Re: Successful probes of my server

[Rich Fearn]

> Hi,
>
> I'm using Logwatch 5.2.2 and in email today it emailed
> me the following:
> --------------------- httpd Begin
>
> A total of 4 sites probed the server
>   203.218.141.123
>   203.206.246.90
>   203.218.200.154
>
> !!!! 3 possible successful probes
>  /css/phpmyadmin.css.php?js_frame=left&num_dbs=0 HTTP
> Response 200
>
> /css/phpmyadmin.css.php?lang=en-iso-8859-1&js_frame=right
> HTTP Response 200
>
> /css/phpmyadmin.css.php?lang=en-iso-8859-1&js_frame=left&num_dbs=0
> HTTP Response 200
> ---------------------- httpd End
>
> What does this mean exactly?

When logwatch processes your log files, the script responsible for looking
at the Apache logs (which you can find at /etc/log.d/scripts/services/http)
treats every request containing the word 'phpmyadmin' as suspicious. On my
system I can see this at line 113 of the script.

Rich