Strange system.log entries. Have I been compromised? Related to ARD

Every two minutes my system.log posts a new entry that I am having a UDP WritePacket error 65 and it looks as if its trying to connect to a range of IP's that are hosted by pacbell. I do not have any systems outside my network on my ARD so not sure what the heck is going on. Here is a copy of the messages:
Mar 24 15:06:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.33
Mar 24 15:06:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.64
Mar 24 15:06:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.95
Mar 24 15:06:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.174
Mar 24 15:06:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.27
Mar 24 15:06:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.161
Mar 24 15:06:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.98
Mar 24 15:06:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.126
Mar 24 15:06:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.61
Mar 24 15:06:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.130
Mar 24 15:06:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.67
Mar 24 15:06:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.51
Mar 24 15:06:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.92
Mar 24 15:06:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.74
Mar 24 15:06:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.57
Mar 24 15:07:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.179
Mar 24 15:07:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.45
Mar 24 15:07:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.90
Mar 24 15:07:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.14
Mar 24 15:07:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.48
Mar 24 15:07:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.88
Mar 24 15:07:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.229
Mar 24 15:07:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.69
Mar 24 15:07:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.37
Mar 24 15:07:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.54
Mar 24 15:07:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.84
Mar 24 15:07:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.23
Mar 24 15:07:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.79
Mar 24 15:07:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.173
Mar 24 15:07:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.149
Mar 24 15:07:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.80
Mar 24 15:07:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.53
Mar 24 15:07:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.21
Mar 24 15:07:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.86
Mar 24 15:07:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.111
Mar 24 15:07:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.168
Mar 24 15:07:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.44
Mar 24 15:07:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.40
Mar 24 15:07:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.124
Mar 24 15:07:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.29
Mar 24 15:07:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.166
Mar 24 15:07:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.133
Mar 24 15:07:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.56
Mar 24 15:08:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.33
Mar 24 15:08:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.64
Mar 24 15:08:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.95
Mar 24 15:08:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.174
Mar 24 15:08:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.27
Mar 24 15:08:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.161
Mar 24 15:08:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.98
Mar 24 15:08:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.126
Mar 24 15:08:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.61
Mar 24 15:08:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.130
Mar 24 15:08:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.67
Mar 24 15:08:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.51
Mar 24 15:08:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.92
Mar 24 15:08:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.74
Mar 24 15:08:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.57
Mar 24 15:09:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.179
Mar 24 15:09:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.45
Mar 24 15:09:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.90
Mar 24 15:09:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.14
Mar 24 15:09:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.48
Mar 24 15:09:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.88
Mar 24 15:09:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.229
Mar 24 15:09:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.69
Mar 24 15:09:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.37
Mar 24 15:09:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.54
Mar 24 15:09:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.84
Mar 24 15:09:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.23
Mar 24 15:09:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.79
Mar 24 15:09:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.173
Mar 24 15:09:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.149
Mar 24 15:09:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.80
Mar 24 15:09:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.53
Mar 24 15:09:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.21
Mar 24 15:09:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.86
Mar 24 15:09:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.111
Mar 24 15:09:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.168
Mar 24 15:09:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.44
Mar 24 15:09:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.40
Mar 24 15:09:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.124
Mar 24 15:09:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.29
Mar 24 15:09:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.166
Mar 24 15:09:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.133
Mar 24 15:09:00 Kyle ARDAgent [222]: UDPWritePacket error 65 No route to host for -64.168.10.56

There is another post about this about a couple of months ago. The poster figured out that the first number -64 actually could be translated into 192. etc.
and that the computers were not online at the time (laptops etc).
Here is the link..
http://discussions.apple.com/thread.jspa?messageID=2608312&#2608312

Similar Messages

Httpd access_log entry - have I been compromised?

What's going on here? Has my security has been breached? Has someone caused a buffer overflow and then put something on my machine? If so, how could they access my machine?
My knowledge state: I do not have a in depth knowledge of security issues - only that they are important. Every once in a while I look at various logs and try to get an idea about what's happening on my machine.
My setup: macmini networked via airport to netgear wireless router connected via cable modem to Comcast.
Mini and firewall both password protected. Airport connection WEP protected.
OSX Firewall turned on - file sharing, personal file sharing, ichat and missing sync (PDA syncing software) only items enabled; router firewall on, connection restricted to the 3 devices on my LAN.
(If my setup worked as expected, I shouldn't see anything from 24.218.x.x on my system, it should have been stopped by my router...)
The following sequence shows up 3 times in a recent httpd access_log
24.218.83.129 - - [10/Oct/2006:18:50:16 -0400] "GET / HTTP/1.0" 200 5834
24.218.25.110 - - [10/Oct/2006:19:06:24 -0400] "GET / HTTP/1.0" 200 5834
24.218.25.110 - - [10/Oct/2006:19:06:24 -0400] "SEARCH /\x90\xc9\xc9\xc9\xc9\...(lots more \xc9)...\x90\x90\...(lots more \x90)...\x90\x90" 414 343
24.218.25.110 - - [10/Oct/2006:19:06:55 -0400] "POST /vti_bin/_vtiaut/fp30reg.dll HTTP/1.1" 404 307
24.218.83.129 - - [10/Oct/2006:22:43:11 -0400] "GET / HTTP/1.0" 200 5834
24.138.225.33 - - [10/Oct/2006:23:35:46 -0400] "GET / HTTP/1.0" 200 5834

