0

I noticed in /var/log/messsages a process 'cimserver' was logging some interesting messages:

Nov 27 15:33:37 lb-web-standby cimserver[2250]: Failed to deliver an indication: Cannot 
connect to the-hostname-of-the-server-im-current-on:49152. Connection failed.
Nov 27 15:33:37 lb-web-standby cimserver[2250]: Failed to deliver an indication: 
Invalid locator: the-hostname-of-the-server-im-current-on:49152

I did a little digging and I was able to find a command reference for cimserver online, but no details as to what task it specifically performs. I know that CIM stands for the Common Information Model in computing, but I don't understand why there is a daemonized task running on our box related to this. What exactly does this process do and why is it giving connection errors in the log?

2

The cimserver daemon is simply a server daemon that allows connections using the Common Information Model. It's typically used by vendors and OEMs as a way for their management and monitoring software and/or services to connect to their servers.

HP uses it for their WBEM Services, IBM uses it (among other things) for their Performance Expert DB2 monitoring software, Cisco uses it for SAN management, VMware uses it for hardware monitoring, Dell uses it for their OpenManage remote management and server monitoring packages (though I can't find a link for that which isn't a .pdf), and other vendors and OEMs use it for similar purposes.

You haven't provided enough inofrmation to determine precisely what it's being used for on your system, or diagnose the errors, except to say that it expecting to connect to something on port 49152, and can't, hence the error.

| improve this answer | |
-2

Could be this huge security breach that is going on with Supermicro boards. The attackers are connecting to the port which BMC boards use it for hardware monitoring purposes. There is supposed to be a patch comming out soon. A large amount of these boards were released by the companies that were mentioned above such as HP. Dell, etc...

http://arstechnica.com/security/2014/06/at-least-32000-servers-broadcast-admin-passwords-in-the-clear-advisory-warns/

http://arstechnica.com/security/2013/08/remote-admin-tool-imperils-servers/

| improve this answer | |
  • What does this have to do with the question? – Andrew Schulman Sep 13 '14 at 13:11
  • Maybe the port is being attacked with the vulnerability in the SM boards through the CIM module? It was more research point as the OP is unsure of the origin of these failures. Any unknown attempts to connect to a port should be viewed as a possible* attack. I thought it was relevant. If I am mistaken could you let me know why this is not relevant so I can understand my error. Thanks you. – chrstphrmllr Sep 14 '14 at 23:13
  • This is wholly unrelated to the question. ServerFault is not a discussion forum. – Bacon Bits Jul 28 '16 at 16:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.