sent by Logwatch usually installled when you setup the OS. - 病毒,防毒,防駭 - 電腦系統討論 - 頂客論壇 ,免費遊戲,免費交友,免費空間,免費部落格,免費相簿,免費開店 - 頂客社區 dk101.com 最用心的華人社群網站
發新話題

[分享] sent by Logwatch usually installled when you setup the OS.

sent by Logwatch usually installled when you setup the OS.

Nothing to worry about these messages. These sent by Logwatch usually installled when you setup the OS.,
Logwatch is a customizable log analysis system. It scans through your system's log files for particular time period, then it generates a report on areas that you specify.

Most CPanel servers come with logwatch installed.
引用:
Can anyone tell me what this means?Im getting emails every couple of days from my server, via logwatch stating:

**Unmatched Entries**
Cp-Wrap[8764]: Pushing "32003 COUNTDBS" to '/usr/local/cpanel/bin/mysqladmin' for
UID: 32003
Cp-Wrap[8764]: CP-Wrapper terminated without error
Cp-Wrap[8767]: Pushing "32003 GETDISK" to '/usr/local/cpanel/bin/mysqladmin' for
UID: 32003
Cp-Wrap[8767]: CP-Wrapper terminated without error
Cp-Wrap[6796]: Pushing "32003 GETDOMAINIP image-upload.org " to
'/usr/local/cpanel/bin/apacheadmin' for UID: 32003
Cp-Wrap[6796]: CP-Wrapper terminated without error
Cp-Wrap[6798]: Pushing "32003 LISTSUBDOMAINS 0 " to
'/usr/local/cpanel/bin/apacheadmin' for UID: 32003
Cp-Wrap[6798]: CP-Wrapper terminated without error
Cp-Wrap[6800]: Pushing "32003 LISTMULTIPARKED 0 " to
'/usr/local/cpanel/bin/apacheadmin' for UID: 32003
Cp-Wrap[6802]: Pushing "32003 COUNTDBS" to '/usr/local/cpanel/bin/mysqladmin' for
UID: 32003
Cp-Wrap[6800]: CP-Wrapper terminated without error
Cp-Wrap[6802]: CP-Wrapper terminated without error
Cp-Wrap[6805]: Pushing "32003 GETDISK" to '/usr/local/cpanel/bin/mysqladmin' for
UID: 32003
Cp-Wrap[6805]: CP-Wrapper terminated without error
Cp-Wrap[16274]: Pushing "32003 RESELLERSUSERS root " to
'/usr/local/cpanel/bin/reselleradmin' for UID: 32003
Cp-Wrap[16276]: Pushing "32003 COUNTDBS" to '/usr/local/cpanel/bin/mysqladmin' for
UID: 32003
Cp-Wrap[16274]: CP-Wrapper terminated without error
Cp-Wrap[16276]: CP-Wrapper terminated without error
Cp-Wrap[16279]: Pushing "32003 GETDISK" to '/usr/local/cpanel/bin/mysqladmin' for
UID: 32003
Cp-Wrap[16279]: CP-Wrapper terminated without error
Cp-Wrap[20604]: Pushing "32003 RESELLERSUSERS root " to
'/usr/local/cpanel/bin/reselleradmin' for UID: 32003
Cp-Wrap[20606]: Pushing "32003 COUNTDBS" to '/usr/local/cpanel/bin/mysqladmin' for
UID: 32003
Cp-Wrap[20604]: CP-Wrapper terminated without error
Cp-Wrap[20606]: CP-Wrapper terminated without error
Cp-Wrap[20609]: Pushing "32003 GETDISK" to '/usr/local/cpanel/bin/mysqladmin' for
UID: 32003
Cp-Wrap[20609]: CP-Wrapper terminated without error
Cp-Wrap[21693]: Pushing "32003 RESELLERSUSERS root " to
'/usr/local/cpanel/bin/reselleradmin' for UID: 32003
Cp-Wrap[21693]: CP-Wrapper terminated without error
Cp-Wrap[21695]: Pushing "32003 COUNTDBS" to '/usr/local/cpanel/bin/mysqladmin' for
UID: 32003
Cp-Wrap[21695]: CP-Wrapper terminated without error
Cp-Wrap[21697]: Pushing "32003 GETDISK" to '/usr/local/cpanel/bin/mysqladmin' for
UID: 32003
Cp-Wrap[21697]: CP-Wrapper terminated without error
Cp-Wrap[21713]: Pushing "32003 RESELLERSUSERS root " to
'/usr/local/cpanel/bin/reselleradmin' for UID: 32003
Cp-Wrap[21715]: Pushing "32003 COUNTDBS" to '/usr/local/cpanel/bin/mysqladmin' for
UID: 32003
Cp-Wrap[21713]: CP-Wrapper terminated without error
Cp-Wrap[21715]: CP-Wrapper terminated without error
Cp-Wrap[21717]: Pushing "32003 GETDISK" to '/usr/local/cpanel/bin/mysqladmin' for
UID: 32003
Cp-Wrap[21717]: CP-Wrapper terminated without error

