LogWatch가 보낸 메일 내용의 분석 의뢰
아래와 같이 LogWatch가 메일을 보냅니다.
그런데 의미를 잘 모르겠는 것들이 있어서...
설명 좀 부탁 드리겠습니다.
각각의 내용이 어떤 의미인지...
sendmail begin이라는 줄 밑부분에 Unknown users라고 나오는 부분이 있습니다.
그런데 SMTP로 시작하는 줄의 메일 주소는 존재하는 것이고,
SMTP로 시작하지 않고 바로 메일 주소로 시작하는 줄은 존재하지 않는 User입니다.
왜 존재하는 User도 Unknown users에 나타나는지 모르겠습니다.
그리고, 메일 주소 뒷 부분의 ? Times(s)는 접속 성공한 횟수인지
무조건 시도한 횟수인지 알고 싶습니다.
좀더 내려가면 Connections(secure-log) Begin이 있습니다.
IP별로 쭉 나와 있는데, 이것 또한 접속 성공한 횟수인지
무조건 시도한 횟수인지 알고 싶습니다.
################## LogWatch 2.1.1 Begin #####################
--------------------- Named Begin ------------------------
**Unmatched Entries**
/etc/named.conf16 parse error near 'LogFile' 1 Time(s)
loading configuration from '/etc/named.conf' 1 Time(s)
loading configuration failure 1 Time(s)
named startup succeeded 1 Time(s)
starting BIND 9.1.3 -u named 1 Time(s)
using 1 CPU 1 Time(s)
---------------------- Named End -------------------------
--------------------- sendmail Begin ------------------------
482010519 bytes transferred
963 messages sent
Unknown users
SMTPhskim@test.com 51 Times(s)
SMTPjhlee@test.com 21 Times(s)
stat1208@test.com 1 Times(s)
SMTPykbae@test.com 6 Times(s)
SMTPjykim@test.com 39 Times(s)
SMTPmjkim@test.com 6 Times(s)
SMTPkhpark@test.com 3 Times(s)
bskim@test.com 2 Times(s)
SMTPcjlee@test.com 9 Times(s)
SMTPmjshin@test.com 3 Times(s)
SMTPmjkang@test.com 36 Times(s)
SMTPsyhwang@test.com 66 Times(s)
SMTPjhkim@test.com 33 Times(s)
SMTPyjkim@test.com 3 Times(s)
SMTPkmkim@test.com 9 Times(s)
SMTPkhryu@test.com 24 Times(s)
SMTPjshwang@test.com 111 Times(s)
SMTPHSJANG@test.com 66 Times(s)
SMTPbskim@test.com 78 Times(s)
SMTPshbaek@test.com 12 Times(s)
**Unmatched Entries**
h3FF7Ne27292 h3FF7he27294 DSN Return receipt
NOQUEUE [203.xx.xx.145] did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA
NOQUEUE [203.xx.xx.145] did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA
NOQUEUE [203.xx.xx.145] did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA
NOQUEUE [203.xx.xx.145] did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA
NOQUEUE [203.xx.xx.145] did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA
NOQUEUE [203.xx.xx.145] did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA
h3FEm9e27270 timeout waiting for input from 12-211-83-98.client.attbi.com during message collect
NOQUEUE [203.xx.xx.177] did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA
NOQUEUE sender0012.lodo.test.com [64.xx.xx.32] did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA
h3AN4kx08975 h3FNvwI01517 sender notify Cannot send message for 5 days
NOQUEUE [211.xx.xx.234] did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA
h3G1FNH01983 h3G1FXH01985 DSN User unknown
NOQUEUE [220.xx.xx.85] did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA
h3G1cZH02087 h3G1cZH02089 DSN Host unknown (Name server yonsei.ac.k host not found)
NOQUEUE [211.xx.xx.186] did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA
NOQUEUE [211.xx.xx.158] did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA
h3G5q7H03217 h3G5s2H03219 DSN Service unavailable
h3G6AaH03283 h3G6AeH03285 DSN User unknown
h3G6AcH03286 h3G6AhH03288 DSN User unknown
h3G6AeH03289 h3G6AqH03293 DSN User unknown
h3G6ApH03308 h3G6AvH03311 DSN Service unavailable
h3G6AiH03299 h3G6AvH03301 DSN User unknown
h3G6ArH03312 h3G6AvH03314 DSN User unknown
h3G6BAH03326 h3G6BLH03328 DSN User unknown
h3G6B6H03322 h3G6BMH03325 DSN User unknown
h3G6BEH03330 h3G6BMH03332 DSN User unknown
h3G6BLH03343 h3G6BeH03347 DSN User unknown
h3G6BlH03385 h3G6BoH03387 DSN Service unavailable
h3G6BjH03382 h3G6BoH03384 DSN Service unavailable
h3G6BnH03388 h3G6BrH03392 DSN User unknown
h3G6BpH03396 h3G6BuH03399 DSN Service unavailable
h3G6BsH03400 h3G6C1H03403 DSN Service unavailable
h3G6BwH03404 h3G6C1H03406 DSN Service unavailable
h3G6C7H03438 h3G6CAH03440 DSN Service unavailable
h3G6CBH03447 h3G6CEH03449 DSN Service unavailable
h3G6CGH03459 h3G6CIH03461 DSN Service unavailable
h3G6CIH03462 h3G6COH03465 DSN Service unavailable
h3G6CRH03475 h3G6CVH03477 DSN Service unavailable
h3G6CUH03484 h3G6CbH03487 DSN Service unavailable
h3G6CcH03513 h3G6CgH03515 DSN User unknown
h3G6D3H03567 h3G6D6H03569 DSN Service unavailable
h3G6D7H03574 h3G6DFH03576 DSN Service unavailable
h3G6DJH03593 h3G6DMH03595 DSN Service unavailable
h3G6DIH03590 h3G6DPH03592 DSN Service unavailable
