user session closed prematurely

From: Wally Haverschmidt (wally_at_haverschmidt.com)
Date: 10/01/03 

Date: Wed, 01 Oct 2003 11:53:24 -0400

I have a strange issue that I have not been able to crack. At 10:50am
each and every day all the users that are working (via telnet) on
a redhat 7.1 server are booted off. The receive a message on the
screen that their connection is closed by host.

I cannot find anything giving any indication of what process is
kicking off at that time nor is there anything that indicates that
the users connections are being closed.

This system has run fine for well over a year. The only thing that
has recently changed is that a new firewall (linux) box was added
to the network at around the same time as the problems began
occuring.

I can't provide anymore specific information becasue I do not know
where to begin. I've checked all the possible cron jobs to see
if anything is getting kicked off at that time and there is nothing
anywhere close. /var/log/messages tells me squat more than I already
know.

Any and all advice on how/where to start looking would be appreciated.