Problem:
The following would show up in my logs with a different GUID and timestamp of course on one minute intervals.
Mar 15 13:03:27 server 1 sshd[16979]: Connection closed by 127.0.0.1
Solution:
To solve this mystery I began trying to think of the possibilities of what it could be. What had I just installed that would be doing this? My memory sucks and I couldn't remember, so I began looking through the web to see if anyone had any solutions. A coworker of mine suggested using a netstat command ("netstat -lep --tcp") to see what services were running and which ones were newly installed on my server. I went through and turned off the services one at a time until I found the culprit. Monit had been installed some days earlier but the configuration file had errored out producing the message above in my log. Stopping the service ("/sbin/service monit stop"), the error no longer appeared in the log file. With some fixing, I am sure the wrongs in the Monit config file could be made right, but for now I am just going to keep it off.
Hope this helps someone else with the same issue. Good luck.
2 comments:
Same issue, sshd, monit, your tips saved me a heap of time, thanks!
Same issue here.
Thank you very much!
Post a Comment