net
Email: wade.peacock@sunwave.net
Support Email: support@sunwave.net
|
|
|
