[CentOS] Interpreting logwatch

Timothy Murphy

gayleard at eircom.net
Wed Sep 8 12:33:18 UTC 2010


Every few days I see in the logwatch on my Centos-5.5 web-server
what seems like a rather feeble break-in attempt.
Eg today I see
---------------------------
    403 Forbidden
       /phpMyAdmin/scripts/setup.php: 2 Time(s)
       /phpmyadmin/scripts/setup.php: 2 Time(s)
    404 Not Found
       /PMA2005/scripts/setup.php: 1 Time(s)
       /TRAD_files/datestamp.js: 1 Time(s)
...
---------------------------
followed by dozens of similar lines.

As far as I can see, the IP of the person making the attempt
(if there was an attempt) is not given.

I'm not at all sure what if anything I should do about this.

In fact, I'm not clear how one should deal with logwatch entries
in general.
Is there any document giving advice on this?


-- 
Timothy Murphy  
e-mail: gayleard /at/ eircom.net
tel: +353-86-2336090, +353-1-2842366
s-mail: School of Mathematics, Trinity College, Dublin 2, Ireland




More information about the CentOS mailing list