On Tue, Jun 24, 2008 at 5:04 PM, Antun Balaz <[log in to unmask]> wrote:
> Hi,
>
> Are these records from pbs_server logs problematic, and should we do something
> about it:
>
> 06/24/2008 16:59:42;0100;PBS_Server;Req;;Type StatusJob request received from
Hi Antun,
We noticed them a few days ago and have got as far as deciding that
they are not
malicious but not where they come from.
With this version of torque you will see a simple "qstat" on the
localhost of the pbs_server
generating these logs.
With this version on the localhost a file socket rather than a network
socket is used and
the host name is kind of meaningless... Exactly where the address
comes from though
is still a mystery... The power of the mighty "grep" in the source
code shows nothing... Needs
a little more digging.
Steve
> [log in to unmask], sock=13
> 06/24/2008 16:59:42;0100;PBS_Server;Req;;Type StatusQueue request received
> from [log in to unmask], sock=11
> 06/24/2008 16:59:47;0100;PBS_Server;Req;;Type StatusJob request received from
> [log in to unmask], sock=14
> 06/24/2008 16:59:54;0100;PBS_Server;Req;;Type StatusJob request received from
> [log in to unmask], sock=18
> 06/24/2008 16:59:59;0100;PBS_Server;Req;;Type StatusJob request received from
> [log in to unmask], sock=11
> 06/24/2008 17:00:00;0100;PBS_Server;Req;;Type StatusJob request received from
> [log in to unmask], sock=16
> 06/24/2008 17:00:00;0100;PBS_Server;Req;;Type StatusQueue request received
> from [log in to unmask], sock=17
> 06/24/2008 17:00:01;0100;PBS_Server;Req;;Type StatusJob request received from
> [log in to unmask], sock=11
> 06/24/2008 17:00:01;0100;PBS_Server;Req;;Type StatusJob request received from
> [log in to unmask], sock=13
> 06/24/2008 17:00:06;0100;PBS_Server;Req;;Type StatusJob request received from
> [log in to unmask], sock=14
> 06/24/2008 17:00:06;0100;PBS_Server;Req;;Type StatusNode request received from
> [log in to unmask], sock=12
> 06/24/2008 17:00:06;0100;PBS_Server;Req;;Type StatusQueue request received
> from [log in to unmask], sock=12
> 06/24/2008 17:00:09;0100;PBS_Server;Req;;Type StatusJob request received from
> [log in to unmask], sock=15
> 06/24/2008 17:00:09;0100;PBS_Server;Req;;Type StatusJob request received from
> [log in to unmask], sock=12
>
> I suspect that here some internal numbers are wrongly interpreted as IP
> numbers and resolved through DNS, but I would like this confirmed. Can this
> somehow be switched off (since this probably creates a load on DNS)?
>
> Thanks, Antun
>
> -----
> Antun Balaz
> Research Assistant
> E-mail: [log in to unmask]
> Web: http://scl.phy.bg.ac.yu/
>
> Phone: +381 11 3713152
> Fax: +381 11 3162190
>
> Scientific Computing Laboratory
> Institute of Physics Belgrade
> Pregrevica 118, 11080 Belgrade, Serbia
> -----
>
--
Steve Traylen
|