[sysadmins] Logwatch for berlin.mcs.anl.gov (Linux)

16 Jan 2013


      ################### Logwatch 7.3 (03/24/06) #################### 
        Processing Initiated: Wed Jan 16 04:02:01 2013
        Date Range Processed: yesterday
                              ( 2013-Jan-15 )
                              Period is day.
      Detail Level of Output: 0
              Type of Output: unformatted
           Logfiles for Host: berlin.mcs.anl.gov
  ################################################################## 
 
 --------------------- Automount Begin ------------------------ 

 **Unmatched Entries**
 key "g" not found in map source(s).: 1 Time(s)
 key "jp" not found in map source(s).: 1 Time(s)
 key "mg" not found in map source(s).: 1 Time(s)
 key "jov" not found in map source(s).: 3 Time(s)
 key "m" not found in map source(s).: 1 Time(s)
 
 ---------------------- Automount End ------------------------- 

 
 --------------------- httpd Begin ------------------------ 

 
 Requests with error response codes
    404 Not Found
       /.cobalt: 1 Time(s)
       /ControlManager/default.htm: 1 Time(s)
       /MSWSMTP/Common/Authentication/Logon.aspx: 1 Time(s)
       /UkMa8EOx_dxs.asp: 1 Time(s)
       /UkMa8EOx_dxs.cfm: 1 Time(s)
       /UkMa8EOx_dxs.cgi: 1 Time(s)
       /UkMa8EOx_dxs.html: 1 Time(s)
       /UkMa8EOx_dxs.inc: 1 Time(s)
       /UkMa8EOx_dxs.php: 1 Time(s)
       /UkMa8EOx_dxs.php3: 1 Time(s)
       /UkMa8EOx_dxs.pl: 1 Time(s)
       /UkMa8EOx_dxs.sh: 1 Time(s)
       /UkMa8EOx_dxs.shtml: 1 Time(s)
       /admin.back: 1 Time(s)
       /cgi-bin/UkMa8EOx_dxs.asp: 1 Time(s)
       /cgi-bin/UkMa8EOx_dxs.cfm: 1 Time(s)
       /cgi-bin/UkMa8EOx_dxs.cgi: 1 Time(s)
       /cgi-bin/UkMa8EOx_dxs.html: 1 Time(s)
       /cgi-bin/UkMa8EOx_dxs.inc: 1 Time(s)
       /cgi-bin/UkMa8EOx_dxs.php: 1 Time(s)
       /cgi-bin/UkMa8EOx_dxs.php3: 1 Time(s)
       /cgi-bin/UkMa8EOx_dxs.pl: 1 Time(s)
       /cgi-bin/UkMa8EOx_dxs.sh: 1 Time(s)
       /cgi-bin/UkMa8EOx_dxs.shtml: 1 Time(s)
       /commoncgi/servlet/CCGIServlet?ApHost=PDT_ ... File=logout.htm: 1 Time(s)
       /file: 1 Time(s)
       /intruvert/jsp/admin/Login.jsp: 1 Time(s)
       /login.htm: 1 Time(s)
       /robots.txt: 1 Time(s)
       /scripts/UkMa8EOx_dxs.asp: 1 Time(s)
       /scripts/UkMa8EOx_dxs.cfm: 1 Time(s)
       /scripts/UkMa8EOx_dxs.cgi: 1 Time(s)
       /scripts/UkMa8EOx_dxs.html: 1 Time(s)
       /scripts/UkMa8EOx_dxs.inc: 1 Time(s)
       /scripts/UkMa8EOx_dxs.php: 1 Time(s)
       /scripts/UkMa8EOx_dxs.php3: 1 Time(s)
       /scripts/UkMa8EOx_dxs.pl: 1 Time(s)
       /scripts/UkMa8EOx_dxs.sh: 1 Time(s)
       /scripts/UkMa8EOx_dxs.shtml: 1 Time(s)
       /sdk: 1 Time(s)
       /sitemap.xml: 1 Time(s)
       /wavemaster.internal: 1 Time(s)
    501 Not Implemented
       /: 1 Time(s)
 
