C/S Login dos in POA logs

Good morning, currently running GW802HP2 but see this issue in POA log entries from before I did that service pack update, I'm seeing a bunch of entries like this:
07:08:52 03E C/S Login dos ::GW Id=abuse :: 172.16.15.26
"abuse" is a nickname...
There would be a bunch of these at the same time for the same GW Id, then for another nickname, then sometimes for a legit user name, then sometimes for a distribution list. After some digging I came up with an old TID that says this can be from an authentication on the GWIA so I looked in the logs there and I find corresponding entries for all the ones I see in the POA (I didn't check every single one but enough to be pretty sure), entries such as:
07:08:52 1C2 Successful login with client/server access: 172.16.15.26:1677
172.16.15.26 would be the local NW65SP8 server running the MTA / POA / GWIA / WebAccess.
Why would there be such entries in the GWIA and POA logs? It's not clear which of these 2 is initiating all this or if it's something else causing this. How can a nickname authenticate (there's no pswd)?
I just want to be sure I don't have a security issue here.
I found similar entries on another NW65SP8 server at a different location, running similar software.
Any help appreciated as usual.
Cheers
James

Perhaps a POP3 login would make such entries?
--El
Originally Posted by JBSIS
Good morning, currently running GW802HP2 but see this issue in POA log entries from before I did that service pack update, I'm seeing a bunch of entries like this:
07:08:52 03E C/S Login dos ::GW Id=abuse :: 172.16.15.26
"abuse" is a nickname...
There would be a bunch of these at the same time for the same GW Id, then for another nickname, then sometimes for a legit user name, then sometimes for a distribution list. After some digging I came up with an old TID that says this can be from an authentication on the GWIA so I looked in the logs there and I find corresponding entries for all the ones I see in the POA (I didn't check every single one but enough to be pretty sure), entries such as:
07:08:52 1C2 Successful login with client/server access: 172.16.15.26:1677
172.16.15.26 would be the local NW65SP8 server running the MTA / POA / GWIA / WebAccess.
Why would there be such entries in the GWIA and POA logs? It's not clear which of these 2 is initiating all this or if it's something else causing this. How can a nickname authenticate (there's no pswd)?
I just want to be sure I don't have a security issue here.
I found similar entries on another NW65SP8 server at a different location, running similar software.
Any help appreciated as usual.
Cheers
James

Similar Messages

  • How to interpret poa log?

    Can anyone help me to interpret this POA log? One user (user1) is complaining about lost message from another user within our domain (user2). I think he deleted the message by himself by accident, but I'm not sure. He claims that the message disappeared spontaneously without his intervention. He only clicked "Read" button in notifier window and the message has gone??? I don't believe it, but can't find out, what really happened....Is the message really deleted? Who deleted it? There is some "follow-up" message from user2 to user1 at 15:05:36. Should it be "delivery confirmation" notification?
    Is anywhere available some explanation of items in POA logs? I found only "Post Office Agent Error Messages" in Groupwise 2012 troubleshooting document. But what about common messages? The logs are quite worthless, when I can't interpret them enough:-(. Thank you for your help
    15:05:00 EADF C/S Login Windows Net Id=user2 ::GW Id=user2 :: 192.168.7.98
    15:05:03 EADF Client Slap session [1407481774] from IP address 192.168.7.98 Bag ID= 19541
    15:05:03 EADF Client Slap Socket Bag ID = 19541 has been added
    15:05:26 EADF Distribute message from: user2 (user2)
    15:05:26 EADF Begin distribution to 1 users
    15:05:26 EADF Distributed: user1
    15:05:29 EADF Processing update: settings (bag) record (user2)
    15:05:29 EADF *** APP DISCONNECTED, Tbl Entry=11, Check ID=1407481775
    15:05:29 EADF Processing update: settings (bag) record (user2)
    15:05:29 EADF *** APP DISCONNECTED, Tbl Entry=0, Check ID=1407481774
    15:05:30 EADF Processing update: Execution Record (user1)
    15:05:30 EADF Purge Execution Record #45963 (user1)
    15:05:30 EADF Processing update: item record (user1)
    15:05:36 EADF Processing update: item record (user1)
    15:05:36 EADF Distribute message from: user1 (user1)
    15:05:36 EADF Begin distribution to 1 users
    15:05:36 EADF Distributed: user2

    Hi,
    This line here:
    15:05:30 EADF Purge Execution Record #45963 (user1)
    Tells me that User1 deleted the mail.
    If User2 checks their sent items, and looks at the properties of the "missing" e-mail what is the status of the message?
    Just note that the Delete button is right next to the Read button on the notify window. Could it have been user error?
    Let us know,
    Cheers