TOP

回覆 1樓 Kevin 的帖子

Does this logwatch seem concerning?
引用:
################### LogWatch 5.2.2 (06/23/04) ####################
Processing Initiated: Wed Jan 24 04:02:03 2007
Date Range Processed: yesterday
Detail Level of Output: 0
Logfiles for Host: server1.egomzez.com
--------------------- Kernel Begin ------------------------

Logged 871 packets on interface eth0
From 24.64.180.61 - 3 packets to udp(1026,1027,1028)
From 24.138.132.242 - 2 packets to tcp(2100)
From 24.153.204.41 - 1 packet to icmp(0)
From 58.158.35.114 - 2 packets to icmp(0)
From 61.28.129.17 - 2 packets to icmp(0)
From 61.98.229.186 - 2 packets to icmp(0)
From 61.180.228.242 - 1 packet to udp(1027)
From 62.116.180.6 - 2 packets to tcp(41222)
From 63.165.104.6 - 2 packets to tcp(2967)
From 63.175.152.104 - 2 packets to icmp(0)
From 63.237.219.166 - 3 packets to tcp(2967)
From 64.4.111.18 - 1 packet to tcp(2968)
From 64.6.196.132 - 1 packet to tcp(2968)
From 64.8.225.20 - 1 packet to tcp(2968)
From 64.16.62.83 - 3 packets to tcp(2967)
From 64.25.182.98 - 2 packets to tcp(2967)
From 64.31.140.59 - 2 packets to tcp(2967)
From 64.31.246.61 - 4 packets to tcp(2967,5900)
From 64.32.207.246 - 4 packets to tcp(2967,5900)
From 64.33.187.84 - 3 packets to tcp(2967,5900)
From 64.33.225.215 - 2 packets to tcp(2967)
From 64.33.229.64 - 2 packets to tcp(2967)
From 64.33.229.216 - 1 packet to tcp(2967)
From 64.33.230.171 - 2 packets to tcp(2967)
From 64.33.231.14 - 1 packet to tcp(2967)
From 64.34.95.12 - 4 packets to tcp(1089)
From 64.34.165.235 - 1 packet to udp(1434)
From 64.34.165.236 - 1 packet to udp(1434)
From 64.34.197.201 - 15 packets to udp(38293)
From 64.34.197.202 - 3 packets to udp(1434)
From 64.34.197.219 - 25 packets to tcp(3313,4863,62849,2775,4972,11791,60710,2656,169 57,1955,27934)
From 64.34.197.228 - 22 packets to udp(6514)
From 64.34.197.234 - 8 packets to udp(1434)
From 64.34.197.250 - 1 packet to udp(1434)
From 64.34.197.254 - 16 packets to udp(1434,38293)
From 64.34.201.84 - 1 packet to udp(1434)
From 64.34.201.97 - 25 packets to udp(6514)
From 64.34.201.101 - 6 packets to udp(1434)
From 64.34.201.120 - 3 packets to udp(1434)
From 64.129.13.102 - 1 packet to tcp(2967)
From 64.134.30.31 - 1 packet to tcp(2967)
From 64.134.122.47 - 2 packets to tcp(2967)
From 64.136.161.106 - 1 packet to tcp(2968)
From 64.136.242.82 - 1 packet to tcp(2967)
From 64.179.109.150 - 1 packet to tcp(5900)
From 64.203.136.12 - 1 packet to tcp(2967)
From 65.36.71.108 - 1 packet to udp(1026)
From 65.44.37.189 - 1 packet to udp(1026)
From 65.49.25.54 - 1 packet to udp(1026)
From 65.54.233.133 - 1 packet to udp(1026)
From 65.68.253.124 - 1 packet to udp(1026)
From 65.70.184.185 - 1 packet to udp(1026)
From 65.71.81.190 - 1 packet to udp(1026)
From 65.83.209.68 - 1 packet to udp(1026)
From 65.98.119.228 - 1 packet to udp(1026)
From 65.119.65.150 - 1 packet to udp(1026)
From 65.119.145.58 - 1 packet to udp(1026)
From 65.123.174.232 - 1 packet to udp(1026)
From 65.124.253.135 - 1 packet to udp(1026)
From 65.127.37.3 - 1 packet to udp(1026)
From 65.131.191.144 - 1 packet to udp(1026)
From 65.135.133.184 - 1 packet to udp(1026)
From 65.161.157.239 - 1 packet to udp(1026)
From 65.166.44.113 - 1 packet to udp(1026)
From 65.170.230.128 - 1 packet to udp(1026)
From 65.182.252.221 - 1 packet to udp(1026)
From 65.254.254.50 - 6 packets to tcp(40311,41478,41546)
From 65.254.254.51 - 2 packets to tcp(41475)
From 65.254.254.52 - 2 packets to tcp(40324)
From 65.254.254.53 - 6 packets to tcp(40754,41865,42103)
From 65.254.254.54 - 2 packets to tcp(40334)
