The UNIX and Linux Forums  
Hello and Welcome from United States to the UNIX and Linux Forums! Thank You for Visiting and Joining Our Global Community.

Go Back   The UNIX and Linux Forums > Operating Systems > SUN Solaris
/var/adm/messages /var/adm/messages
.
google unix.com

Forums Register Forum RulesLinksAlbums FAQ Members List Calendar Search Today's Posts Mark Forums Read


SUN Solaris The Solaris Operating System, usually known simply as Solaris, is a free Unix-based operating system introduced by Sun Microsystems .

More UNIX and Linux Forum Topics You Might Find Helpful
Thread Thread Starter Forum Replies Last Post
error messages in /var/adm/messages nitinp82 UNIX for Advanced & Expert Users 1 04-17-2007 10:17 AM
/var/adm/messages FrankC UNIX for Dummies Questions & Answers 3 09-18-2006 11:25 AM
/var/adm/messages soliberus SUN Solaris 2 06-29-2005 10:18 AM
/var/adm/messages- Help finster SUN Solaris 1 12-11-2003 09:03 AM
Messages in /var/adm owls UNIX for Dummies Questions & Answers 1 09-26-2001 12:16 PM

Closed Thread
English Japanese Spanish French German Portuguese Italian Dutch Swedish Russian Norwegian Hungarian Hebrew Danish Powered by Powered by Google
 
LinkBack Thread Tools Search this Thread Rate Thread Display Modes
  #1 (permalink)  
Old 12-16-2003
finster's Avatar
finster finster is offline
Registered User
  
 

Join Date: Nov 2002
Location: USA
Posts: 75
/var/adm/messages
Check message file and result posted below.
Can anyone tell me what this is a sign of, what does it mean?

Code:
server1% more messages.0
Dec 02 09:35:06 server1 bsd-gw[25101]: [ID 315218 lpr.error] Inval
id protocol request (65): AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA^\\2
00õw\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220
\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220
\220\220\220\220\220\220\220\220\220\220\220\220ë^C]ë^Eèøÿÿÿ\203Å^U\220\220\220\
213Å3Éf¹^P^CP\2000\227@âú~\216\225\227\227Í^\M^T|\220ýhÄó6\227\227\227\227Çó^^²\
227\227\227\227¤L,\227\227wà^?K\226\227\227^Vl\227\227h(\230^TY\226\227\227^VT\2
27\227\226\227ñ^V¬ÚÍâp¤W^\Ô«\224Tñ^V¯ÇÒâN^TWï^\§\224d^\Ù\233\224\^V®ÜÒÅÙâR^Vî\22
3ÒÛ¤¥â+¤h^\Ñ·\224T^\\\224\237^V®ÐòãÇâ\236^Vî\223åøôÖã\221Ð^TW\223|r\224h\224l^\Á
³\224m¤Eñ^\\200^\m^\Ñ\207ß\224o¤^^\X\224^\224^\224Ù\213\224\^\®\224l~þ\226\227\2
27É^P`^\@¤W`G^\_e8^^¥^ZÕ\237ÅÇÄh\205Í^^Õ\223^Zå\202ÅÁhÅ\223ͤW;^SWân¤^^]\231^S^ã
\236ÅÁÄh\205Í<u^?ÑÅÁhÅ\223Í^\O¤W;^SWân¤^^]\231^Wn\225ã\236ÅÁÄh\205Í<up¤WÇ×Ç×ÇhÀ^
?^Dý\207ÁÄhÀ{ý\225ÄhÀg¤WÀÇ'\233<Ï<×<ÈßÇÀÁ:ÁhÀWßÇÀ:Á:ÁhÀWß'Ó^^\220ÀhÀS¤W^\Ñc^^Ы^
^Ð×^\\221^^Я¤Wñ/\226\226^^лÀÀ¤WÇÇÇ×ÇßÇÇ:Á¤WÇhÀ_hághÀ[hákhÀ[ßÇÇÄhÀc^\O¤W#\223ÇV
^?\223ÇhÀC^\g¤W^\_"\223ÇÇÀÆÁhà?hÀG^T¨\226뵤WÇÀh_Áhà?hÀK\234W㸤WÇh_ÁÄhÀoýÇhÀw|_
¤WÇ#\223ÇÁÄhÀkÀ¤^ÆÇÁhà;hÀOýÇhÀw|=ÇhÀs|iÏÇ^^ÕeT^\Ó³\233\222/\227\227\227P\227ïÁ£\
205¤WT|{^?ujhh^?^EihhÜÁpà´^WpàÛøöóÛþõåöåîÖ\227ÜÒÅÙÒÛ¤¥\227ÔåòöãòÇþçò\227ÐòãÄãöåã
âçÞùñøÖ\227ÔåòöãòÇåøôòääÖ\227Ôûøäòßöùóûò\227ÇòòüÙöúòóÇþçò\227ÐûøõöûÖûûøô\227Àåþã
òÑþûò\227ÅòöóÑþûò\227Äûòòç\227ÒïþãÇåøôòää\227\227ÀÄØÔܤ¥\227äøôüòã\227õþùó\227ûþ
äãòù\227öôôòçã\227äòùó\227åòôá\227\225\227\211û\227\227\227\227\227\227\227\227\
227\227\227\227ôúó¹òïò\227hhhh
server1%