  • POA Log - Redirecting User - Clarification Question

    In my POA logs I see the following entry:
    C/S Login Windows :GW ID=username :: IPAddress (this is an internal IP)
    Redirecting user "joeuser.realpostoffice.realdomain" to IPAddress:1677 (this is the IP address/port of user's post office
    If I am reading this correctly, I understand this to mean that joeuser has an account in "realpostoffice" but logged in with a client that is pointing to another post office.
    Please correct me if I'm wrong.
    I also see the following entries repeatedly:
    C/S login Windows: :: IPaddress (this is an internal IP)
    Redirecting user "postoffice1.realdomain" to IP Address of postoffice1:1677
    What concerns me is the fact that this entry has no username attached to the redirect statement and I'm wondering where this login might be coming from.
    Both if the IPAddresses in the login are actual systems on our internal network (not wireless devices).
    Thanks
    Can anyone shed some light on the entry

    On 3/21/2012 7:46 AM, vchiarelli wrote:
    >
    > In my POA logs I see the following entry:
    >
    > C/S Login Windows :GW ID=username :: IPAddress (this is an internal
    > IP)
    > Redirecting user "joeuser.realpostoffice.realdomain" to IPAddress:1677
    > (this is the IP address/port of user's post office
    >
    > If I am reading this correctly, I understand this to mean that joeuser
    > has an account in "realpostoffice" but logged in with a client that is
    > pointing to another post office.
    >
    > Please correct me if I'm wrong.
    >
    correct
    > I also see the following entries repeatedly:
    >
    > C/S login Windows: :: IPaddress (this is an internal IP)
    > Redirecting user "postoffice1.realdomain" to IP Address of
    > postoffice1:1677
    >
    > What concerns me is the fact that this entry has no username attached
    > to the redirect statement and I'm wondering where this login might be
    > coming from.
    > Both if the IPAddresses in the login are actual systems on our internal
    > network (not wireless devices).
    >
    > Thanks
    >
    > Can anyone shed some light on the entry
    >
    >
    dunno. guessing it's the poa itself, maybe forbusy search or shared
    resources?

  • I am trying to purchase an app and when i try ti it tells me to login. When I log in it ask me security questions which I don't even remember the answers to. I put, "forgot answers" and it told me to check my email but I don't receive it.

    I am trying to purchase an app and when I try to it tells me to login. When I log in it ask me security questions which I don't even remember the answers to. I put, "forgot answers" and it says, "we can help you reset your security information by sending a message to your rescue email address: [email protected]" I only have one email and thats on Yahoo. i still click send email button and it tells me to check my email but i dont recieve anything. please help me

    That's not a good sign if it said it was going to send it to an email address you've never heard of. Contact iTunes Support and let them know this: http://apple.com/support/itunes/contact/

  • Trying to login and automatically get logged out in AD?

