Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Just had a confusing couple of minutes! I was monitoring a screen (the gnu screen) running "netstat -a" and I noticed that there was one connection connected to http (port 80), fine. But when I checked my apache logs there's nothing! Neither there is in any other log files I've checked (message, secure, I've watched them all).

My system is running the latest CentOS with all the latest (as of yesterday) patches. The netstat -a output looked like follows: (I only noticed TIME_WAITs , never established new or anything else)

tcp        0      0 ::ffff:internalserverip:http    externaluserip:61215         TIME_WAIT

I've now blocked the IP and it keeps requesting my server (gets SYN_SENT in netstat now), so I guess it is some kind of bot! Do you guys have any idéa what it could be and where I can find logs on the requests?!

Thanks!

share|improve this question
    
Well this was embarasing! The output in netstat was caused by an internal script which a user did not inform me about. –  Armer Dec 5 '12 at 18:09

1 Answer 1

Well, if someone connects to your web server, it doesn't mean that there should be some entry in your logs.

For example, using this command will create a connection to your server, but won't put any entry in the logs

telnet server-ip 80

And if the used just quit from the telnet session, there will be a entry in the netstat output.

share|improve this answer
    
Oh, my bad, looks like I didn't notice before answering that you already got the reason for your problem :( –  GeekRide Dec 5 '12 at 18:48

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.