Thanks.
  #2 (permalink)  
Old 12-16-2003
PxT's Avatar
PxT PxT is offline Forum Advisor  
Registered User
  
 

Join Date: Oct 2000
Location: Sacramento, CA
Posts: 909
Error is from 'lpr' -- the print command. Have you tried printing something recently that might have caused it?
  #3 (permalink)  
Old 12-16-2003
finster's Avatar
finster finster is offline
Registered User
  
 

Join Date: Nov 2002
Location: USA
Posts: 75
No printers are installed on this box.


If someone tried to print something, is this the error message I can expect in the future?
  #4 (permalink)  
Old 12-16-2003
jsilva's Avatar
jsilva jsilva is offline
Registered User
  
 

Join Date: Apr 2003
Posts: 169
Hi,

I don't know if you pasted all the text correctly, but it might be someone trying to exploit your print daemon... if you don't need the printer service, just disable it and see if you have all the patches installed.
  #5 (permalink)  
Old 12-17-2003
kduffin's Avatar
kduffin kduffin is offline Forum Advisor  
UN1X
  
 

Join Date: Nov 2003
Location: Maryland
Posts: 449
It does look suspiciously like padding for a buffer overflow. Any service that you don't actually need (lpd in this case) should be shutdown. After seeing something like this, I'd take the time to not only proble for listening ports locally, but use an external tool such as nessus or nmap to peer into your system and etherreal to watch the outbound.

Cheers,

Keith
  #6 (permalink)  
Old 12-17-2003
finster's Avatar
finster finster is offline
Registered User
  
 

Join Date: Nov 2002
Location: USA
Posts: 75
Thanks for the replies.....I'll take your advice.


Thanks again.
  #7 (permalink)  
Old 02-09-2009
sanaup sanaup is offline
Registered User
  
 

Join Date: Feb 2009
Posts: 1
Post What ID corresponds to
Hi,

In the entry of each messages in /var/adm/messages there ID is there, what this ID corresponds to. I mean to say how this ID get generated?

Sandeep
Sponsored Links
Closed Thread

Bookmarks

« Not able to ping global zone from local zone | Not getting warnings!! »
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes Rate This Thread
Linear Mode Linear Mode
Rate This Thread:

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On



All times are GMT -4. The time now is 06:16 AM.

The UNIX and Linux Forums - Learn UNIX and UNIX Commands RSS Feeds - Contact Us - The UNIX and Linux Forums - Learn UNIX and UNIX Commands - Archive - Top

Powered by: vBulletin, Copyright ©2000 - 2006, Jelsoft Enterprises Limited. Language Translations Powered by .
vBCredits v1.4 Copyright ©2007 - 2008, PixelFX Studios
The UNIX and Linux Forums Content Copyright ©1993-2009. All Rights Reserved.Ad Management by RedTyger

Content Relevant URLs by vBSEO 3.2.0