 ---------------------- httpd End ------------------------- 

 
 --------------------- pam_unix Begin ------------------------ 

 sshd:
    Authentication Failures:
       unknown (anlscan8.cspo.anl.gov): 2 Time(s)
    Invalid Users:
       Unknown Account: 2 Time(s)
 
 su:
    Sessions Opened:
       jbischof(uid=0) -> mgrastprod: 12 Time(s)
 
 sudo:
    Authentication Failures:
       jbischof(0) -> jbischof: 8 Time(s)
       dsouza(0) -> dsouza: 1 Time(s)
       tharriso(0) -> tharriso: 1 Time(s)
    Unknown Entries:
       auth could not identify password for [jbischof]: 1 Time(s)
       conversation failed: 1 Time(s)
 
 
 ---------------------- pam_unix End ------------------------- 

 
 --------------------- postfix Begin ------------------------ 

 
 
 10461 bytes transferred
 10 messages sent
 10 messages removed from queue
 
 Hostname validation errors: 1 Message(s), 143 Time(s)
 
 Process exited:
    Exit status 1:
       /usr/libexec/postfix/pickup: 34 Time(s)
 
 
 Unrecognized warning:
     /usr/libexec/postfix/pickup: bad command startup -- throttling : 34 Time(s)
 
 
 **Unmatched Entries**
 
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 fatal: unable to use my own hostname
 
 ---------------------- postfix End ------------------------- 

 
 --------------------- SSHD Begin ------------------------ 

 
 Illegal users from:
    146.137.70.8 (anlscan8.cspo.anl.gov): 2 times
 
 Postponed authentication:
    jared/publickey:
       140.221.9.205: 2 Time(s)
    jbischof/publickey:
       140.221.9.205: 5 Time(s)
    root/publickey:
       140.221.76.5: 3 Time(s)
 
 Users logging in through sshd:
    dsouza:
       140.221.10.82 (dsouza.mcs.anl.gov): 1 time
    jared:
       140.221.9.205 (login3.mcs.anl.gov): 2 times
    jbischof:
       140.221.9.205 (login3.mcs.anl.gov): 5 times
       130.202.135.163 (mcswl163.mcs.anl.gov): 2 times
       140.221.11.19 (jbischof.mcs.anl.gov): 1 time
    root:
       140.221.76.5 (berlin.mcs.anl.gov): 3 times
       192.5.200.126 (warehouse13.mcs.anl.gov): 1 time
    tharriso:
       130.202.135.156 (mcswl156.mcs.anl.gov): 1 time
 
 
 Received disconnect:
    11: disconnected by user : 9 Time(s)
 
 **Unmatched Entries**
 userauth_hostbased: unsupported public key algorithm: ecdsa-sha2-nistp256 : 7 time(s)
 pam_succeed_if(sshd:auth): error retrieving information about user Cisco : 1 time(s)
 pam_succeed_if(sshd:auth): error retrieving information about user cisco : 1 time(s)
 
 ---------------------- SSHD End ------------------------- 

 
 --------------------- Sudo (secure-log) Begin ------------------------ 

 ==============================================================================
 dsouza => root
 ------------------------------------------------------------------------------
 /bin/bash
 ==============================================================================
 jbischof => root
 ------------------------------------------------------------------------------
 /bin/zsh -c ssh dunkirk
 /bin/zsh
 /bin/zsh -c ssh dunkirk\:ls
 /bin/zsh -c ssh dunkirk ls
 /bin/zsh -c ssh berlin ls
 /bin/zsh -c ssh root\@berlin ls
 /bin/zsh -c ssh root\@dunkirk ls
 /bin/zsh -c ssh root\@dunkirk\.mcs\.anl\.gov \/homes\/jbischof\/MCP\/MCP \
     upload stop
 /bin/zsh -c ssh root\@berlin\.mcs\.anl\.gov \/homes\/jbischof\/MCP\/MCP \
     upload start
 /bin/zsh
 /bin/zsh
 /bin/zsh
 /bin/zsh
 /bin/zsh
 /bin/zsh
 /bin/zsh
 ==============================================================================
 tharriso => root
 ------------------------------------------------------------------------------
 /bin/zsh
 
 ---------------------- Sudo (secure-log) End ------------------------- 

 
 --------------------- Disk Space Begin ------------------------ 

 Filesystem            Size  Used Avail Use% Mounted on
 /dev/mapper/Vol0-LV00
                        15G  9.0G  4.5G  67% /
 /dev/md0               99M   39M   55M  42% /boot
 /dev/mapper/Vol0-local
                       1.8T  138G  1.7T   8% /local
 
 
 ---------------------- Disk Space End ------------------------- 

 
 ###################### Logwatch End #########################

[sysadmins] Logwatch for berlin.mcs.anl.gov (Linux)

logwatch＠mcs.anl.gov