I keep seeing this message on the console every so often:

10-11-2004 11:54:51 am: NMAS-2.65-14
NMAS.NLM intruder detection locked user account admin.O=whatever

this message repeats itself every 5 seconds or so for about 2 to 3 min's.
when I goto the admin account to see the address that is listed in the
intruder lockout all I see is 12. is this a connection number or something

anyway is there a log or something somewhere that I can see the ip address
of the incoming host ( if this is an attempt to access the system from the
outside) or to see which ip (internal) it is coming from so I can have a
"talk" with that user???

oh ya the important stuff:

Novell NetWare 6.5
Support Pack Revision 01
(C) Copyright 1983-2003 Novell Inc. All Rights Reserved. Patent Pending.
Server Version 5.70.01 December 11, 2003
Novell eDirectory Version 8.7.3 SMP
NDS Version 10550.98 December 2, 2003

BM 35_g03

thanks in advance