XCOMN0780E with no message repeated multiple times in xcom.log file

Products

XCOM Data Transport - Windows XCOM Data Transport XCOM Data Transport - Linux PC

Issue/Introduction

Using XCOM for Windows and seeing repeated XCOMN0780E messages in the xcom.log with no TXPI message after them.
XCOM secure/SSL transfers are being used and they are working to/from all partners so these messages appear not to be impacting transfers.

Environment

XCOM™ Data Transport® for Windows
XCOM™ Data Transport® for Linux PC

Resolution

Looking in more detail at the xcom.log the XCOMN0780E only occurs for some remote connections.
Looking at common PID values and after removing some of the intervening lines from the actual XCOM file transfer connections, typically see these groupings of 3 messages:

+++
2021/08/02 14:25:06 TID=REMOTE PRG=xcomtcp PID=15080 IP=###.###.###.###:47797
XCOMN0812I Remote Secure TCP/IP Connection Requested.

2021/08/02 14:25:06 TID=REMOTE PRG=xcomtcp PID=15080 IP=###.###.###.###:47797
XCOMN0780E :

2021/08/02 14:25:06 TID= PRG=xcomtcp PID=15080 IP=###.###.###.###:47797
XCOMN0818I Secure TCP/IP Connection Ended.
+++

+++
2021/08/02 14:25:06 TID=REMOTE PRG=xcomtcp PID=15904 IP=###.###.###.###:47793
XCOMN0812I Remote Secure TCP/IP Connection Requested.

2021/08/02 14:25:06 TID=REMOTE PRG=xcomtcp PID=15904 IP=###.###.###.###:47793
XCOMN0780E :

2021/08/02 14:25:06 TID= PRG=xcomtcp PID=15904 IP=###.###.###.###:47793
XCOMN0818I Secure TCP/IP Connection Ended.
+++

Per above, there also seem to be 2 of those connections per second.
Due to the 2 per second regularity of the messages, they are most likely being generated by a port scanning/health check tool that is regularly polling the secure XCOM port 8045 on the XCOM server.
XCOM receives connection attempts on its ports (8044 (unsecure) and 8045 (secure)) and does not know that they are just port scans (not real transfers) until no data is actually received, so it has to process the initial connection as if it was a transfer.
The only way to eliminate the symptoms completely is stop the port scans. Whatever IP addresses are appearing in the xcom.log for connections which are not file transfers the security team need to check what process(es) they have running which are sending the port scan connections.

To reduce the visibility and impact on the xcom.log growing in size connection message pairs XCOMN0793I/XCOMN0805I and XCOMN0812I/XCOMN0818I can be disabled by setting LOG_CONNECT_MSG to NO in the xcom.glb file and restarting the XCOM service. However the XCOMN0780E (with no message) for the secure port connection would still remain.
For further details please see doc. references
11.6: LOG_CONNECT_MSG
12.0: LOG_CONNECT_MSG

Additional Information

1. Support can also recreate the same 3 message sequence in-house by using a telnet command to port 8045 of the XCOM server i.e. "telnet xcom_server 8045"

+++
2021/08/04 00:27:35 TID=REMOTE PRG=xcomtcp PID=2300 IP=###.###.###.###:65353
XCOMN0812I Remote Secure TCP/IP Connection Requested.

2021/08/04 00:27:39 TID=REMOTE PRG=xcomtcp PID=2300 IP=###.###.###.###:65353
XCOMN0780E :

2021/08/04 00:27:39 TID= PRG=xcomtcp PID=2300 IP=###.###.###.###:65353
XCOMN0818I Secure TCP/IP Connection Ended.
+++

If instead use the telnet command to the insecure port 8044, only the Connection Established & Ended messages appear in the xcom.log and there is no XCOMN0780E message:
+++
2021/08/05 01:40:32 TID=REMOTE PRG=xcomtcp PID=9784 IP=###.###.###.###:61985
XCOMN0793I Remote TCP/IP Connection Established.

2021/08/05 01:40:38 TID= PRG=xcomtcp PID=9784 IP=###.###.###.###:61985
XCOMN0805I TCP/IP Connection Ended.
+++

2. XCOM Data Transport for Windows Messages > XCOMN0780E

3. A similar problem could be seen on UNIX/Linux platforms in which case the message would be: XCOM Data Transport for UNIX/Linux Messages > XCOMU0780E
LOG_CONNECT_MSG also available there.
11.6: LOG_CONNECT_MSG
12.0: LOG_CONNECT_MSG