OK well, if you don't need any access to Apache from outside then you should configure it to be inaccessible to the internet.
I use the built-in Terminal editor "pico" to edit the file, which is located at
/private/etc/httpd/httpd.conf.
First, make a backup of your httpd.conf file in case you break something while editing it.
Open httpd.conf and find the line that begins with Listen and then an IP address or hostname. Edit it to look like this:
Listen 127.0.0.1:80
If you find a second "Listen" line that designates port 80, leave it alone. It should already read:
Listen 80
The only "listen" lines in httpd.conf that are not commented out should be:
Listen 127.0.0.1
and
Listen 80
Then Apache will only accept connections from your local machine on port 80. Restart Apache to make your changes take effect. You can test to see if it worked by typing 127.0.0.1 into your web browser. If it worked you should see a default Apache page.
This is all off of the top of my head, but I think it should work. If it doesn't, just restore your original httpd.conf file from your backup and restart apache again and you'll be no worse off than you were before.
If you want to be extra safe, you can also configure your firewall to block INBOUND connections on port 80. Make sure you don't block outbound port 80 or you won't be able to load any external webpages from that computer.
As for the attack deflection code, disregard it if you don't need it. Such hacks can cause mysterious problems in a development environment but work well on a normal server.

Strange System Log Entry

The following sequence keeps repeating every few seconds in the System Log. Does anyone have any ideas as to what it is all about? It appears to be referring to a Python script, but we have not "knowingly" executed any.
Dec 13 13:15:06 host1 com.apple.wikid[28950]: Traceback (most recent call last):
Dec 13 13:15:06 host1 com.apple.wikid[28950]: File "/usr/share/caldavd/bin/twistd", line 21, in <module>
Dec 13 13:15:06 host1 com.apple.wikid[28950]: run()
Dec 13 13:15:06 host1 com.apple.wikid[28950]: File "/usr/share/caldavd/lib/python/twisted/scripts/twistd.py", line 27, in run
Dec 13 13:15:06 host1 com.apple.wikid[28950]: app.run(runApp, ServerOptions)
Dec 13 13:15:06 host1 com.apple.wikid[28950]: File "/usr/share/caldavd/lib/python/twisted/application/app.py", line 379, in run
Dec 13 13:15:06 host1 com.apple.wikid[28950]: runApp(config)
Dec 13 13:15:06 host1 com.apple.wikid[28950]: File "/usr/share/caldavd/lib/python/twisted/scripts/twistd.py", line 23, in runApp
Dec 13 13:15:06 host1 com.apple.wikid[28950]: _SomeApplicationRunner(config).run()
Dec 13 13:15:06 host1 com.apple.wikid[28950]: File "/usr/share/caldavd/lib/python/twisted/application/app.py", line 156, in run
Dec 13 13:15:06 host1 com.apple.wikid[28950]: self.preApplication()
Dec 13 13:15:06 host1 com.apple.wikid[28950]: File "/usr/share/caldavd/lib/python/twisted/scripts/twistdunix.py", line 203, in preApplication
Dec 13 13:15:06 host1 com.apple.wikid[28950]: self.config['prefix'], self.config['nodaemon'])
Dec 13 13:15:06 host1 com.apple.wikid[28950]: File "/usr/share/caldavd/lib/python/twisted/scripts/twistdunix.py", line 113, in startLogging
Dec 13 13:15:06 host1 com.apple.wikid[28950]: logFile = app.getLogFile(logfilename or 'twistd.log')
Dec 13 13:15:06 host1 com.apple.wikid[28950]: File "/usr/share/caldavd/lib/python/twisted/application/app.py", line 410, in getLogFile
Dec 13 13:15:06 host1 com.apple.wikid[28950]: os.path.dirname(logPath))
Dec 13 13:15:06 host1 com.apple.wikid[28950]: File "/usr/share/caldavd/lib/python/twisted/python/logfile.py", line 113, in _init_
Dec 13 13:15:06 host1 com.apple.wikid[28950]: BaseLogFile._init_(self, name, directory, defaultMode)
Dec 13 13:15:06 host1 com.apple.wikid[28950]: File "/usr/share/caldavd/lib/python/twisted/python/logfile.py", line 26, in _init_
Dec 13 13:15:06 host1 com.apple.wikid[28950]: assert os.path.isdir(self.directory)
Dec 13 13:15:06 host1 com.apple.wikid[28950]: AssertionError
Dec 13 13:15:06 host1 com.apple.launchd[1] (com.apple.wikid[28950]): Exited with exit code: 1
Dec 13 13:15:06 host1 com.apple.launchd[1] (com.apple.wikid): Throttling respawn: Will start in 8 seconds

