Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been seeing the following log entry in /var/log/mysqld.log and am trying to pinpoint the source of the request:

130313 10:10:48 [Warning] Access denied for user 'admin'@'localhost' (using password: YES)

This started on Monday evening right on 8pm and continued until last night at 23:59:57, once every minute (roughly).

I thought that was the end of it until it started back up again this morning at 10:00:03, again, every minute.

I am running CentOS 5.9 X64 with Plesk 11 and Atomicorp's ASL security system.

I have went through all Cron tasks, none start at 8pm nor 10am and the only hourly ones are run through PHP and don't use admin as the login.

I have also, one by one, disabled services to try to figure it out, the following didn't make a difference when off:

httpd xinetd sshd psmon named crond couriercpd postfix

I have also enabled verbose logging with mySQL using the General Query Log, but it doesn't show anything of use.

Can anyone suggest a way of tracking down the source of these attempted logins? Or even to show the password the system is trying to connect with?

That way, I can figure out if it is friend or foe.


share|improve this question
up vote 0 down vote accepted

Apparently, since the source of the connection is made through a socket, neither mySQL or any Linux Kernel can identify the source.

I'm now working with Atomicorp ( as they are developing a kernel patch which will allow this to be traced in the future.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.