Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

The /var/log/messages log file on our server is filled with endless lines of

May  5 11:10:38 crm xinetd[24532]: FAIL: check_mk address from=1.2.3.4

It seems to log every 3 minutes or so, the number after the xinetd changes, but the IP address is always the same one

Can anyone tell me why this is, what's causing it and how to stop it.

The OS is CentOS 5.3 x64

Thanks

share|improve this question

2 Answers 2

up vote 0 down vote accepted

It would appear that you installed (but probably didn't configure?) Nagios and the check_mk plugin. The address you see belongs to APNIC Debogon Project in Brisbane, AU.

As for the stop it: read up on Nagios, check_mk and do it right.

P.S.: I gave you a downvote because given the information you provided it took me 2 minutes of googling to dig this up.

share|improve this answer
    
The likelihood that the address is actually 1.2.3.4 is pretty low. I am guessing he obfuscated the address, and just didn't use one of the ranges reserved for that purpose. –  Zoredache May 8 '13 at 0:07
    
@Zoredache: that is indeed a possibility. Doesn't make a difference, though? The plugin needs to be configured properly. –  tink May 8 '13 at 0:14
    
It makes a difference to your sentence about the APNIC Debogon project which is basically pointless, and almost certainly irrelevant, since this is just an obfuscated address. Or to put it differently, I only mentioned it, because you did. –  Zoredache May 8 '13 at 0:15
    
Thanks. Having already googled this numerous times and got nothing useful, you are obviously a better googler than I. Yes I obfuscated the address, not knowing what this was I didn't want to just chuck the real data in to a public forum. And no I didn't install or configure anything, I've just ended up managing this server and trying to do the best I can. –  fullybaked May 8 '13 at 7:53

You can start by looking at /etc/xinet.d/check_mk. It has both the settings as to what should be logged or not, and probably also indication of the monitoring server's IP address.

If you set disable = yes and restart xinetd that will turn off the agent port (6556) for good. You should really know who is trying to monitor your system though :)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.