Okay - I also noticed this same issue as propably many others - did little study and found out the reason.
First of all - these should be standard locations, but let's make sure. I found out that wikid keeps it settings in /etc/wikid/wikid.conf - From error messages I checked source of last mention before process ended. Not pasting anything to here, I usually use PHP or C and try to stay away from python but I was able to make something out. Assert is a function that makes a test agains something, if this test's result is true (if I remember my studies right, I rarely use assert) it exits process. Why? Sometimes when programs start they need to make certain checks to avoid crashing - crashing isn't nice..
Anyway, test was for existency of directory where logfile(s) are kept. From same or another source file I also found out about location /etc/wikid, I ofcourse could had checked it from there in the first place, but I liked to follow the code a bit.. There I found file wikid.plist, opened it - a long conf file and finally there it was - logfile(s) are kept in location:
/Library/Logs/wikid
I created this directory and restarted, everything wasn't okay yet, as rights for that directory were incorrect. So I checked com.apple.wikid in LaunchDaemons and found out it runs as user _teamsserver and gid _teamsserver. So I changed rights for that uid and gid and everything was working after that.
Here's what you need to do in terminal to get it working:
#sudo mkdir /Library/Logs/wikid
#sudo chown -R teamsserver:teamsserver /Library/Logs/wikid
Then just restart wikid, there you go. This was my first post and I just created account for this.
Can be marked as SOLVED but 10.5.2 should make sure this directory gets created - either when ever it's missing and wikid is started, or just a empty dir created while upgrading to 10.5.2

Worrying system log entry

Hi guys,
I've been having a look through the system log and have have seen the following message come up a few times:
jnl: journal start/end pointers reset!
What does this mean, and should I be worried?
Thanks

Thanks for the input guys, but I think I've tracked down the cause.
It's my iPod.
I happened to have the console open when I connected my iPod, and lo and behold the following appeared in the log:
Feb 6 08:05:11 Poppy kernel[0]: jnl: journal start/end pointers reset! (jnl 0x1f78d7c; s 0x205800 e 0x205800)
Feb 6 08:05:24 Poppy kernel[0]: jnl: close: flushing the buffer cache (start 0x261000 end 0x265200)
The iPod was set to automatically sync and eject (ie. NOT enabled for disk use) These entries are for the system mounting and unmounting the iPod.
I re-enabled the iPod for disk use. After this, I noticed I had a couple of files still on the iPod from when it'd previously been used as a disk. I deleted those, unmounted the disk and then set it back to auto-sync in iTunes, and now the journal start/end pointers entry doesn't appear in the console.
Hopefully this will come in handy for someone else.
Thanks for your interest
Darren

Strange system log error

Hi everyone.
I'm having some trouble.
Today i saw my system log file have an error going.
its a
iMac AOSNotification[165]: [AOSNotification] XMPP session not connected - no ping sent
and it is coming all day long.
i'm sure it have something to do with MobileMe or some synchronizing thing.
Anyone have an idea of what to do ? I did try to log out and back in on MobileMe.
But it didn't help.
Thx

Hi.
Yes. it is synchronizing with my Notes, Keychains, Bookmarks and Calendar but not with a iPhone
Just the normal MobileMe on the computer. The iPhone is manually synchronized with iTunes and not with MobileMe.
But the strange part is. I even deleted all the MobileMe sync preffs such as
user/Library/Application support/Preferences/host/com.apple.AOSNotification
user/Library/Application support/Preferences/host/com.apple.DotMacSync
user/Library/Application support/Preferences/com.apple.FileSyncAgent.plist
and logged out of MobileMe preffspane in systempreffs.
And it is still giving me the same error in system log ????
Really weird now that i eint logged in ?

Word 2008 & System Log Entries

Whenever I open Word 2008 there is a flood of never ending entries in System Log as long as Word 2008 is open. This is an example:
*Feb 20 14:40:10 Macintosh Microsoft Word[728]: CGBitmapContextGetData: invalid context*
*Feb 20 14:40:40: --- last message repeated 276 times ---*
Are others with Word 2008 and my Mac configuration receiving similar System Log entries?
If so, any suggestions for a solution?

I have that same problem lookin in my console.. can anybody help us out here???

