I've been seeing the following log entry in /var/log/mysqld.log and am trying to pinpoint the source of the request:
130313 10:10:48 [Warning] Access denied for user 'admin'@'localhost' (using password: YES)
This started on Monday evening right on 8pm and continued until last night at 23:59:57, once every minute (roughly).
I thought that was the end of it until it started back up again this morning at 10:00:03, again, every minute.
I am running CentOS 5.9 X64 with Plesk 11 and Atomicorp's ASL security system.
I have went through all Cron tasks, none start at 8pm nor 10am and the only hourly ones are run through PHP and don't use admin as the login.
I have also, one by one, disabled services to try to figure it out, the following didn't make a difference when off:
httpd xinetd sshd psmon named crond couriercpd postfix
I have also enabled verbose logging with mySQL using the General Query Log, but it doesn't show anything of use.
Can anyone suggest a way of tracking down the source of these attempted logins? Or even to show the password the system is trying to connect with?
That way, I can figure out if it is friend or foe.