PAM user error on ids 4235 Version 4.1(5)S190

[garyprice]

this is error message

Sep 9 14:34:30Sep 9 14:34:31 Defiant pam_tally[1321]: pam_tally: pam_get_uid; no such user "sensor name"

it is occuring every minute.

any ideas?

[a.arndt]

I can only hazard a guess. It looks like something is trying to login in to your sensor, and it is most likely automated.

Is it possible that some kind of network management system is probing your system? Do you have TELNET enabled? WhatsUp from Ipswitch is known to tickle telnet servers with a generic account, I believe, in order to determine the status of the server (up or down)…

Another possibility is that you have a RDEP / SDEE client with a misconfigured username (read: typo) trying to access alarms on the sensor.

Have you sniffed your Command and Control interface to see what the offending packets look like?

Alex Arndt