Weird system.log entry

Hi,
since a few days I see appr. 5 minutes after boot thsi system.log entry:
Dec 26 17:03:52 Gullivers-Computer configd[52]: target=enable-network: disabled
Dec 26 17:08:54 Gullivers-Computer kernel[0]: disk0s5: ioctl('
Dec 26 17:09:20 Gullivers-Computer kernel[0]: disk0s5: ioctl('
Dec 26 17:09:33 Gullivers-Computer kernel[0]: disk0s5: ioctl('
Dec 26 17:09:42 Gullivers-Computer kernel[0]: disk0s5: ioctl('
Dec 26 17:09:42 Gullivers-Computer kernel[0]: disk0s5: ioctl('
Dec 26 17:09:42 Gullivers-Computer kernel[0]: disk0s5: ioctl('
Dec 26 17:09:42 Gullivers-Computer kernel[0]: disk0s5: ioctl('
Dec 26 17:09:42 Gullivers-Computer kernel[0]: disk0s5: ioctl('
Dec 26 17:09:44 Gullivers-Computer kernel[0]: disk0s5: ioctl('
Dec 26 17:09:44 Gullivers-Computer kernel[0]: disk0s5: ioctl('
Dec 26 17:09:44 Gullivers-Computer kernel[0]: disk0s5: ioctl('
Dec 26 17:09:44 Gullivers-Computer kernel[0]: disk0s5: ioctl('
Dec 26 17:09:46 Gullivers-Computer kernel[0]: disk0s5: ioctl('
Dec 26 17:09:46 Gullivers-Computer kernel[0]: disk0s5: ioctl('
Dec 26 17:09:46 Gullivers-Computer kernel[0]: disk0s5: ioctl('
Dec 26 17:09:46 Gullivers-Computer kernel[0]: disk0s5: ioctl('
Dec 26 17:09:48 Gullivers-Computer kernel[0]: disk0s5: ioctl('
Dec 26 17:09:48 Gullivers-Computer kernel[0]: disk0s5: ioctl('
Dec 26 17:09:48 Gullivers-Computer kernel[0]: disk0s5: ioctl('
Dec 26 17:09:58 Gullivers-Computer kernel[0]: disk0s5: ioctl('
Dec 26 17:09:59 Gullivers-Computer kernel[0]: disk0s5: ioctl('
Dec 26 17:09:59 Gullivers-Computer kernel[0]: disk0s5: ioctl('
Dec 26 17:09:59 Gullivers-Computer kernel[0]: disk0s5: ioctl('
Dec 26 17:10:06 Gullivers-Computer kernel[0]: disk0s5: ioctl('
Dec 26 17:10:07 Gullivers-Computer kernel[0]: disk0s5: ioctl('
Dec 26 17:10:07 Gullivers-Computer kernel[0]: disk0s5: ioctl('
Dec 26 17:10:07 Gullivers-Computer kernel[0]: disk0s5: ioctl('
Dec 26 17:10:33 Gullivers-Computer kernel[0]: disk0s5: ioctl('
Dec 26 17:18:48 Gullivers-Computer KernelEventAgent[46]: tid 00000000 received VQ_LOWDISK event (4)
Does this point to an upcoming hard disk failure? Or what else could that mean? TechTool pro does not show any errors.
Thanks in advance!

What's the S.M.A.R.T. status on the drive? You can check it on Disk Utility (click on the device, not the volume), or you can use a freeware tool such as [SMARTreporter|http://www.versiontracker.com/dyn/moreinfo/macosx/23232].
And you have probably run the regular Repair Disk/Repair Permissions/etc. routine on it, right?

