I don't think this really has anything to do with XRootD and I see no
reason why Briuan would say so. It might have something to do with DPM but
if it does it would not be an XRootD issue either. Unfortuantely, I also
do not know how to configure systemd to stop the forwarding.
On Wed, 30 Mar 2022, Bockjoo Kim wrote:
> Brian replied with this:
>
> "
>
> If I had to take a guess,|libcurl|is dumping the response from DPM to stdout,
> stdout is being picked up by systemd, and systemd is forwarding this to
> syslog. I would open a ticket with XRootD (should be a simple fix) but you
> can probably override the systemd unit so the logs don't get forwarded in
> that way.
>
> "
>
> I am not sure how to override the systemd unit.
>
> Bockjoo
>
> On 3/22/22 7:15 PM, Bockjoo Kim wrote:
>> The HTML messages come from only DPM sites:
>>
>> [root@cmsio8 ~]# grep "<p>Resource" /var/log/messages | sed
>> "s#sfn=#\nsfn=#g" | grep sfn= | sed "s#%2F# #g" | awk '{print $1" "$2"
>> "$3}' | sort -u
>> sfn= dpm grid.nchc.org.tw
>> sfn= dpm ihep.ac.cn
>> sfn= dpm in2p3.fr
>> sfn= dpm indiacms.res.in
>>
>> Thanks,
>>
>> Bockjoo
>>
>> On 3/22/22 5:34 PM, Matevz Tadel wrote:
>>> Hmmh, I don't think cmssw has much to do with this, either :)
>>>
>>> If it's in syslog from a running xrootd it is probably coming from some
>>> plugin.
>>> I remember lcmaps used to put auth errors into syslog.
>>>
>>> I'd guess it has something to do with tokens -- as it reports Created
>>> resource
>>> ... file-name ... token=xyzz.
>>>
>>> Cheers,
>>> Matevz
>>>
>>> On 3/22/22 14:06, Andrew Hanushevsky wrote:
>>>> Hi Bockjoo,
>>>>
>>>> This appears to have nothing to do with xrootd but cmssw, instead. Please
>>>> contact the cmssw developers.
>>>>
>>>> Andrew
>>>>
>>>> On Tue, 22 Mar 2022, Bockjoo Kim wrote:
>>>>
>>>>> Hi,
>>>>>
>>>>> In the syslog, there are the html messages that trigger some security
>>>>> alert.
>>>>> The messages look like:
>>>>>
>>>>> Mar 19 20:48:06 cmsio8 xrootd[14852]: <!DOCTYPE HTML PUBLIC
>>>>> "-//IETF//DTD HTML
>>>>> 2.0//EN">
>>>>>
>>>>> Mar 19 20:48:06 cmsio8 xrootd[14852]: <html><head>
>>>>>
>>>>> Mar 19 20:48:06 cmsio8 xrootd[14852]: <title>201 Created</title>
>>>>>
>>>>> Mar 19 20:48:06 cmsio8 xrootd[14852]: </head><body>
>>>>>
>>>>> Mar 19 20:48:06 cmsio8 xrootd[14852]: <h1>Created</h1>
>>>>>
>>>>> Mar 19 20:48:06 cmsio8 xrootd[14852]: <p>Resource
>>>>> /data01/cms/2022-03-20/ggtree_mc_1452.root.49084.1647737262?sfn=%2Fdpm%2Fgrid.nchc.org.tw%2Fhome%2Fcms%2Fstore%2Fgroup%2Fphys_s
>>>>>
>>>>>
>>>>> mp%2FggNtuples%2F13TeV%2Fmc%2FV10_06_20_00%2Fjob_UL17_DYJetsToLL_m50_aMCatNLO%2FDYJetsToLL_M-50_TuneCP5_13TeV-amcatnloFXFX-pythia8%2Fcrab_job_UL17_DYJetsToLL_m50_aMCatNLO%2F2203
>>>>>
>>>>>
>>>>> 19_115430%2F0001%2Fggtree_mc_1452.root&token=2bQDtqshnuQqRYesF89MpBQACps%3D%401647738262%401
>>>>> has been created.</p>
>>>>>
>>>>> Mar 19 20:48:06 cmsio8 xrootd[14852]: </body></html>
>>>>>
>>>>> Mar 19 21:58:15 cmsio8 xrootd[14852]: :-) <!DOCTYPE html>
>>>>>
>>>>> Mar 19 21:58:15 cmsio8 xrootd[14852]: <html lang="en">
>>>>>
>>>>>
>>>>> How can I suppress or get rid of these?
>>>>> Thanks,
>>>>> Bockjoo
>>>>>
>>>>>
>>>>> ########################################################################
>>>>> Use REPLY-ALL to reply to list
>>>>>
>>>>> To unsubscribe from the XROOTD-L list, click the following link:
>>>>> <a
>>>>> href="https://urldefense.proofpoint.com/v2/url?u=https-3A__listserv.slac.stanford.edu_cgi-2Dbin_wa-3FSUBED1-3DXROOTD-2DL-26A-3D1&d=DwQBAg&c=-35OiAkTchMrZOngvJPOeA&r=f2PhPg2_OoVvPAKGXfp4WG1YcdhQC9qsy2uMHw3Z_6k&m=icCUH9VtISTCRKeJF-Bcz-nbaCUb_DeaiMD-b3AVC4dc51RXZqlgd2GAAg5eVOxd&s=CV0H_o7l2bm5TjWU0a_bZMu1oLUNetyd1DBKuIMysL8&e=">https://listserv.slac.stanford.edu/cgi-bin/wa?SUBED1=XROOTD-L&A=1</a>
>>>>>
>>>>>
>>>> ########################################################################
>>>> Use REPLY-ALL to reply to list
>>>>
>>>> To unsubscribe from the XROOTD-L list, click the following link:
>>>> <a
>>>> href="https://urldefense.proofpoint.com/v2/url?u=https-3A__listserv.slac.stanford.edu_cgi-2Dbin_wa-3FSUBED1-3DXROOTD-2DL-26A-3D1&d=DwQBAg&c=-35OiAkTchMrZOngvJPOeA&r=f2PhPg2_OoVvPAKGXfp4WG1YcdhQC9qsy2uMHw3Z_6k&m=icCUH9VtISTCRKeJF-Bcz-nbaCUb_DeaiMD-b3AVC4dc51RXZqlgd2GAAg5eVOxd&s=CV0H_o7l2bm5TjWU0a_bZMu1oLUNetyd1DBKuIMysL8&e=">https://listserv.slac.stanford.edu/cgi-bin/wa?SUBED1=XROOTD-L&A=1</a>
>>>>
>
> ########################################################################
> Use REPLY-ALL to reply to list
>
> To unsubscribe from the XROOTD-L list, click the following link:
> https://listserv.slac.stanford.edu/cgi-bin/wa?SUBED1=XROOTD-L&A=1
########################################################################
Use REPLY-ALL to reply to list
To unsubscribe from the XROOTD-L list, click the following link:
https://listserv.slac.stanford.edu/cgi-bin/wa?SUBED1=XROOTD-L&A=1
