I have a server with MySQL database which is accessible by WordPress. In every 1-2 seconds I see the following in MySQL error.log
[Note] Access denied for user 'root'@'localhost'
There is no password attempt involved as I see it, but my root user has password set.
I am guessing this is some kind of brute force attack. The problem is that I cant figure out which service or script is trying this? My WordPress installation is not using root as user, and from what I saw in one plugin that may be susceptible to it, all SQL queries are in prepared statements.
I have tried tcpdump to sniff packets sent to local port on 3306 but it gave me nothing. How can I find which service or script is trying to access it? Thanks a lot.