LSM Alert

[hsilamot]

I'm receibing lots of LSM Alerts, but i can not track user who is starting them

they look like this:
Following is a summary of new Internet Server Sockets:
> tcp 0 0 69.50.209.134:53071 0.0.0.0:* LISTEN -


> tcp 0 0 69.50.208.138:37744 0.0.0.0:* LISTEN -
> tcp 0 0 69.50.208.138:62413 0.0.0.0:* LISTEN -

> tcp 0 0 69.50.209.130:58929 0.0.0.0:* LISTEN -

> tcp 0 0 69.50.208.138:14731 0.0.0.0:* LISTEN -
> tcp 0 0 69.50.209.130:2788 0.0.0.0:* LISTEN -

> tcp 0 0 69.50.209.130:3717 0.0.0.0:* LISTEN -
> tcp 0 0 69.50.209.58:6153 0.0.0.0:* LISTEN -

don't know who is listening but when i receibe alert port is closed

 

[vavayi]

Try this

chown -R named:named /var/named