sos at zjod.net
Sun Jan 21 19:11:20 UTC 2007
Jeffrey Ross wrote:
> When logwatch reports that a host probed the server, what information
> does it use to determine that? I tried to grep for the IP address that
> did the probing in /var/log/* and came up empty handed.
It would be helpful if you reproduced the relevant portion of logwatch's
I've only seen "probed the server" output from logwatch in conjunction
with httpd reporting (ie: in the "-- httpd Begin --"/"-- httpd End --"
part of the report).
If what you're seeing isn't in that part of your logwatch report, then
this probably isn't what's going on.
However, if it is, then you need to look for the IP address of the site
that probed your server in the log file that records hits. In apache on
Fedora, that's normally /var/log/httpd/access_log.
Hope this helps,
More information about the users