    Basically what happens is an AD user *using admit mac* tries to login, it start to spin like it's going to let her in but then goes to a blue screen *non death* and then goes straight back to the login screen from that said blue screen. All other AD accounts can login just fine.
    This is the log I'm getting from a good login, starting from 2:56:33-2:56:53, and then the problem login where i get booted before i even get to my home screen starting at 2:58:20, and then a following good login to collect the log. I put spaces in where i think each login starts and begins. I have also removed my companies domain and replaced it with ***** in several places.
    5/8/12 2:56:33 PM             com.apple.DirectoryServices[15]   [0x1006a1ba0] priv_searchSync error Error Domain=LDAPErrorDomain Code=-7 UserInfo=0x1006accf0 "Bad search filter"
    5/8/12 2:56:36 PM             com.apple.DirectoryServices[15]   [0x10067d4c0] priv_searchSync error Error Domain=LDAPErrorDomain Code=-7 UserInfo=0x10069b8b0 "Bad search filter"
    5/8/12 2:56:38 PM             edu.mit.Kerberos.CCacheServer[221]          launchctl start error: No such process
    5/8/12 2:56:44 PM             com.thursby.TSSRegistryStore[50]                WARN [0x20aa00] -[Replicator(GroupPolicy) infArrayFromInfData:]: '=' but no assignment?
    5/8/12 2:56:44 PM             com.thursby.TSSRegistryStore[50]                WARN [0x20aa00] -[LDAPKerbConnection(LDAPKerbConnectionGroupPolicyExtensions) groupPolicyEntriesAtDN:]: entryAtDN failed for gPLinkDN 'cn={DEC02046-73EB-4A18-8539-4E45787D6C8F},cn=policies,cn=system,DC=*****,DC=** ***,DC=net', error=Error Domain=LDAPErrorDomain Code=10 UserInfo=0x40a4e0 "Referral"
    5/8/12 2:56:44 PM             com.thursby.TSSRegistryStore[50]                WARN [0x20aa00] -[LDAPKerbConnection(LDAPKerbConnectionGroupPolicyExtensions) groupPolicyEntriesAtDN:]: entryAtDN failed for gPLinkDN 'cn={CF494306-C9C6-4349-B2BA-707E745C19EC},cn=policies,cn=system,DC=*****,DC=** ***,DC=net', error=Error Domain=LDAPErrorDomain Code=10 UserInfo=0x40a510 "Referral"
    5/8/12 2:56:44 PM             com.apple.launchctl.Aqua[1125]   launchctl: Please convert the following to launchd: /etc/mach_init_per_user.d/com.adobe.versioncueCS4.monitor.plist
    5/8/12 2:56:44 PM             com.apple.launchd.peruser.7589[219]        (com.apple.ReportCrash) Falling back to default Mach exception handler. Could not find: com.apple.ReportCrash.Self
    5/8/12 2:56:45 PM             com.apple.launchd.peruser.7589[219]        (com.apple.Kerberos.renew.plist[1144]) Exited with exit code: 1
    5/8/12 2:56:45 PM             FlipShareAutoRun[1148]   Could not connect the action buttonPressed: to target of class NSApplication
    5/8/12 2:56:45 PM             FlipShareAutoRun[1148]   Could not connect the action buttonPressed: to target of class NSApplication
    5/8/12 2:56:45 PM             FlipShareAutoRun[1148]   Could not connect the action buttonPressed: to target of class NSApplication
    5/8/12 2:56:45 PM             FlipShareAutoRun[1148]   Could not connect the action buttonPressed: to target of class NSApplication
    5/8/12 2:56:45 PM             FlipShareAutoRun[1148]   Incompatible applications: app=com.flipvideo.FlipShareAutoRun, targetApp=com.apple.Safari
    5/8/12 2:56:45 PM             com.apple.launchd.peruser.7589[219]        (com.apple.Kerberos.renew.plist) Throttling respawn: Will start in 600 seconds
    5/8/12 2:56:45 PM             tss_check_cifs[1147]         Incompatible applications: app=com.thursby.tss_check_cifs, targetApp=com.apple.Safari
    5/8/12 2:56:45 PM             com.apple.launchd.peruser.7589[219]        (0x100204170.mach_init.VersionCueCS4monitor) Failed to check-in!
    5/8/12 2:56:46 PM             com.thursby.TSSRegistryStore[50]                WARN [0x20aa00] -[Replicator(GroupPolicy) infArrayFromInfData:]: '=' but no assignment?
    5/8/12 2:56:46 PM             com.thursby.TSSRegistryStore[50]                WARN [0x20aa00] -[LDAPKerbConnection(LDAPKerbConnectionGroupPolicyExtensions) groupPolicyEntriesAtDN:]: entryAtDN failed for gPLinkDN 'cn={DEC02046-73EB-4A18-8539-4E45787D6C8F},cn=policies,cn=system,DC=*****,DC=** ***,DC=net', error=Error Domain=LDAPErrorDomain Code=10 UserInfo=0x473b70 "Referral"
    5/8/12 2:56:46 PM             com.thursby.TSSRegistryStore[50]                WARN [0x20aa00] -[LDAPKerbConnection(LDAPKerbConnectionGroupPolicyExtensions) groupPolicyEntriesAtDN:]: entryAtDN failed for gPLinkDN 'cn={CF494306-C9C6-4349-B2BA-707E745C19EC},cn=policies,cn=system,DC=*****,DC=** ***,DC=net', error=Error Domain=LDAPErrorDomain Code=10 UserInfo=0x45cd70 "Referral"
    5/8/12 2:56:46 PM             com.apple.DirectoryServices[15]   [0x100684dd0] priv_searchSync error Error Domain=LDAPErrorDomain Code=-7 UserInfo=0x1006846f0 "Bad search filter"