Strange system log error from Photoshop CS4

Hi.
I keep getting this strange system log error from Photoshop CS4.
It comes after a wile when using PS CS4.
I tried to chance the memory settings and scratch disc to see if that helped. It didn't.
I also checked all my ram for anything bad. 16GB in my Mac Pro Intel OS X 10.5.6
Everything is updated to latest included Adobe apps.
This is the system log error
Apr 7 16:04:03 mugge [0x0-0x28028].com.adobe.Photoshop[305]: *** error: can't allocate region
Apr 7 16:04:03 mugge [0x0-0x28028].com.adobe.Photoshop[305]: *** set a breakpoint in malloc_error_break to debug
Apr 7 16:04:03 mugge [0x0-0x28028].com.adobe.Photoshop[305]: Adobe Photoshop CS4(305,0x6a73720) malloc: *** mmap(size=132911104) failed (error code=12)
Apr 7 16:04:03 mugge [0x0-0x28028].com.adobe.Photoshop[305]: *** error: can't allocate region
Apr 7 16:04:03 mugge [0x0-0x28028].com.adobe.Photoshop[305]: *** set a breakpoint in malloc_error_break to debug
Apr 7 16:04:03 mugge [0x0-0x28028].com.adobe.Photoshop[305]: Adobe Photoshop CS4(305,0x6a73720) malloc: *** mmap(size=132911104) failed (error code=12)
Apr 7 16:04:03 mugge [0x0-0x28028].com.adobe.Photoshop[305]: *** error: can't allocate region
Apr 7 16:04:03 mugge [0x0-0x28028].com.adobe.Photoshop[305]: *** set a breakpoint in malloc_error_break to debug
Apr 7 16:04:03 mugge [0x0-0x28028].com.adobe.Photoshop[305]: Adobe Photoshop CS4(305,0x6a73720) malloc: *** mmap(size=132911104) failed (error code=12)
Apr 7 16:04:03 mugge [0x0-0x28028].com.adobe.Photoshop[305]: *** error: can't allocate region
Apr 7 16:04:03 mugge [0x0-0x28028].com.adobe.Photoshop[305]: *** set a breakpoint in malloc_error_break to debug
Apr 7 16:04:03 mugge [0x0-0x28028].com.adobe.Photoshop[305]: Adobe Photoshop CS4(305,0x6a73720) malloc: *** mmap(size=132911104) failed (error code=12)
Apr 7 16:04:03 mugge [0x0-0x28028].com.adobe.Photoshop[305]: *** error: can't allocate region
Apr 7 16:04:03 mugge [0x0-0x28028].com.adobe.Photoshop[305]: *** set a breakpoint in malloc_error_break to debug
Apr 7 16:04:03 mugge [0x0-0x28028].com.adobe.Photoshop[305]: Adobe Photoshop CS4(305,0x6a73720) malloc: *** mmap(size=132911104) failed (error code=12)
Apr 7 16:04:03 mugge [0x0-0x28028].com.adobe.Photoshop[305]: *** error: can't allocate region
Apr 7 16:04:03 mugge [0x0-0x28028].com.adobe.Photoshop[305]: *** set a breakpoint in malloc_error_break to debug
Apr 7 16:04:03 mugge [0x0-0x28028].com.adobe.Photoshop[305]: Adobe Photoshop CS4(305,0x6a73720) malloc: *** mmap(size=132911104) failed (error code=12)
Apr 7 16:04:03 mugge [0x0-0x28028].com.adobe.Photoshop[305]: *** error: can't allocate region
Apr 7 16:04:03 mugge [0x0-0x28028].com.adobe.Photoshop[305]: *** set a breakpoint in malloc_error_break to debug
Apr 7 16:04:03 mugge [0x0-0x28028].com.adobe.Photoshop[305]: Adobe Photoshop CS4(305,0x6a73720) malloc: *** mmap(size=132911104) failed (error code=12)
Apr 7 16:04:03 mugge [0x0-0x28028].com.adobe.Photoshop[305]: *** error: can't allocate region
Apr 7 16:04:03 mugge [0x0-0x28028].com.adobe.Photoshop[305]: *** set a breakpoint in malloc_error_break to debug
Apr 7 16:04:03 mugge [0x0-0x28028].com.adobe.Photoshop[305]: Adobe Photoshop CS4(305,0x6a73720) malloc: *** mmap(size=132911104) failed (error code=12)
Apr 7 16:04:03 mugge [0x0-0x28028].com.adobe.Photoshop[305]: *** error: can't allocate region
Apr 7 16:04:03 mugge [0x0-0x28028].com.adobe.Photoshop[305]: *** set a breakpoint in malloc_error_break to debug
Apr 7 16:04:03 mugge [0x0-0x28028].com.adobe.Photoshop[305]: Adobe Photoshop CS4(305,0x6a73720) malloc: *** mmap(size=132911104) failed (error code=12)
Apr 7 16:04:03 mugge [0x0-0x28028].com.adobe.Photoshop[305]: *** error: can't allocate region
And it keeps on until i close Photoshop.
Please anybody ?? i cant figure out what this means.
Thx for help.
Erik S