h3G6DLH03598 h3G6DdH03602 DSN Service unavailable
h3G6DYH03606 h3G6DiH03608 DSN Service unavailable
h3G6DrH03649 h3G6DuH03651 DSN Service unavailable
NOQUEUE [211.xx.xx.56] did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA
h3G9YAH04758 ruleset=check_rcpt, arg1=<syiffx@test.com>, relay=[211.xx.xx.250], reject=550 5.7.1 <syiffx@test.com>... Relaying denied. IP name lookup failed [211.xx.xx.250]
NOQUEUE [211.xx.xx.198] did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA
NOQUEUE [211.xx.xx.231] did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA
NOQUEUE [211.xx.xx.231] did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA
NOQUEUE [211.xx.xx.203] did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA
---------------------- sendmail End -------------------------
---------------- Connections (secure-log) Begin -------------------
Connections
Service pop3
63.xx.xx.175 2 Time(s)
210.xx.xx.5 176 Time(s)
61.xx.xx.48 9 Time(s)
210.xx.xx.254 105 Time(s)
211.xx.xx.215 24 Time(s)
211.xx.xx.203 22 Time(s)
211.xx.xx.220 24 Time(s)
211.xx.xx.221 1 Time(s)
211.xx.xx.205 6 Time(s)
218.xx.xx.206 1 Time(s)
211.xx.xx.206 18 Time(s)
211.xx.xx.207 96 Time(s)
211.xx.xx.223 42 Time(s)
211.xx.xx.224 23 Time(s)
211.xx.xx.208 32 Time(s)
211.xx.xx.226 15 Time(s)
211.xx.xx.227 38 Time(s)
211.xx.xx.171 11 Time(s)
63.xx.xx.216 2 Time(s)
211.xx.xx.228 18 Time(s)
211.xx.xx.229 30 Time(s)
219.xx.xx.192 2 Time(s)
211.xx.xx.192 155 Time(s)
211.xx.xx.195 24 Time(s)
211.xx.xx.210 21 Time(s)
211.xx.xx.211 275 Time(s)
211.xx.xx.244 6 Time(s)
211.xx.xx.212 30 Time(s)
211.xx.xx.213 25 Time(s)
211.xx.xx.214 10 Time(s)
211.xx.xx.215 12 Time(s)
211.xx.xx.231 26 Time(s)
211.xx.xx.142 95 Time(s)
211.xx.xx.143 18 Time(s)
211.xx.xx.232 74 Time(s)
211.xx.xx.217 6 Time(s)
211.xx.xx.233 14 Time(s)
211.xx.xx.218 20 Time(s)
211.xx.xx.234 18 Time(s)
211.xx.xx.235 18 Time(s)
211.xx.xx.147 30 Time(s)
211.xx.xx.236 22 Time(s)
211.xx.xx.180 33 Time(s)
211.xx.xx.237 25 Time(s)
211.xx.xx.181 17 Time(s)
211.xx.xx.185 29 Time(s)
Service sgi_fam
0.0.0.0 1 Time(s)
----------------- Connections (secure-log) End --------------------
---------------------- Syslogd Begin -------------------------
**Unmatched Entries**
gethostby*.getanswer asked for "test_svr", got "realname"
---------------------- Syslogd End -------------------------
###################### LogWatch End #########################
또 다른 LogWatch를 좀 보겠습니다.
ftpd-messages Begin에서 User FTP Logins는 접속에 성공한 내용만 보이는 것인지? Unmatched Entries는 접속한 것 중 존재하지 않는 ID를 입력한 것인지? Connections에 보이는 IP 중에 User FTP Logins에도 없고 Unmatched Entries에도 없는 것은 어떤 상태인지? 그런 것들이 궁금합니다.
제가 잘 몰라서....
답변 부탁 드립니다.
################## LogWatch 2.1.1 Begin #####################
--------------------- ftpd-messages Begin ------------------------
User FTP Logins
211.xx.xx.131 (211.xx.xx.131) test1 - 1 Time(s)
211.xx.xx.206 (211.xx.xx.206) test2 - 2 Time(s)
**Unmatched Entries**
FTP LOGIN FAILED (cannot set guest privileges) for ACB086F1.ipt.test.com [172.xx.xx.241], ftp
FTP LOGIN FAILED (cannot set guest privileges) for 211.xx.xx.101 [211.xx.xx.101], ftp
---------------------- ftpd-messages End -------------------------
--------------------- sendmail Begin ------------------------
1621 bytes transferred
1 messages sent
**Unmatched Entries**
My unqualified host name (test_server) unknown; sleeping for retry
unable to qualify my own domain name (test_server) -- using short name
My unqualified host name (test_server) unknown; sleeping for retry
unable to qualify my own domain name (test_server) -- using short name
My unqualified host name (test_server) unknown; sleeping for retry
unable to qualify my own domain name (test_server) -- using short name
---------------------- sendmail End -------------------------
---------------- Connections (secure-log) Begin -------------------
Connections
Service ftp
211.xx.xx.171 1 Time(s)
62.xx.xx.72 1 Time(s)
210.xx.xx.171 1 Time(s)
211.xx.xx.131 1 Time(s)
211.xx.xx.206 2 Time(s)
211.xx.xx.101 1 Time(s)
172.xx.xx.241 1 Time(s)
61.xx.xx.221 1 Time(s)
Service telnet
211.xx.xx.204 1 Time(s)
211.xx.xx.147 1 Time(s)
211.xx.xx.206 7 Time(s)
Service sgi_fam
0.0.0.0 1 Time(s)
----------------- Connections (secure-log) End --------------------
###################### LogWatch End #########################
댓글 달기