    5/8/12 2:56:52 PM             com.apple.launchd.peruser.7589[219]        (com.apple.AirPortBaseStationAgent[1146]) Exited: Killed
    5/8/12 2:56:52 PM             com.apple.UserEventAgent-Aqua[1138]     Tue May 8 14:56:52 pdmchi1p06953.local UserEventAgent[1138] <Warning>: CGSShutdownServerConnections: Detaching application from window server
    5/8/12 2:56:52 PM             com.apple.UserEventAgent-Aqua[1138]     Tue May 8 14:56:52 pdmchi1p06953.local UserEventAgent[1138] <Warning>: CGSDisplayServerShutdown: Detaching display subsystem from window server
    5/8/12 2:56:52 PM             com.apple.loginwindow[1019]       Tue May 8 14:56:52 pdmchi1p06953.local loginwindow[1019] <Warning>: CGSShutdownServerConnections: Detaching application from window server
    5/8/12 2:56:52 PM             com.apple.ScreenSharing.server[1141]       Tue May 8 14:56:52 pdmchi1p06953.local AppleVNCServer[1141] <Warning>: CGSShutdownServerConnections: Detaching application from window server
    5/8/12 2:56:52 PM             com.apple.ScreenSharing.server[1141]       Tue May 8 14:56:52 pdmchi1p06953.local AppleVNCServer[1141] <Warning>: CGSDisplayServerShutdown: Detaching display subsystem from window server
    5/8/12 2:56:52 PM             com.apple.loginwindow[1019]       Tue May 8 14:56:52 pdmchi1p06953.local loginwindow[1019] <Error>: kCGErrorFailure: Set a breakpoint @ CGErrorBreakpoint() to catch errors as they are logged.
    5/8/12 2:56:52 PM             com.apple.loginwindow[1019]       Tue May 8 14:56:52 pdmchi1p06953.local loginwindow[1019] <Warning>: CGSDisplayServerShutdown: Detaching display subsystem from window server
    5/8/12 2:56:52 PM             com.apple.launchd.peruser.7589[219]        (com.apple.quicklook) Bug: launchd_core_logic.c:6183 (24498):0
    5/8/12 2:56:52 PM             com.apple.launchd.peruser.7589[219]        Background: Bug: launchd_core_logic.c:6298 (24498):0
    5/8/12 2:56:52 PM             com.apple.launchd.peruser.7589[219]        Bug: launchd_runtime.c:908 (24003):0: job_ack_port_destruction(rights)
    5/8/12 2:56:53 PM             com.apple.WindowServer[1176]    Tue May 8 14:56:53 pdmchi1p06953.local WindowServer[1176] <Error>: kCGErrorFailure: Set a breakpoint @ CGErrorBreakpoint() to catch errors as they are logged.
    5/8/12 2:58:20 PM             com.apple.ReportCrash.Root[1199]             2012-05-08 14:58:20.612 ReportCrash[1199:2b03] Saved crash report for lsregister[1198] version ??? (???) to /Library/Logs/DiagnosticReports/lsregister_2012-05-08-145820_localhost.crash
    5/8/12 2:58:20 PM             com.apple.launchd[1]       (0x100104a80.mach_init.mdworker[1197]) Job appears to have crashed: Segmentation fault
    5/8/12 2:58:20 PM             com.apple.launchd[1]       (0x100104a80.mach_init.mdworker) Failed to check-in!
    5/8/12 2:58:20 PM             com.apple.ReportCrash.Root[1199]             2012-05-08 14:58:20.702 ReportCrash[1199:1407] Saved crash report for mdworker[1197] version ??? (???) to /Library/Logs/DiagnosticReports/mdworker_2012-05-08-145820_localhost.crash
    5/8/12 2:58:20 PM             com.apple.DirectoryServices[15]   [0x100699db0] maxPasswordAge maxPwdAgeStr not found
    5/8/12 2:58:20 PM             com.apple.DirectoryServices[15]   [0x100699db0] priv_searchSync error Error Domain=LDAPErrorDomain Code=-7 UserInfo=0x1006aaf00 "Bad search filter"
    5/8/12 2:58:23 PM             com.thursby.TSSRegistryStore[50]                WARN [0x20aa00] -[Replicator(GroupPolicy) infArrayFromInfData:]: '=' but no assignment?
    5/8/12 2:58:23 PM             com.thursby.TSSRegistryStore[50]                WARN [0x20aa00] -[LDAPKerbConnection(LDAPKerbConnectionGroupPolicyExtensions) groupPolicyEntriesAtDN:]: entryAtDN failed for gPLinkDN 'cn={DEC02046-73EB-4A18-8539-4E45787D6C8F},cn=policies,cn=system,DC=*****,DC=** ***,DC=net', error=Error Domain=LDAPErrorDomain Code=10 UserInfo=0x449e40 "Referral"
    5/8/12 2:58:23 PM             com.thursby.TSSRegistryStore[50]                WARN [0x20aa00] -[LDAPKerbConnection(LDAPKerbConnectionGroupPolicyExtensions) groupPolicyEntriesAtDN:]: entryAtDN failed for gPLinkDN 'cn={CF494306-C9C6-4349-B2BA-707E745C19EC},cn=policies,cn=system,DC=*****,DC=** ***,DC=net', error=Error Domain=LDAPErrorDomain Code=10 UserInfo=0x439a50 "Referral"
    5/8/12 2:58:25 PM             com.apple.launchd[1]       (com.apple.loginwindow[1175]) Job appears to have crashed: Segmentation fault
    5/8/12 2:58:26 PM             com.apple.ReportCrash.Root[1199]             2012-05-08 14:58:26.213 ReportCrash[1199:3593] Saved crash report for Dock[1211] version ??? (???) to /Library/Logs/DiagnosticReports/Dock_2012-05-08-145826_localhost.crash