Now i get this system log error ?
Apr 29 14:45:02 mugge [0x0-0x32032].com.adobe.Photoshop[651]: *** error: can't allocate region
Apr 29 14:45:02 mugge [0x0-0x32032].com.adobe.Photoshop[651]: *** set a breakpoint in malloc_error_break to debug
Apr 29 14:45:02 mugge [0x0-0x32032].com.adobe.Photoshop[651]: Adobe Photoshop CS4(651,0x6a73720) malloc: *** mmap(size=132911104) failed (error code=12)
Apr 29 14:45:02 mugge [0x0-0x32032].com.adobe.Photoshop[651]: *** error: can't allocate region
Apr 29 14:45:02 mugge [0x0-0x32032].com.adobe.Photoshop[651]: *** set a breakpoint in malloc_error_break to debug
Apr 29 14:45:02 mugge [0x0-0x32032].com.adobe.Photoshop[651]: Adobe Photoshop CS4(651,0x6a73720) malloc: *** mmap(size=132911104) failed (error code=12)
Apr 29 14:45:02 mugge [0x0-0x32032].com.adobe.Photoshop[651]: *** error: can't allocate region
Apr 29 14:45:02 mugge [0x0-0x32032].com.adobe.Photoshop[651]: *** set a breakpoint in malloc_error_break to debug
Apr 29 14:45:02 mugge [0x0-0x32032].com.adobe.Photoshop[651]: Adobe Photoshop CS4(651,0x6a73720) malloc: *** mmap(size=132911104) failed (error code=12)
Apr 29 14:45:02 mugge [0x0-0x32032].com.adobe.Photoshop[651]: *** error: can't allocate region
Apr 29 14:45:02 mugge [0x0-0x32032].com.adobe.Photoshop[651]: *** set a breakpoint in malloc_error_break to debug
Apr 29 14:45:02 mugge [0x0-0x32032].com.adobe.Photoshop[651]: Adobe Photoshop CS4(651,0x6a73720) malloc: *** mmap(size=132911104) failed (error code=12)
Apr 29 14:45:02 mugge [0x0-0x32032].com.adobe.Photoshop[651]: *** error: can't allocate region
Apr 29 14:45:02 mugge [0x0-0x32032].com.adobe.Photoshop[651]: *** set a breakpoint in malloc_error_break to debug
Apr 29 14:45:02 mugge [0x0-0x32032].com.adobe.Photoshop[651]: Adobe Photoshop CS4(651,0x6a73720) malloc: *** mmap(size=132911104) failed (error code=12)
Apr 29 14:45:02 mugge [0x0-0x32032].com.adobe.Photoshop[651]: *** error: can't allocate region
Apr 29 14:45:02 mugge [0x0-0x32032].com.adobe.Photoshop[651]: *** set a breakpoint in malloc_error_break to debug
Apr 29 14:45:02 mugge [0x0-0x32032].com.adobe.Photoshop[651]: Adobe Photoshop CS4(651,0x6a73720) malloc: *** mmap(size=132911104) failed (error code=12)
Apr 29 14:45:02 mugge [0x0-0x32032].com.adobe.Photoshop[651]: *** error: can't allocate region
Apr 29 14:45:02 mugge [0x0-0x32032].com.adobe.Photoshop[651]: *** set a breakpoint in malloc_error_break to debug
and this from Bridge ???
Apr 29 16:35:45 mugge Adobe Bridge CS4[650]: Adobe Bridge CS4(650,0xb0e8f000) malloc: *** error for object 0x29777980: double free\n*** set a breakpoint in malloc_error_break to debug
Apr 29 16:35:45 mugge Adobe Bridge CS4[650]: Adobe Bridge CS4(650,0xb0e8f000) malloc: *** error for object 0xcb73827b: Non-aligned pointer being freed\n*** set a breakpoint in malloc_error_break to debug
Apr 29 16:35:45 mugge Adobe Bridge CS4[650]: Adobe Bridge CS4(650,0xb0e8f000) malloc: *** error for object 0x29777980: Non-aligned pointer being freed (2)\n*** set a breakpoint in malloc_error_break to debug
Apr 29 16:35:45 mugge [0x0-0x31031].com.adobe.bridge3[650]: Adobe Bridge CS4(650,0xb0e8f000) malloc: *** error for object 0x29777980: double free
Apr 29 16:35:45 mugge [0x0-0x31031].com.adobe.bridge3[650]: *** set a breakpoint in malloc_error_break to debug
Apr 29 16:35:45 mugge [0x0-0x31031].com.adobe.bridge3[650]: Adobe Bridge CS4(650,0xb0e8f000) malloc: *** error for object 0xcb73827b: Non-aligned pointer being freed
Apr 29 16:35:45 mugge [0x0-0x31031].com.adobe.bridge3[650]: *** set a breakpoint in malloc_error_break to debug
Apr 29 16:35:45 mugge [0x0-0x31031].com.adobe.bridge3[650]: Adobe Bridge CS4(650,0xb0e8f000) malloc: *** error for object 0x29777980: Non-aligned pointer being freed (2)
Apr 29 16:35:45 mugge [0x0-0x31031].com.adobe.bridge3[650]: *** set a breakpoint in malloc_error_break to debug
Chris. also read my post just before this one plase. thx

The system/systems - SM7, has/have not been registered in SLM

Hi,
When I go tx DSWP--> Maintenance Optimizer, it shows the error "The system/systems - SM7, has/have not been registered in SLM"
Then I click the help of the message and explain this:
Diagnosis
In order to download and deploy the support packages to the managed systems, these systems should be registered in SLM.
Procedure
1. Run transaction code /TMWFLOW/MOPZCFG;
2. Start the Multiple Software Lifecycle Manager Configuration Assistant;
3. Select an SLM or create a new SLM;
4. Choose "SLM Configuration" and register these systems in the SLM.
The problem is that tx /TMWFLOW/MOPZCFG does not exists!
Any clue?

Hi,
Thank you it works!
But now the thing is that I dont know how to configure the SLM.
Do you have a guide or something like that?
Regards

I have an Iphone 4 iOS 6.1.3 and have read that it is capable to receive the Weather Emergency Alert system. I have also been told that it will not. This is confusing. Can someone at Apple clarify. If it doe not work on this phone is a download available?

