Menu
▾
▴
[SSHGuard-users] strange log messages about dns resolving
|
From: Frank S. <fst...@bi...> - 2018-08-02 09:48:35
|
Hi, I find many messages like these in my logs: 2018-08-02T06:15:01.862432+02:00 fermat sshguard[10448]: message repeated 6111 times: [ Could not resolve 'org.freedesktop.Tracker1.Miner.Extract' to address] 2018-08-02T06:15:41.856787+02:00 fermat sshguard[10448]: message repeated 20 times: [ Could not resolve 'org.freedesktop.Tracker1.Miner.Extract' to address] 2018-08-02T06:15:44.902071+02:00 fermat sshguard[10448]: message repeated 42 times: [ Could not resolve 'org.kde.dolphin.desktop' to address] 2018-08-02T06:15:47.642763+02:00 fermat sshguard[10448]: Could not resolve 'org.freedesktop.Tracker1.Miner.Extract' to address 2018-08-02T06:15:50.294792+02:00 fermat sshguard[10448]: message repeated 3 times: [ Could not resolve 'org.freedesktop.Tracker1.Miner.Extract' to address] 2018-08-02T06:15:52.619668+02:00 fermat sshguard[10448]: Could not resolve 'org.kde.dolphin.desktop' to address 2018-08-02T06:15:53.381778+02:00 fermat sshguard[10448]: message repeated 137 times: [ Could not resolve 'org.kde.dolphin.desktop' to address] Obsiously sshguard somehow considers some messages from the KDE desktop as attack patterns which doesn't only flood my log files but might also cause many unccessary dns calls or cpu works (especially the "repeated 6111 times" is somewhat worrying). Below are some of the messages from dophin/tracker, maybe you can adjust the pattern matching so that these are ignored. cu, Frank 2018-08-02T06:15:07.433070+02:00 fermat org.freedesktop.Tracker1.Miner.Extract[6102]: ** 2018-08-02T06:15:07.433325+02:00 fermat org.freedesktop.Tracker1.Miner.Extract[6102]: ERROR:gstaudiodecoder.c:1527:gst_audio_decoder_push_buffers: assertion failed: (offset + len <= av) 2018-08-02T06:15:07.438528+02:00 fermat sshguard[10448]: Could not resolve 'org.freedesktop.Tracker1.Miner.Extract' to address 2018-08-02T06:15:10.243920+02:00 fermat org.freedesktop.Tracker1.Miner.Extract[6102]: ** 2018-08-02T06:15:10.244167+02:00 fermat org.freedesktop.Tracker1.Miner.Extract[6102]: ERROR:gstaudiodecoder.c:1527:gst_audio_decoder_push_buffers: assertion failed: (offset + len <= av) 2018-08-02T06:15:13.259264+02:00 fermat org.freedesktop.Tracker1.Miner.Extract[6102]: ** 2018-08-02T06:15:13.259528+02:00 fermat org.freedesktop.Tracker1.Miner.Extract[6102]: ERROR:gstaudiodecoder.c:1527:gst_audio_decoder_push_buffers: assertion failed: (offset + len <= av) 2018-08-02T06:15:14.848489+02:00 fermat org.freedesktop.Tracker1.Miner.Extract[6102]: (tracker-extract:15277): Tracker-WARNING **: Failed to update ignored file 'file:///home/users/ammar/Downloads/libgd-2.1.1/examples/noIconAlpha.tga': GDBus.Error:org.freedesktop.Tracker1.SparqlError.Parse: 1.267: syntax error, expected variable or term 2018-08-02T06:15:20.330276+02:00 fermat org.freedesktop.Tracker1.Miner.Extract[6102]: ** 2018-08-02T06:15:20.330487+02:00 fermat org.freedesktop.Tracker1.Miner.Extract[6102]: ERROR:gstaudiodecoder.c:1527:gst_audio_decoder_push_buffers: assertion failed: (offset + len <= av) 2018-08-02T06:15:23.285491+02:00 fermat org.freedesktop.Tracker1.Miner.Extract[6102]: ** 2018-08-02T06:15:23.285709+02:00 fermat org.freedesktop.Tracker1.Miner.Extract[6102]: ERROR:gstaudiodecoder.c:1527:gst_audio_decoder_push_buffers: assertion failed: (offset + len <= av) 2018-08-02T06:15:26.283477+02:00 fermat org.freedesktop.Tracker1.Miner.Extract[6102]: ** 2018-08-02T06:15:26.283699+02:00 fermat org.freedesktop.Tracker1.Miner.Extract[6102]: ERROR:gstaudiodecoder.c:1527:gst_audio_decoder_push_buffers: assertion failed: (offset + len <= av) 2018-08-02T06:15:27.842209+02:00 fermat org.freedesktop.Tracker1.Miner.Extract[6102]: (tracker-extract:15616): Tracker-WARNING **: Failed to update ignored file 'file:///home/users/ammar/Downloads/libgd-2.1.1/examples/noIconAlpha.tga': GDBus.Error:org.freedesktop.Tracker1.SparqlError.Parse: 1.267: syntax error, expected variable or term 2018-08-02T06:15:34.608785+02:00 fermat org.freedesktop.Tracker1.Miner.Extract[6102]: ** 2018-08-02T06:15:34.609012+02:00 fermat org.freedesktop.Tracker1.Miner.Extract[6102]: ERROR:gstaudiodecoder.c:1527:gst_audio_decoder_push_buffers: assertion failed: (offset + len <= av) 2018-08-02T06:15:37.263174+02:00 fermat org.freedesktop.Tracker1.Miner.Extract[6102]: ** 2018-08-02T06:15:37.263435+02:00 fermat org.freedesktop.Tracker1.Miner.Extract[6102]: ERROR:gstaudiodecoder.c:1527:gst_audio_decoder_push_buffers: assertion failed: (offset + len <= av) 2018-08-02T06:15:40.268377+02:00 fermat org.freedesktop.Tracker1.Miner.Extract[6102]: ** 2018-08-02T06:15:40.268645+02:00 fermat org.freedesktop.Tracker1.Miner.Extract[6102]: ERROR:gstaudiodecoder.c:1527:gst_audio_decoder_push_buffers: assertion failed: (offset + len <= av) 2018-08-02T06:15:41.849034+02:00 fermat org.freedesktop.Tracker1.Miner.Extract[6102]: (tracker-extract:17051): Tracker-WARNING **: Failed to update ignored file 'file:///home/users/ammar/Downloads/libgd-2.1.1/examples/noIconAlpha.tga': GDBus.Error:org.freedesktop.Tracker1.SparqlError.Parse: 1.267: syntax error, expected variable or term 2018-08-02T06:15:44.699866+02:00 fermat org.kde.dolphin.desktop[551]: org.kde.baloo: false "/org/kde/fstab/fs17.my.domain.de:/h" 2018-08-02T06:15:44.705027+02:00 fermat org.kde.dolphin.desktop[551]: org.kde.baloo: false "/org/kde/fstab/fs16.my.domain.de:/o" 2018-08-02T06:15:44.710212+02:00 fermat org.kde.dolphin.desktop[551]: org.kde.baloo: false "/org/kde/fstab/fs17.my.domain.de:/j" 2018-08-02T06:15:44.721023+02:00 fermat org.kde.dolphin.desktop[551]: org.kde.baloo: false "/org/kde/fstab/fs16.my.domain.de:/p" 2018-08-02T06:15:44.724658+02:00 fermat org.kde.dolphin.desktop[551]: org.kde.baloo: false "/org/kde/fstab/hilbert-int:/mnt/raidbiocluster" 2018-08-02T06:15:44.728317+02:00 fermat org.kde.dolphin.desktop[551]: org.kde.baloo: false "/org/kde/fstab/einstein:/mnt/einstein" 2018-08-02T06:15:44.731780+02:00 fermat org.kde.dolphin.desktop[551]: org.kde.baloo: false "/org/kde/fstab/fs17.my.domain.de:/l" 2018-08-02T06:15:44.735419+02:00 fermat org.kde.dolphin.desktop[551]: org.kde.baloo: false "/org/kde/fstab/fs16.my.domain.de:/r" 2018-08-02T06:15:44.738813+02:00 fermat org.kde.dolphin.desktop[551]: org.kde.baloo: false "/org/kde/fstab/fs16.my.domain.de:/t" 2018-08-02T06:15:44.742398+02:00 fermat org.kde.dolphin.desktop[551]: org.kde.baloo: false "/org/kde/fstab/fs16.my.domain.de:/w" 2018-08-02T06:15:44.746088+02:00 fermat org.kde.dolphin.desktop[551]: org.kde.baloo: false "/org/kde/fstab/fs16.my.domain.de:/st" 2018-08-02T06:15:44.749771+02:00 fermat org.kde.dolphin.desktop[551]: org.kde.baloo: false "/org/kde/fstab/fs17.my.domain.de:/u" 2018-08-02T06:15:44.753462+02:00 fermat org.kde.dolphin.desktop[551]: org.kde.baloo: false "/org/kde/fstab/fs17.my.domain.de:/v" 2018-08-02T06:15:44.757086+02:00 fermat org.kde.dolphin.desktop[551]: org.kde.baloo: false "/org/kde/fstab/fs17.my.domain.de:/x" 2018-08-02T06:15:44.760652+02:00 fermat org.kde.dolphin.desktop[551]: org.kde.baloo: false "/org/kde/fstab/fs17.my.domain.de:/y" 2018-08-02T06:15:44.764225+02:00 fermat org.kde.dolphin.desktop[551]: org.kde.baloo: false "/org/kde/fstab/fs17.my.domain.de:/sch" 2018-08-02T06:15:44.767685+02:00 fermat org.kde.dolphin.desktop[551]: org.kde.baloo: true "/org/kde/fstab/abel:/mnt/raidproj" 2018-08-02T06:15:44.771293+02:00 fermat org.kde.dolphin.desktop[551]: org.kde.baloo: false "/org/kde/fstab/fs15.my.domain.de:/big" 2018-08-02T06:15:44.775021+02:00 fermat org.kde.dolphin.desktop[551]: org.kde.baloo: false "/org/kde/fstab/hilbert-int:/var/log/apache2" 2018-08-02T06:15:44.778653+02:00 fermat org.kde.dolphin.desktop[551]: org.kde.baloo: false "/org/kde/fstab/fs14.my.domain.de:/proj" 2018-08-02T06:15:44.782253+02:00 fermat org.kde.dolphin.desktop[551]: org.kde.baloo: false "/org/kde/fstab/hilbert-int:/web/bio" 2018-08-02T06:15:44.785901+02:00 fermat org.kde.dolphin.desktop[551]: org.kde.baloo: false "/org/kde/fstab/fs14.my.domain.de:/c" 2018-08-02T06:15:44.789337+02:00 fermat org.kde.dolphin.desktop[551]: org.kde.baloo: false "/org/kde/fstab/fs14.my.domain.de:/d" 2018-08-02T06:15:44.793030+02:00 fermat org.kde.dolphin.desktop[551]: org.kde.baloo: false "/org/kde/fstab/hilbert-int:/web/www2" 2018-08-02T06:15:44.796832+02:00 fermat org.kde.dolphin.desktop[551]: org.kde.baloo: false "/org/kde/fstab/fs14.my.domain.de:/e" 2018-08-02T06:15:44.800691+02:00 fermat org.kde.dolphin.desktop[551]: org.kde.baloo: false "/org/kde/fstab/hilbert-int:/mnt/raidtmpbio" 2018-08-02T06:15:44.804556+02:00 fermat org.kde.dolphin.desktop[551]: org.kde.baloo: true "/org/kde/fstab/babbage:/export/home" 2018-08-02T06:15:44.808181+02:00 fermat org.kde.dolphin.desktop[551]: org.kde.baloo: false "/org/kde/fstab/fs14.my.domain.de:/i" 2018-08-02T06:15:44.811836+02:00 fermat org.kde.dolphin.desktop[551]: org.kde.baloo: false "/org/kde/fstab/hilbert-int:/mnt/raidbio" 2018-08-02T06:15:44.815662+02:00 fermat org.kde.dolphin.desktop[551]: org.kde.baloo: false "/org/kde/fstab/fs14.my.domain.de:/k" 2018-08-02T06:15:44.819674+02:00 fermat org.kde.dolphin.desktop[551]: org.kde.baloo: false "/org/kde/fstab/fs17.my.domain.de:/extra" 2018-08-02T06:15:44.823928+02:00 fermat org.kde.dolphin.desktop[551]: org.kde.baloo: false "/org/kde/fstab/fs15.my.domain.de:/f" 2018-08-02T06:15:44.828341+02:00 fermat org.kde.dolphin.desktop[551]: org.kde.baloo: false "/org/kde/fstab/hilbert-int:/web/drupalstatic/old" 2018-08-02T06:15:44.832414+02:00 fermat org.kde.dolphin.desktop[551]: org.kde.baloo: false "/org/kde/fstab/fs16.my.domain.de:/a" 2018-08-02T06:15:44.836437+02:00 fermat org.kde.dolphin.desktop[551]: org.kde.baloo: false "/org/kde/fstab/hilbert-int:/web/files" 2018-08-02T06:15:44.840300+02:00 fermat org.kde.dolphin.desktop[551]: org.kde.baloo: false "/org/kde/fstab/fs15.my.domain.de:/m" 2018-08-02T06:15:44.844556+02:00 fermat org.kde.dolphin.desktop[551]: org.kde.baloo: false "/org/kde/fstab/fs16.my.domain.de:/g" 2018-08-02T06:15:44.848934+02:00 fermat org.kde.dolphin.desktop[551]: org.kde.baloo: false "/org/kde/fstab/fs17.my.domain.de:/b" 2018-08-02T06:15:44.852922+02:00 fermat org.kde.dolphin.desktop[551]: org.kde.baloo: false "/org/kde/fstab/fs15.my.domain.de:/q" 2018-08-02T06:15:44.856990+02:00 fermat org.kde.dolphin.desktop[551]: org.kde.baloo: true "/org/kde/fstab/babbage:/rpm-export" 2018-08-02T06:15:44.862000+02:00 fermat org.kde.dolphin.desktop[551]: org.kde.baloo: false "/org/kde/fstab/fs15.my.domain.de:/s" 2018-08-02T06:15:44.902071+02:00 fermat sshguard[10448]: message repeated 42 times: [ Could not resolve 'org.kde.dolphin.desktop' to address] -- Dipl.-Inform. Frank Steiner Web: http://www.bio.ifi.lmu.de/~steiner/ Lehrstuhl f. Bioinformatik Mail: http://www.bio.ifi.lmu.de/~steiner/m/ LMU, Amalienstr. 17 Phone: +49 89 2180-4049 80333 Muenchen, Germany Fax: +49 89 2180-99-4049 * Rekursion kann man erst verstehen, wenn man Rekursion verstanden hat. * |
