[PLUG] Understanding Logwatch Entry

[chris (fool) mccraw]

On Thu, Mar 26, 2009 at 06:00, Rich Shepard <rshepard at appl-ecosys.com> wrote:
>   I don't know how to interpret this section from logwatch:
>
>  Refused Connections:
>     Service in.comsat:
>        localhost.localdomain (127.0.0.1): 235 Time(s)
>
>   In ~/.bash_profile biff is set to 'n'. Does the above mean someone
> external tried to log in via ssh claiming their computer was
> 'localhost.localdomain'?

I think the explanation is far simpler.

>From the log file you posted at my request earlier this week:

> procmail: Notified comsat: "rshepard at 451980:/home/rshepard/mail/INBOX"

which should be harmless, comsat service running or not.