I have an Iphone 4 iOS 6.1.3 and have read that it is capable of receiving the Weather Emergency Alert system. I have also been told that it will not. There is no option in Settings / Notifications. This is confusing. Can someone at Apple clarify? If it does not work on this phone is a download available?

Apple usually doesn't participate here, we're just users. Have you done a search for an app for Weather Emergency Alert in the app store? It certainly doesn't come built-in in the iphone.

What does these Apple System Log entries mean?

I have been reading the Apple System Log and the following entries have caught my attention. Can someone tell me what they mean?
2011-08-31 12:55:07 -0400 kernel[0]: IOSurface: buffer allocation size is zero
2011-08-31 12:55:08 -0400 kernel[0]: IOSurface: buffer allocation size is zero
2011-08-31 12:55:09 -0400 kernel[0]: IOSurface: buffer allocation size is zero
2011-08-31 12:58:39 -0400 kernel[0]: IOSurface: buffer allocation size is zero
2011-08-31 12:58:54 -0400 kernel[0]: IOSurface: buffer allocation size is zero
2011-08-31 12:59:03 -0400 kernel[0]: IOSurface: buffer allocation size is zero
2011-08-31 12:59:11 -0400 kernel[0]: IOSurface: buffer allocation size is zero
2011-08-31 12:59:21 -0400 kernel[0]: IOSurface: buffer allocation size is zero
2011-08-31 12:59:30 -0400 kernel[0]: IOSurface: buffer allocation size is zero
2011-08-31 12:59:52 -0400 kernel[0]: IOSurface: buffer allocation size is zero
2011-08-31 13:01:08 -0400 kernel[0]: IOSurface: buffer allocation size is zero
2011-08-31 13:01:24 -0400 kernel[0]: IOSurface: buffer allocation size is zero
2011-08-31 13:06:24 -0400 kernel[0]: IOSurface: buffer allocation size is zero
2011-08-31 13:06:43 -0400 kernel[0]: IOSurface: buffer allocation size is zero
2011-08-31 13:07:12 -0400 kernel[0]: IOSurface: buffer allocation size is zero
2011-08-31 13:07:32 -0400 kernel[0]: IOSurface: buffer allocation size is zero
2011-08-31 13:07:36 -0400 kernel[0]: IOSurface: buffer allocation size is zero
2011-08-31 13:07:39 -0400 kernel[0]: IOSurface: buffer allocation size is zero
2011-08-31 13:08:09 -0400 kernel[0]: IOSurface: buffer allocation size is zero
2011-08-31 13:08:17 -0400 kernel[0]: IOSurface: buffer allocation size is zero
2011-08-31 13:08:25 -0400 kernel[0]: IOSurface: buffer allocation size is zero
2011-08-31 13:08:33 -0400 kernel[0]: IOSurface: buffer allocation size is zero
2011-08-31 13:08:50 -0400 kernel[0]: IOSurface: buffer allocation size is zero
2011-08-31 13:08:56 -0400 kernel[0]: IOSurface: buffer allocation size is zero
2011-08-31 13:09:04 -0400 kernel[0]: IOSurface: buffer allocation size is zero
2011-08-31 13:10:21 -0400 kernel[0]: IOSurface: buffer allocation size is zero
2011-08-31 13:10:22 -0400 kernel[0]: IOSurface: buffer allocation size is zero
2011-08-31 13:10:22 -0400 kernel[0]: IOSurface: buffer allocation size is zero
2011-08-31 13:11:11 -0400 kernel[0]: IOSurface: buffer allocation size is zero
2011-08-31 13:11:12 -0400 kernel[0]: IOSurface: buffer allocation size is zero
2011-08-31 13:11:13 -0400 kernel[0]: IOSurface: buffer allocation size is zero
2011-08-31 13:11:13 -0400 kernel[0]: IOSurface: buffer allocation size is zero
2011-08-31 13:12:03 -0400 kernel[0]: IOSurface: buffer allocation size is zero
2011-08-31 13:12:07 -0400 kernel[0]: IOSurface: buffer allocation size is zero

I find:
kernel: IOSurface: buffer allocation size is zero
appears a lot when I can barely get control of my iMac 27, with constant whirring disk sounds and also often with Pref Sync Client (even if no sync taking place) and Safari Web Content also frequently.
Other alerts include:
kernel: IOSurface: buffer allocation size is zero
[0x0-0xda0da].com.apple.Safari: DVFreeThread - CFMachPortCreateWithPort hack = 0x182080, fPowerNotifyPort= 0x181910
Imran

Help decoding System.log entry

Hello,
Does anyone know what this entry in the System log means?
Jul 23 14:40:19 www fseventsd[43]: failed to make the directory /private/tmp/278/E/.fseventsd (1/Operation not permitted)
Jul 23 14:40:59 www fseventsd[43]: scan_old: bailing out because device mounted @ /private/tmp/278/E has dls 0x0 and dls->fci 0x0
Does it mean I should do anything ... ?
Thanks in advance for the help.