    5/8/12 2:58:26 PM             com.apple.ReportCrash.Root[1199]             2012-05-08 14:58:26.219 ReportCrash[1199:4407] Saved crash report for loginwindow[1175] version ??? (???) to /Library/Logs/DiagnosticReports/loginwindow_2012-05-08-145826_localhost.crash
    5/8/12 2:58:26 PM             com.apple.ReportCrash.Root[1199]             2012-05-08 14:58:26.227 ReportCrash[1199:420f] Saved crash report for Finder[1213] version ??? (???) to /Library/Logs/DiagnosticReports/Finder_2012-05-08-145826_localhost.crash
    5/8/12 2:58:26 PM             com.apple.ReportCrash.Root[1199]             2012-05-08 14:58:26.234 ReportCrash[1199:3003] Saved crash report for SystemUIServer[1212] version ??? (???) to /Library/Logs/DiagnosticReports/SystemUIServer_2012-05-08-145826_localhost.cras h
    5/8/12 2:58:27 PM             com.apple.WindowServer[1217]    Tue May 8 14:58:27 pdmchi1p06953.local WindowServer[1217] <Error>: kCGErrorFailure: Set a breakpoint @ CGErrorBreakpoint() to catch errors as they are logged.
    5/8/12 2:58:37 PM             com.apple.DirectoryServices[15]   [0x10068b380] priv_searchSync error Error Domain=LDAPErrorDomain Code=-7 UserInfo=0x100646640 "Bad search filter"
    5/8/12 2:58:38 PM             com.thursby.TSSRegistryStore[50]                WARN [0x20aa00] -[Replicator(GroupPolicy) infArrayFromInfData:]: '=' but no assignment?
    5/8/12 2:58:38 PM             com.thursby.TSSRegistryStore[50]                WARN [0x20aa00] -[LDAPKerbConnection(LDAPKerbConnectionGroupPolicyExtensions) groupPolicyEntriesAtDN:]: entryAtDN failed for gPLinkDN 'cn={DEC02046-73EB-4A18-8539-4E45787D6C8F},cn=policies,cn=system,DC=*****,DC=** ***,DC=net', error=Error Domain=LDAPErrorDomain Code=10 UserInfo=0x47fc50 "Referral"
    5/8/12 2:58:38 PM             com.thursby.TSSRegistryStore[50]                WARN [0x20aa00] -[LDAPKerbConnection(LDAPKerbConnectionGroupPolicyExtensions) groupPolicyEntriesAtDN:]: entryAtDN failed for gPLinkDN 'cn={CF494306-C9C6-4349-B2BA-707E745C19EC},cn=policies,cn=system,DC=*****,DC=** ***,DC=net', error=Error Domain=LDAPErrorDomain Code=10 UserInfo=0x47fc80 "Referral"
    5/8/12 2:58:39 PM             edu.mit.Kerberos.CCacheServer[221]          launchctl start error: No such process
    5/8/12 2:58:42 PM             com.apple.launchctl.Aqua[1249]   launchctl: Please convert the following to launchd: /etc/mach_init_per_user.d/com.adobe.versioncueCS4.monitor.plist
    5/8/12 2:58:42 PM             com.apple.launchd.peruser.7589[219]        (com.apple.ReportCrash) Falling back to default Mach exception handler. Could not find: com.apple.ReportCrash.Self
    5/8/12 2:58:43 PM             com.apple.launchd.peruser.7589[219]        (com.apple.Kerberos.renew.plist[1267]) Exited with exit code: 1
    5/8/12 2:58:43 PM             FlipShareAutoRun[1271]   Could not connect the action buttonPressed: to target of class NSApplication
    5/8/12 2:58:43 PM             FlipShareAutoRun[1271]   Could not connect the action buttonPressed: to target of class NSApplication
    5/8/12 2:58:43 PM             FlipShareAutoRun[1271]   Could not connect the action buttonPressed: to target of class NSApplication
    5/8/12 2:58:43 PM             FlipShareAutoRun[1271]   Could not connect the action buttonPressed: to target of class NSApplication
    5/8/12 2:58:43 PM             FlipShareAutoRun[1271]   Incompatible applications: app=com.flipvideo.FlipShareAutoRun, targetApp=com.apple.Safari
    5/8/12 2:58:43 PM             com.apple.launchd.peruser.7589[219]        (com.apple.Kerberos.renew.plist) Throttling respawn: Will start in 600 seconds
    5/8/12 2:58:43 PM             tss_check_cifs[1270]         Incompatible applications: app=com.thursby.tss_check_cifs, targetApp=com.apple.Safari
    5/8/12 2:58:43 PM             com.apple.launchd.peruser.7589[219]        (0x100204170.mach_init.VersionCueCS4monitor) Failed to check-in!
    5/8/12 2:58:43 PM             com.thursby.TSSRegistryStore[50]                WARN [0x20aa00] -[Replicator(GroupPolicy) infArrayFromInfData:]: '=' but no assignment?
    5/8/12 2:58:43 PM             com.thursby.TSSRegistryStore[50]                WARN [0x20aa00] -[LDAPKerbConnection(LDAPKerbConnectionGroupPolicyExtensions) groupPolicyEntriesAtDN:]: entryAtDN failed for gPLinkDN 'cn={DEC02046-73EB-4A18-8539-4E45787D6C8F},cn=policies,cn=system,DC=*****,DC=** ***,DC=net', error=Error Domain=LDAPErrorDomain Code=10 UserInfo=0x4930e0 "Referral"
    5/8/12 2:58:43 PM             com.thursby.TSSRegistryStore[50]                WARN [0x20aa00] -[LDAPKerbConnection(LDAPKerbConnectionGroupPolicyExtensions) groupPolicyEntriesAtDN:]: entryAtDN failed for gPLinkDN 'cn={CF494306-C9C6-4349-B2BA-707E745C19EC},cn=policies,cn=system,DC=*****,DC=** ***,DC=net', error=Error Domain=LDAPErrorDomain Code=10 UserInfo=0x4a8060 "Referral"