From 65.254.254.55 - 8 packets to tcp(41543,41825,41843,41859)
From 65.254.254.57 - 2 packets to tcp(41980)
From 66.29.45.248 - 2 packets to tcp(41921)
From 66.42.162.8 - 2 packets to icmp(0)
From 66.111.4.70 - 2 packets to tcp(40417)
From 66.111.4.71 - 8 packets to tcp(40415,40416,40442,41369)
From 66.249.83.27 - 1 packet to tcp(41573)
From 66.249.83.114 - 1 packet to tcp(42286)
From 69.26.178.192 - 3 packets to tcp(41398)
From 69.59.17.25 - 2 packets to tcp(40305)
From 69.158.251.247 - 2 packets to icmp(0)
From 70.98.54.37 - 2 packets to tcp(41971)
From 71.6.187.38 - 2 packets to tcp(41105)
From 71.223.174.3 - 2 packets to icmp(0)
From 90.240.3.228 - 1 packet to tcp(4899)
From 124.52.171.106 - 2 packets to icmp(0)
From 124.165.184.187 - 2 packets to icmp(0)
From 148.244.235.4 - 3 packets to icmp(0)
From 155.212.20.178 - 2 packets to tcp(32000)
From 172.21.1.35 - 1 packet to tcp(40636)
From 172.21.8.7 - 1 packet to tcp(41726)
From 172.21.12.26 - 1 packet to tcp(40054)
From 172.21.12.38 - 1 packet to tcp(40913)
From 172.21.134.13 - 1 packet to tcp(42309)
From 172.21.134.16 - 1 packet to tcp(41575)
From 172.21.134.17 - 1 packet to tcp(41481)
From 172.21.134.20 - 1 packet to tcp(42308)
From 172.21.134.38 - 1 packet to tcp(42302)
From 172.21.134.39 - 1 packet to tcp(41763)
From 172.21.135.10 - 1 packet to tcp(40764)
From 172.21.135.12 - 1 packet to tcp(40784)
From 172.21.135.13 - 1 packet to tcp(41595)
From 172.21.135.18 - 2 packets to tcp(40770,41574)
From 189.152.5.37 - 2 packets to icmp(0)
From 193.135.56.218 - 2 packets to tcp(41193)
From 195.244.198.197 - 2 packets to tcp(41319)
From 200.226.57.205 - 2 packets to icmp(0)
From 200.227.69.128 - 1 packet to icmp(0)
From 201.161.147.6 - 2 packets to icmp(0)
From 201.165.4.112 - 2 packets to icmp(0)
From 202.99.172.175 - 4 packets to udp(1028,1030,4081)
From 203.113.146.76 - 2 packets to icmp(0)
From 204.16.209.110 - 2 packets to udp(1026,1027)
From 204.16.209.120 - 1 packet to udp(1026)
From 204.16.209.130 - 1 packet to udp(1026)
From 204.16.209.140 - 5 packets to udp(1026,1027)
From 204.16.209.159 - 5 packets to udp(1026,1027)
From 204.16.210.20 - 78 packets to udp(1026,1027)
From 204.16.210.30 - 53 packets to udp(1026,1027)
From 204.16.210.42 - 167 packets to udp(1026,1027)
From 204.16.210.50 - 4 packets to udp(1026,1027)
From 204.16.210.60 - 3 packets to udp(1026,1027)
From 204.16.210.70 - 40 packets to udp(1026,1027)
From 204.16.210.130 - 9 packets to udp(1026,1027)
From 204.16.210.150 - 14 packets to udp(1026,1027)
From 204.16.210.202 - 58 packets to udp(1026,1027)
From 204.16.210.204 - 3 packets to udp(1026,1027)
From 204.16.210.207 - 62 packets to udp(1026,1027)
From 206.111.17.226 - 2 packets to tcp(2100)
From 207.190.204.212 - 3 packets to tcp(40756)
From 209.60.61.227 - 2 packets to tcp(5900)
From 209.213.12.167 - 2 packets to tcp(40777)
From 210.55.80.80 - 2 packets to icmp(0)
From 212.17.71.190 - 2 packets to icmp(0)
From 212.227.15.134 - 6 packets to tcp(41113,41219,41331)
From 212.227.15.169 - 4 packets to tcp(41074,41851)
From 212.227.15.186 - 4 packets to tcp(41191,41280)
From 213.166.4.219 - 2 packets to tcp(41238)
From 216.75.3.207 - 2 packets to tcp(40188)
From 216.130.85.3 - 2 packets to tcp(2967)
From 217.160.226.100 - 4 packets to tcp(41110,41253)
From 218.27.194.66 - 9 packets to udp(1026,1027)
From 218.201.150.21 - 2 packets to tcp(7212)
From 219.91.70.213 - 3 packets to tcp(1080)
From 221.124.21.109 - 2 packets to icmp(0)
From 222.170.90.104 - 1 packet to tcp(8080)
From 222.215.119.37 - 1 packet to udp(1032)

---------------------- Kernel End -------------------------


--------------------- Connections (secure-log) Begin ------------------------


**Unmatched Entries**
Cp-Wrap[9135]: Pushing "544 RESELLERSUSERS smyrc " to '/usr/local/cpanel/bin/reselleradmin' for UID: 544
Cp-Wrap[9135]: CP-Wrapper terminated without error
Cp-Wrap[9138]: Pushing "544 GETDOMAINIP smyrc.org " to '/usr/local/cpanel/bin/apacheadmin' for UID: 544
Cp-Wrap[9138]: CP-Wrapper terminated without error
Cp-Wrap[9141]: Pushing "544 LISTSUBDOMAINS 0 " to '/usr/local/cpanel/bin/apacheadmin' for UID: 544
Cp-Wrap[9141]: CP-Wrapper terminated without error
Cp-Wrap[9144]: Pushing "544 LISTMULTIPARKED 0 " to '/usr/local/cpanel/bin/apacheadmin' for UID: 544
Cp-Wrap[9144]: CP-Wrapper terminated without error
Cp-Wrap[9147]: Pushing "544 COUNTDBS" to '/usr/local/cpanel/bin/mysqladmin' for UID: 544
Cp-Wrap[9147]: CP-Wrapper terminated without error
Cp-Wrap[9150]: Pushing "544 LISTDBS" to '/usr/local/cpanel/bin/postgresadmin' for UID: 544
Cp-Wrap[9150]: CP-Wrapper terminated without error
Cp-Wrap[9154]: Pushing "544 GETDISK" to '/usr/local/cpanel/bin/mysqladmin' for UID: 544
Cp-Wrap[9154]: CP-Wrapper terminated without error
Cp-Wrap[10139]: Pushing "544 RESELLERSUSERS smyrc " to '/usr/local/cpanel/bin/reselleradmin' for UID: 544
Cp-Wrap[10139]: CP-Wrapper terminated without error
Cp-Wrap[10141]: Pushing "544 COUNTDBS" to '/usr/local/cpanel/bin/mysqladmin' for UID: 544
Cp-Wrap[10141]: CP-Wrapper terminated without error
Cp-Wrap[10144]: Pushing "544 LISTDBS" to '/usr/local/cpanel/bin/postgresadmin' for UID: 544
Cp-Wrap[10144]: CP-Wrapper terminated without error
Cp-Wrap[10147]: Pushing "544 GETDISK" to '/usr/local/cpanel/bin/mysqladmin' for UID: 544
Cp-Wrap[10147]: CP-Wrapper terminated without error
Cp-Wrap[10366]: Pushing "544 RESELLERSUSERS smyrc " to '/usr/local/cpanel/bin/reselleradmin' for UID: 544
Cp-Wrap[10366]: CP-Wrapper terminated without error
Cp-Wrap[10368]: Pushing "544 COUNTDBS" to '/usr/local/cpanel/bin/mysqladmin' for UID: 544
A:
It looks like someone with access to a botnet is scanning your machine for the available ports or a large number of infected machines out there are doing it without working together. I would be concerned about this but I wouldn't think it is an emergency. My first step would be to put a software firewall on the machine to only allow the ports you need. I may also look at the running process to see if any look "funny". You could also run root kit detection program if you are paranoid

A1:

Quote:
Originally Posted by egomzez
I installed csf firewall and security. But I am not sure how I specific to drop these.

That's a great start. Now you'll need to spend some time tweaking your settings for it. I think the setting you want is this one, near the top of the config page.

# Enable logging of dropped connections to blocked IP addresses in csf.denyor
# by lfd with temporary connection tracking blocks
DROP_IP_LOGGING

Set that to 0

As for ports, CSF is setup with default ports you'd need to have open for cpanel.

TOP

~真是個好東西~謝謝啦~

TOP

發新話題

本站所有圖文均屬網友發表,僅代表作者的觀點與本站無關,如有侵權請通知版主會盡快刪除。