Probably not. fseventsd is the daemon responsible for reading filesystem events from a special device file in /dev/ (basically, from the kernel), and writing those events to log files stored in directories named .fseventsd.
Each filesystem volume that exists and has events associated with it will have a .fseventd directory at its root. For example, take a look in your / directory and you'll see one (to look inside, you'll need to be root or use sudo).
The whole reason for the daemon's existence is so that any other application on the Mac can take advantage of filesystem events without having to read directly from the kernel. Instead, they read from ordinary log files.
What that error is saying is that you have some external disk or disk image (i.e. volume) attaching itself to a directory in /private/tmp, and fseventsd is having problems setting up the proper log file directory in order to make filesystem events work for that volume. The "1/Operation not permitted" message is a standard error code, "1" being the numeric code and "operation not permitted" being the corresponding string code. This error typically means that the underlying filesystem (in this case, your mystery volume) is purposefully denying the creation of the object in a way _other than_ by permissions. For example, there could be a file flag set making the root of the filesystem immutable.
To understand more, it would be helpful to know what is attaching itself to that area in your tmp directory. Regardless, I don't think the errors are much to worry about...

RV325 System Log Entries - Kernel - kernel: wrong ip[0],not_list[0]

Hello,
I have a RV325 Router. Entries in the System Log are mysterious to me and all my search results and reading are not relevant.
The Event-Type is - "Kernel", and the Message is "kernel: wrong ip[0],not_list[0]"
The Log entries occur every few minutes.
Does anyone know what this log entry signifies?
Also, does anyone know how to get an answer to any question from Cisco?
Thanks,
Michael Downs

Hello
yes, there are several existing discussions about same syslog message, like here, here or here, but neither of discussions points to solution.
If you device is still under warranty I would suggest you to open service request to Cisco Small Business Support Center to make this issue fixed permanently.

RV325 System Log Entries - Kernel - kernel: The MAC table overflow. (Neighbour table overflow.)

Hello,
I have a RV325 Router. Entries in the System Log are repeated over and over.
The messages are:
2015-01-20, 04:11:59
Kernel
kernel: The MAC table overflow. (Neighbour table overflow.)
2015-01-20, 04:11:59
Kernel
last message repeated 8 times
2015-01-20, 05:52:19
Kernel
kernel: The MAC table overflow. (Neighbour table overflow.)
Packet traces point to thousands of ARP packets coming from the ISP to my WAN port. Most of the ARP packet sources/destinations are not even close to my ISP DHCP assigned IP.

Hi, Mark.
I'm not an Apache guru, but you may have two different issues here, depending on when the
kernel[0]: file: table is full
message is time-stamped relative to when you issue the
sudo apachectl start command.
1. Looking at the results of this Google search and some others tends to indicate that common causes for httpd could not be started are errors in the /etc/httpd/httpd.conf file.
You might also want to take a look at some of these other Discussions threads and in these "Networking and the Web" Discussion threads.
2. One explanation I've found for kernel[0]: file: table is full is here.
Hope these ideas help.
Good luck!
Dr. Smoke
Author: Troubleshooting Mac® OS X

Strange FTP log entry - FTP LOGIN REFUSED: getpwnam returned null

At the systems log file, I get entries like the following since a few days:
FTP LOGIN REFUSED: getpwnam returned null
Over and over again (three or four per second). System performance is not harmed, anything working in normal parameters.
There are several xftpd processes there causing this behavior - stopping ftp, killing them, restarting ftp solves the problem - and after one day, same situation.
I searched this forum, but haven't found much information. Others seemed to have the problem as well, but either got no reply or have decided to use a different ftp server instead of Apple's one (which is no choice for us).
Any advise would be appreciated.

Others seemed to have the problem as well, but either got no reply or have decided to use a different ftp server instead of Apple's one
Using a different server won't make any difference.
Your machine is being attacked by a hacker trying to get into your FTP server.
Don't be surprised by this. Just about any service that is open to the public internet is going to get probed at some point. All that's happened here is that some bot has detected a FTP server running on your machine and is trying a number of username/password combinations to see if they can log in.
Whether they will or not depends on the number of accounts you have on your server and the strength of their passwords.
Having a different FTP server isn't going to make a difference because the bot doesn't (yet) know what server you're running, it's just opening FTP connections and trying to log in. Any FTP server would respond in the same way.
The solution is to decide whether you really need FTP exposed to the outside world. It really isn't a secure protocol and can be the vector through which other hacks occur. If you don't need it I'd turn it off. If you do need it, consider some way of limiting access (e.g. make it available to LAN clients only and not to the whole internet, or use a VPN.

Strange system.log entries. Have I been compromised? Related to ARD

Similar Messages

Maybe you are looking for