    Sign Out When Sign In http://forums.adobe.com/thread/1450581?tstart=0 may help
    -and http://helpx.adobe.com/creative-cloud/kb/unable-login-creative-cloud-248.html
    or
    Chat Now button near the bottom for Activation and Deactivation problems may help
    http://helpx.adobe.com/x-productkb/policy-pricing/activation-deactivation-products.html

  • Is there a way to access remote login and screen sharing logs?

    I have a very high suspicion that my macbook air has been accessed through remote login. Here's what happened. I closed my macbook air, letting it sleep, and left my house. After coming back I found it logged into the Guest account (which I didn't know was enabled). Remote login, Remote sharing and file sharing were enabled but I disabled them. I can't remember enabling them but maybe I did.
    I am also on a local network with about 8 other devices connected. I looked through /private/var/log/system.log but couldn't find anything concrete. I have yet to log out of the guest account and have connected to another internet connection just to be on the safe side. 
    My other user account is passworded and I could switch back to it from guest.
    So if my macbook was accessed through remote login, is there a way to tell from what IP address it came from?
    Please help me get to the bottom of this.

    May 20 13:03:44 XXXXXXXX-MacBook-Air.local loginwindow[51]: ERROR | ScreensharingLoginNotification | Failed sending message to screen sharing GetScreensharingPort, err: 1102
    May 20 13:03:44 XXXXXXXXMacBook-Air.local loginwindow[51]: USER_PROCESS: 51 console
    May 20 19:11:14 XXXXXXXXXXX-MacBook-Air.local loginwindow[51]: ERROR | ScreensharingLoginNotification | Failed sending message to screen sharing GetScreensharingPort, err: 1102
    I guess if it did happen it would have said so. Thanks anyway.

  • Can't login.  Stuck at "Logging in"

    I looked through past posts for a solution but none of them seemed to be exactly what I needed. Recentley my emac started to freeze up when I tried to empty the trash. Soon after I was not able to login and I still cannot login. I tried booting off of the Mac os X disc and repairing the disk and permssions. After repairing I am still not able to login. I tried deleting the auto login preference but that didn't work. There are two users on the computer and I cannot get into either of them. If you have a solution I would appreciate it very much. I'm using Mac OS 10.2.8.

    By your title, I assume that you are stuck at the revolving candycane with the words "Logging in". If so, the following thread sounds similar to your problem and there was a solution, although it took a fair bit of work: Trouble Logging in to OS X.
    EMAC G4 1.0 GHz   Mac OS X (10.3.9)  

  • Login request failed, when logging in from the iPhone simulator.

    Hi all,
    I am currently working on a setup, based on the Co-innovation Architecture with a SUP 2.0 server and SAP Netweaver Mobile 7.1. We have created a SWCV in Netweaver Mobile and deployed it SUP 2.0 and generated Objective C code.
    The iOS 4.3 simulator is able to connect to the SUP server, and the device is registered in the control center, thus a "Login request failed" is thrown.
    Here are the logs from the SUP server:
    2011-11-24 11:45:34 INFO DataServices sup.mbs.10 [com.sybase.vader.mms.DataServiceImpl]9#78311995 supAdmin d1_mypackage_mdc.1_0 (sup.mbs.10) com.sybase.vader.mms.DataServiceImpl::execute:238 - Response From Operation: doec.execute {response={content={}, id=1322131361, pkg=mypackage_MDC:1.0, method=loginFailed, loginFailed=true, log=[{"timestamp":"2011-11-24 11:45:34","message":"No Subscription Found","level":"error","code":404}], cid=9#78311995}, pushTo=sup.mbs.moca.5}
    2011-11-24 11:45:34 DEBUG DOEC sup.mbs.10 [com.sybase.vader.sap.doe.SapDoeConnectorOperation]execute( login ) --> result:
    | cid : 9#78311995 : 10
    | log : [{"timestamp":"2011-11-24 11:45:34","message":"No Subscription Found","level":"error","code":404}]
    | loginFailed : true
    | method : loginFailed : 11
    | pkg : MYPACKAGE_MDC:1.0 : 19
    | id : 1322131361 : 10
    | content : {}
    DOE-C Response Message
    2011-11-24 11:45:34 WARN DOEC sup.mbs.10 [com.sybase.vader.sap.doe.SapDoeConnectorOperation]Login request failed:
    | cid : 9#78311995 : 10
    | pid : moca://SIMULATOR-MAC2SIM2__SUP101 : 33
    | method : login : 5
    | pushTo : sup.mbs.moca.5 : 14
    | pkg : MYPACKAGE_MDC:1.0 : 19
    | ppm : eyJsYW5ndWFnZSI6bnVsbCwidXNlcm5hbWUiOiJzdXBBZG1pbiIsInBhc3N3b3JkIjoiczNwQWRtaW4ifQ== : 84
    | replyTo : sup.mbs.moca.5 : 14
    | upa : *
    | content : {}
    | id : 1322131361 : 10
    2011-11-24 11:45:34 DEBUG DOEC sup.mbs.10 [com.sybase.vader.sap.doe.SapDoeConnectorOperation]execute --> login
    2011-11-24 11:45:34 TRACE DataServices sup.mbs.10 [com.sybase.vader.service.interaction.PipelineCompositeInteractionOperation] 9#78311995 supAdmin d1_mypackage_mdc.1_0 (sup.mbs.10) com.sybase.vader.service.interaction.PipelineCompositeInteractionOperation]Invoking d1_mypackage_mdc_1_0_subscriptions.findSubscriptionByClientInteractionOperationBean.getResult
    It looks like it is the doe-c throwing the error. I am able to ping Netweaver Mobile from the control center, with the tech user defined.
    I hope you have any suggestions.
    /Nima
    Edited by: NimaZandi on Nov 24, 2011 12:48 PM

    Hi Nima,
    Were you able to resolve this issue? I am also facing a similar problem.
    Thanks,
    Krishneel

  • Can't login as an admin, log files are going nuts,HELP!

    The heart of the matter:
    1) About a year ago I realized my ASL log files were growing out of control (about 30gb right now)
    2) I d/led Omni DiskSweeper and Yasu
    3) I started using Yasu regularly and it seemed to keep things a lot cleaner
    4) Suddenly, out of nowwhere I started getting warnings again that my hd was full but
    I couldn't log in as an admin, it rejected the passwords I'd set years ago and I was unable to reset
    to a new password with the startup disk (the new password is never recognized when I reboot)
    5) Yasu completely stopped working, now every time I try to launch it it says
    "error dscl_cmd DS Error -1436 (eDSRecordNotFound (56)"
    I'm not that comfortable getting under the hood or using console. Is a complete reinstall the easiest/only fix? One more wrinkle I d/led MacKeeper recently but found it useless and irritating cause of my login issue so dumped it.
    Thanks so much!

    Regarding MacKeeper, make sure you remove all associated files ...
    To Completely Uninstall and Remove Zeobit's MacKeeper
    Download and Install AppCleaner
    Download and Install Find Any File
    Run AppCleaner
    Click on Applications
    Select MacKeeper
    Click on Search
    Select all results
    Click on Delete
    Run Find Any File
    Search for zeobit
    Select and Delete all results (except for those already in the Trash)
    Search for mackeeper
    Select and Delete all results (except for those already in the Trash)
    Open Up Keychain Access
    Search for zeobit
    Select and Delete all results
    Search for mackeeper
    Select and Delete all results
    Secure Empty Trash
    Reboot
    Unless you perform all of these steps, you'll have remnants of Zeobit's MacKeeper app. I had installed MacKeeper several weeks ago, when I had accidentally deleted some files on my Mac -- hoping to use their "undelete" feature. This was when my nightmare began. Even after using AppCleaner to remove it, there were still some background processes that were running every 10 seconds. While probably harmless, this adds unnnecessary strain on the Mac.
    The key was also using Find Any File and delete any entries in the Keychain Access.
    Download Links
    AppCleaner - http://appcleaner.en.softonic.com/mac
    Find Any File - http://www.macupdate.com/app/mac/30079/find-any-file
    I hope this helps!
    Frank

  • Key Sequence To Return To Login Window Without User Logging Out

    Anyone know the key sequence to return to the login window without requiring the user to log out?
    I know this is possible from the menu bar when you have fast-user switching enabled, but I'm trying to get rid of that menu bar icon but I'm looking for an alternative.

