0

I noticed in /var/log/messsages a process 'cimserver' was logging some interesting messages:

Nov 27 15:33:37 lb-web-standby cimserver[2250]: Failed to deliver an indication: Cannot 
connect to the-hostname-of-the-server-im-current-on:49152. Connection failed.
Nov 27 15:33:37 lb-web-standby cimserver[2250]: Failed to deliver an indication: 
Invalid locator: the-hostname-of-the-server-im-current-on:49152

I did a little digging and I was able to find a command reference for cimserver online, but no details as to what task it specifically performs. I know that CIM stands for the Common Information Model in computing, but I don't understand why there is a daemonized task running on our box related to this. What exactly does this process do and why is it giving connection errors in the log?

2 Answers 2

2

The cimserver daemon is simply a server daemon that allows connections using the Common Information Model. It's typically used by vendors and OEMs as a way for their management and monitoring software and/or services to connect to their servers.

HP uses it for their WBEM Services, IBM uses it (among other things) for their Performance Expert DB2 monitoring software, Cisco uses it for SAN management, VMware uses it for hardware monitoring, Dell uses it for their OpenManage remote management and server monitoring packages (though I can't find a link for that which isn't a .pdf), and other vendors and OEMs use it for similar purposes.

You haven't provided enough inofrmation to determine precisely what it's being used for on your system, or diagnose the errors, except to say that it expecting to connect to something on port 49152, and can't, hence the error.

-2

Could be this huge security breach that is going on with Supermicro boards. The attackers are connecting to the port which BMC boards use it for hardware monitoring purposes. There is supposed to be a patch comming out soon. A large amount of these boards were released by the companies that were mentioned above such as HP. Dell, etc...

http://arstechnica.com/security/2014/06/at-least-32000-servers-broadcast-admin-passwords-in-the-clear-advisory-warns/

http://arstechnica.com/security/2013/08/remote-admin-tool-imperils-servers/

3
  • What does this have to do with the question? Sep 13, 2014 at 13:11
  • Maybe the port is being attacked with the vulnerability in the SM boards through the CIM module? It was more research point as the OP is unsure of the origin of these failures. Any unknown attempts to connect to a port should be viewed as a possible* attack. I thought it was relevant. If I am mistaken could you let me know why this is not relevant so I can understand my error. Thanks you. Sep 14, 2014 at 23:13
  • This is wholly unrelated to the question. ServerFault is not a discussion forum.
    – Bacon Bits
    Jul 28, 2016 at 16:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .