On Mon, 2006-04-03 at 22:51 -0700, Knute Johnson wrote: > I'm getting some interesting things in my secure log. sshd appears > to be reporting things in two times, local and UTC. Anybody else > notice this and know how to stop it? FC5. > > Thanks, > > knute... > > Apr 3 08:01:52 homeonthehill sshd[5220]: Invalid user admin from > 218.27.100.24 > > Apr 3 08:01:52 homeonthehill sshd[5220]: > pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 > tty=ssh ruser= rhost=218.27.100.24 > > Apr 3 08:01:54 homeonthehill sshd[5220]: > Failed password for invalid user admin from 218.27.100.24 port 34533 > ssh2 > > Apr 3 15:01:54 homeonthehill sshd[5221]: Failed password for invalid > user admin from 218.27.100.24 port 34533 ssh2 > > Apr 3 15:01:54 homeonthehill sshd[5221]: Received disconnect from > 218.27.100.24: 11: Bye Bye > > Apr 3 08:01:59 homeonthehill sshd[5222]: Invalid user admin from > 218.27.100.24 > > Apr 3 08:01:59 homeonthehill sshd[5222]: pam_unix(sshd:auth): > authentication failure; logname= uid=0 euid=0 tty=ssh ruser= > rhost=218.27.100.24 > > Apr 3 08:02:00 homeonthehill sshd[5222]: Failed > password for invalid user admin from 218.27.100.24 port 35291 ssh2 > > Apr 3 15:02:00 homeonthehill sshd[5223]: Failed password for invalid > user admin from 218.27.100.24 port 35291 ssh2 > > Apr 3 15:02:01 homeonthehill sshd[5223]: Received disconnect from > 218.27.100.24: 11: Bye Bye > > -- > Knute Johnson > Molon Labe... > > > I am also seeing this in /var/log/secure. The messages with the UTC time Tag appear to be duplicates of messages with a local time tag. The message with the UTC tag seems to come from the child (pid+1) of the process that logged the identical message with the local tag. No clue on a fix. Bob...
