Track down

Hello all,

I am trying to track down the source of a large amount of IRC traffic from
one of my clients servers. It is a RedHat 7.2 machine. While I am logged on
using SSH, I am getting the following message every couple of minutes or so
and I was wondering if I could get some opinions as to what is going on. As
well, any insight as to how I can best track down the source of this IRC
traffic would also be appreciated.

[[email protected] 28717]#
Message from [email protected] at Sun Dec 14 21:40:00 2003 ...
kumatage

I also have the following message repeatedly in my log file:

78>Dec 14 21:30:00 CROND[29221]: (root) CMD (/usr/lib/sa/sa1 1 1)

Any help would be very much appreciated. My experience when it comes to
tracking down intruders is not very deep so help is indeed needed.

Best,

Dave

David Filchak
President - Zuka Inc.
art | technology | strategy | solutions
www.zuka.net | www.screamingmedia.ca
_______________________________________________
LinuxManagers mailing list - http://www.linuxmanagers.org
submissions: LinuxManagers-35TzE1X9F6582KRnZfj+bdi2O/[email protected]
subscribe/unsubscribe: http://www.linuxmanagers.org/mailman/listinfo/linuxmanagers