I wish I knew. I see these types of errors on some of my systems as well, but haven't had a chance to look into it. I was thinking it might be some daemon polling the optical drive to see if media is present, and if it is present mount it. But again, I haven't researched it enough to know for sure. It's an easy and safe log to write an ignore rule for.
On Mon, Apr 26, 2010 at 4:06 AM, Bradley Radjoo <[email protected]> wrote: > Yes indeed Dan. Yip. > > Do you perhaps know why its generating this error, as it happens on many > other of my machines and I am no trying to access the DVD-ROM/CD-ROM drive/s > as I know there is no media in them.... > > > On 23 Apr 2010, at 2:21 PM, dan (ddp) wrote: > >> Is there an optical drive in the system? Does it happen to be hda? >> >> On Fri, Apr 23, 2010 at 8:06 AM, Bradley Radjoo <[email protected]> >> wrote: >>> Hello All, >>> Does anybody know where the below message come from ? >>> And where are they are generated from.....? >>> I don't have an hda device.......? >>> >>> ----- >>> >>> Regards, >>> >>> Bradley Radjoo >>> >>> Anyone who has never made a mistake has never tried anything new. — Albert >>> Einstein. >>> >>> Begin forwarded message: >>> >>> Subject: OSSEC Notification - *servername.exmaple.com* - Alert level 2 >>> >>> OSSEC HIDS Notification. >>> 2010 Apr 23 13:23:30 >>> >>> Received From:servername.example.com->/var/log/messages >>> >>> Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system." >>> Portion of the log(s): >>> >>> Apr 23 13:23:30 servername.example.com hda: packet command error: >>> status=0x51 { DriveReady SeekComplete Error } >>> >>> >>> >>> --END OF NOTIFICATION >>> >>> >>> >>> OSSEC HIDS Notification. >>> 2010 Apr 23 13:23:30 >>> >>> Received From:servername.example.com->/var/log/messages >>> >>> Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system." >>> Portion of the log(s): >>> >>> Apr 23 13:23:30servername.example.com hda: packet command error: error=0x54 >>> { AbortedCommand LastFailedSense=0x05 } >>> >>> >>> --END OF NOTIFICATION >>> >>> >>> >>> OSSEC HIDS Notification. >>> 2010 Apr 23 13:23:30 >>> >>> Received From:servername.example.com->/var/log/messages >>> >>> Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system." >>> Portion of the log(s): >>> >>> Apr 23 13:23:30 servername.example.com ide: failed opcode was: unknown >>> >>> >>> --END OF NOTIFICATION >>> >>> >>> >>> >>> Please note: This email and its content are subject to the disclaimer as >>> displayed at the following link >>> http://www.is.co.za/legal/E-mail+Confidentiality+Notice+and+Disclaimer.htm. >>> Should you not have Web access, send an email to [email protected] and a >>> copy will be sent to you. >> >> >> -- >> Subscription settings: >> http://groups.google.com/group/ossec-list/subscribe?hl=en > > Please note: This email and its content are subject to the disclaimer as > displayed at the following link > http://www.is.co.za/legal/E-mail+Confidentiality+Notice+and+Disclaimer.htm. > Should you not have Web access, send a mail to [email protected] and a > copy will be emailed to you. >
