> > > Service sgi_fam: > > > <no address>: 5 Time(s) > > > > > > Can someone please explain what the above means and how this service > > > can be configured to give useful information? > > > > I am unfamiliar with logcheck, however I assume it means that there were > > five connections to the sgi_fam service. Presumably the system was > > unable to determine the client's address. > > It is a program that scans the logs and sends out a daily message depending > on how it is configured. I figured that much. :-) > > FAM is the file alteration monitor. It is used by file managers such as > > Nautilus and Konqueror to always show an up-to-date view of the file > > system. You can read more about it here: > > <http://oss.sgi.com/projects/fam/> > > Thanks. It is sorta thin on details -- at least for me. I am currently maintaining those pages, so let me know how you think they're inadequate, and I'll try to find the time to improve them. :-) > > On Red Hat Linux systems, famd is configured in xinetd to bind to the > > loopback interface, meaning clients can only connect to famd using > > sockets (or local TCP/IP clients on 127.0.0.1), so connections from > > remote hosts will not be accepted. Any configuration changes you might > > make related to this message would probably be made to xinetd rather > > than famd itself. See </etc/xinetd.d/sgi_fam> for more information. > > Roger, saw that. > > > If you could post the information in your syslog related to fam, I might > > be able to help figure it out. </var/log/messages> is probably a good > > place to look first. > > Not a lot in the logs either. Nothing in messages, boot.log, > > Secure has entries like: > > Jan 21 09:51:41 www xinetd[664]: START: sgi_fam pid=20567 from=<no address> > Jan 21 19:49:49 www xinetd[664]: START: sgi_fam pid=24372 from=<no address> > Jan 21 19:57:47 www xinetd[664]: START: sgi_fam pid=24629 from=<no address> > Jan 21 20:04:47 www xinetd[664]: START: sgi_fam pid=24788 from=<no address> > Jan 22 13:21:26 www xinetd[664]: START: sgi_fam pid=27329 from=<no address> > Jan 22 13:24:16 www xinetd[664]: START: sgi_fam pid=27478 from=<no address> > Jan 22 13:34:42 www xinetd[664]: START: sgi_fam pid=27654 from=<no address> > Jan 22 16:19:44 www xinetd[664]: START: sgi_fam pid=27930 from=<no address> > Jan 22 17:31:08 www xinetd[28043]: START: sgi_fam pid=28328 from=<no > address> Jan 23 09:57:48 www xinetd[28043]: START: sgi_fam pid=29981 > from=<no address> Jan 23 16:33:28 www xinetd[28043]: START: sgi_fam > pid=32623 from=<no address> Jan 23 18:22:17 www xinetd[28043]: START: > sgi_fam pid=967 from=<no address> > > which is consistent with what logcheck is telling me. These messages are generated by xinetd, not fam, which is why I suggested learning more about xinetd and its configuration files. I think you should safely be able to ignore these messages. You might like to change the xinetd logging settings or tell logwatch not to report these. > I get this in daemonlog (separate log for daemons): > > Jan 22 16:35:07 www xinetd[28043]: Reading included configuration file: > /etc/xinetd.d/sgi_fam [line=13] > > and these > > Jan 22 17:39:06 www fam[28328]: test-monitor invalid request number 33 > Jan 22 17:39:06 www fam[28328]: test-monitor invalid request number 32 > Jan 22 19:55:56 www fam[28328]: test-monitor invalid request number 13 > > I have no idea where the test-monitor message was generated nor why. I > grep'd but did not find anything. > > Be nice to know where and why these things are triggered. This message means from fam means that the client did something unexpected. A quick Web search suggests test-monitor is probably a GNOME component, so I guess it happens when starting GNOME or a GNOME component that uses FAM such as the Nautilus file manager. I can't think why exactly it would happen. -- Michael Wardle Adacel Technologies -- Psyche-list mailing list Psyche-list@redhat.com https://listman.redhat.com/mailman/listinfo/psyche-list
