<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
On 09/05/2012 08:13 AM, Roy Urick wrote:
<blockquote cite="mid:002001cd8b68$4b69ffb0$e23dff10$@usa.net"
type="cite">
<meta http-equiv="Context-Type" content="text/html;
charset=us-ascii">
<div>
<p>We started seeing the host blocks kick in yesterday against
the IP of our corporate firewall. </p>
<p> </p>
<p>At first we thought it was the conversion we are doing and
that the server running popcon was causing failures due to
accounts with bad passwords. However when I tail the maillog
and grep for “(auth failed” the number of failures doesn’t
match the failure count on the server gui. The server is
reporting approximately 2-3 failed logins for every auth
failed line we see in the maillog. </p>
<p> </p>
<p>I have dug around the other logfiles in that directory and
don’t see any other failed login references. Also the gui
doesn’t seem to pace the errors in maillog exactly as its
incrementing faster than the logfile. </p>
<p> </p>
<p>Where else do I look to figure out what could be causing the
login failures? </p>
<p> <br>
</p>
</div>
</blockquote>
look at /var/log/secure<br>
<br>
Gerald<br>
</body>
</html>