    Create a script in Script Editor with the following:
    do shell script "/System/Library/CoreServices/Menu\\ Extras/User.menu/Contents/Resources/CGSession -suspend"

  • Login window displayed after logging in

    Since I upgraded to Yosemite I have had some problems with the login process.Hope somebody can help!
    Before upgrading I had my Users & Groups preference set to 'Display login window as Name and Password' and everything worked fine. However, since upgrading, when rebooting, I would be given the list of users, even though the preference was still name and password. If I logged in the system would boot, all of my login items would be started and then the name and password login screen would be displayed and I had to login again! I have tried changing the login option to 'List of users' and now I have exactly the same problem but I see the list of users on both occasions! It's a bit of a pain.
    It's not the end of the world as I leave the machine logged in most of the time but I would like to know what the problem is. I have tried resetting the SMC and NVRAM but it hasn't helped. The machine is a 2011 MacBook Pro and both a firmware password and filevault are enabled. I have another issue where my display keeps going to sleep, which is the subject of another thread on the forums, and I suppose this may be related as the preference in that case is to never let the display sleep.
    Any ideas would be gratefully received.
    Thanks,
    S

    Hi,
    Thanks for the reply. Can you please explain why you think this will help before I spend all day Saturday trying it?
    S

  • Ipod touch is disabled with error message to login to Itunes. i log in and device is not recognized as it is disabled. Im stuck in a loop....???

    My iPod touch is disabled with error message to log into ITunes. I log in to ITunes and it does not recognize device as ITouch is disabled. Im stuck in a loop...?
    Any assistance is greatly appreciated.

    Connect the device to your iTunes library in Recovery Mode using the instructions in this Apple support document.  From there restore it factory defaults.
    http://support.apple.com/kb/ht1808
    B-rock

  • I am always prompted to type in a "login" Keychain right after logging onto the computer. How do I disable this?

    I've found Keychain Access in the Utilities folder but I can't seem to turn it off.

    Keychain Access > Preferences > First Aid
    Synchronize login keychain password with account: check
    Set login keychain as default: check
    Keep login keychain unlocked: check

  • Get login screen after I logged in

    When i Login i get the standard background screen and after that a blue one, it stays a few minutes this way and after that i get the login screen again.
    I tried to safeboot but I get redirected to the login screen again.
    Anyone got a solution for this, =S
    zeemeeuw

    This has been mentioned in some of the other threads about this issue, but an Archive and Install from your Leopard Installer DVD will solve this problem.
    I had the same problem and was unable to login to my main working account. All the admin and the other accounts were all okay.
    I did an archive and install, plus installed the updates (huge combo updater) and all is well again. Yeah it is a pain, but this is the first system reinstall since I originally installed Leopard.
    Just make sure to run the Disk Utility Repair Disk before you do this.
    Message was edited by: Zac.

  • How do i remove diffrent login names from yahoo log in on mac

    when I try to login to yahoo from firefox it gives me a drop down list of all old yahoo email names that have been used on this computer

    See:
    * http://kb.mozillazine.org/Deleting_autocomplete_entries
    If it is form data then you can highlight such an entry in the drop down list and press Shift + Delete to remove it.
    If it is saved in the Firefox Password Manager then remove it there:
    * [http://kb.mozillazine.org/Menu_differences Firefox > Preferences] > Security: Passwords: "Saved Passwords" > "Show Passwords"

Maybe you are looking for

  • How can i move music from one account to another

    I have 4 different accounts in Itunes and i wish to move all the music into one account help please !!!!

  • How do I migrate everything from one recent Imac to another, temporarily.

    I have an Imac running Yosemite, with all sorts of programs (Microsoft for MAC, dropbox, filemaker) photoshop, anti virus etc etc) but it needs to go off for repairs (the stand is broken). Fortunately, as its in a business theres an un-used very rece

  • Webutil_File_Transfer.Client_To_DB_With_Progress in Synchronous

    Hi, I am using the the webutil toolkit to do file transfer to and from the database. The webutil_file_transfer.Client_To_DB_With_Progress with the synchronous mode(i.e. asynchronous FALSE) locks the downloaded file from the database. I want to delete

  • Export performance on oracle 9i

    We have newly installed Oracle DB on 2 Linux Servers Perfromance on both is found to be slow as compared to Oracle DB on the other server LINUX The Export activity (for 100K records) in AutoClass on various servers gives following figures: D1- 2min D

  • Public folder in WAS

    Hi everyone, Where in the J2EE engine server should I put files in order to reach them via HTTP protocol (like in IIS server in the wwwroot folder) ? Thanks in advance.