I have an OS X 10.7.5 machine on my home network with the built-in screen sharing turned on. I connect to it from work with the built-in OS X Screen Sharing app, so it's essentially a VNC connection using the default Apple client/server software on the default port 5900.
These connections show up in /var/log/secure.log like this:
Jan 15 10:16:41 MyServer screensharingd: Authentication: SUCCEEDED
Jan 15 10:21:35 MyServer screensharingd: Authentication: FAILED
But when I look at my traffic logs (using PRTG Network Monitor), I see frequent port 5900 connections to that machine that don't correspond with any secure.log entry.
Where might those connection attempts be logged? Is there something other than screensharingd that might be handling port 5900 traffic?