1

fresh install of Ubuntu 16.04. My syslog is filling up daily, over 60GB per day. Looking at the last few entries, I see these being written several times per second: 

Jul 18 12:39:23 JALServer gnome-session[1361]: 18/07/2016 12:39:23 PM      static-71-177-42-141.lsanca.fios.frontiernet.net
Jul 18 12:39:23 JALServer gnome-session[1361]: 18/07/2016 12:39:23 PM      75-114-70-170.biz.bhn.net
Jul 18 12:39:23 JALServer gnome-session[1361]: 18/07/2016 12:39:23 PM      static-71-177-42-141.lsanca.fios.frontiernet.net
Jul 18 12:39:23 JALServer gnome-session[1361]: 18/07/2016 12:39:23 PM      75-114-70-170.biz.bhn.net
Jul 18 12:39:23 JALServer gnome-session[1361]: 18/07/2016 12:39:23 PM      static-71-177-42-141.lsanca.fios.frontiernet.net
Jul 18 12:39:23 JALServer gnome-session[1361]: 18/07/2016 12:39:23 PM      75-114-70-170.biz.bhn.net

It appears to be domain names and ip addresses of an ISP (not my IP address, though), but I can't figure out why gnome-session is writing it. If it matters, I'm running vino, vsftpd, openssh-server, deluged and a LAMP stack, plus some php and python apps that I can access over the web.

Sorry if this has been asked before but of the many syslog messages in questions here I haven't seen anything like this, and I'm pretty much a newbie.

Aikiharp
  • 21
  • You could append those hostnames to your localhost entry in /etc/hosts, so it looks like 127.0.0.1 localhost yourhost static-71-177-42-141.lsanca.fios.frontiernet.net 75-114-70-170.biz.bhn.net. That should at least evoke more error messages. – waltinator Jul 18 '16 at 21:21

1 Answers1

1

Turns out it was a brute-force attack on my VNC port getting through my router. I've installed DenyHosts and Fail2Ban and I'm keeping an eye on the syslog.

Aikiharp
  • 21