1

My Ec2 instance configured with apache2 was running fine and all of a sudden web-server stopped serving pages. I checked all the logs but it didn't help or may i am missing something here. Below are the error logs of apache2 

[Mon Jan 12 18:15:49 2015] [error] [client 76.164.202.114] PHP Notice:  Undefined index: categoryname in /data/html/judaism.php on line 11
[Mon Jan 12 18:15:49 2015] [error] [client 76.164.202.114] PHP Notice:  Undefined index: title in /data/html/judaism.php on line 18
[Mon Jan 12 18:16:29 2015] [error] [client 114.124.39.172] PHP Notice:  Undefined variable: link in /data/html/article_emailconfig.php on line 37
[Mon Jan 12 18:16:29 2015] [error] [client 114.124.39.172] PHP Notice:  Undefined variable: link in /data/html/article_emailconfig.php on line 37
[Mon Jan 12 18:16:46 2015] [error] [client 5.44.217.87] File does not exist: /data/html/old
[Mon Jan 12 18:16:56 2015] [error] [client 114.124.39.172] PHP Notice:  Undefined variable: link in /data/html/article_emailconfig.php on line 37
[Mon Jan 12 18:16:56 2015] [error] [client 114.124.39.172] PHP Notice:  Undefined index: urlid in /data/html/friend.php on line 67
[Mon Jan 12 18:16:56 2015] [error] [client 114.124.39.172] PHP Notice:  Undefined variable: link in /data/html/article_emailconfig.php on line 37
[Mon Jan 12 18:17:27 2015] [error] [client 188.165.15.117] PHP Notice:  Undefined index: categoryname in /data/html/judaism.php on line 11
[Mon Jan 12 18:17:27 2015] [error] [client 188.165.15.117] PHP Notice:  Undefined index: title in /data/html/judaism.php on line 18
[Mon Jan 12 18:17:36 2015] [error] [client 120.40.144.203] PHP Notice:  Undefined index: categoryname in /data/html/judaism.php on line 11
[Mon Jan 12 18:17:36 2015] [error] [client 120.40.144.203] PHP Notice:  Undefined index: title in /data/html/judaism.php on line 18
[Mon Jan 12 18:17:39 2015] [error] [client 12.218.42.6] PHP Notice:  Undefined index: categoryname in /data/html/judaism.php on line 11, referer: http://search.pch.com/frontpagesearch?q=shovavim
[Mon Jan 12 18:17:39 2015] [error] [client 12.218.42.6] PHP Notice:  Undefined index: title in /data/html/judaism.php on line 18, referer: http://search.pch.com/frontpagesearch?q=shovavim
[Mon Jan 12 18:17:45 2015] [error] [client 66.249.67.27] script '/data/html/go.php' not found or unable to stat
[Mon Jan 12 18:17:57 2015] [error] [client 46.165.222.7] PHP Notice:  Undefined index: categoryname in /data/html/judaism.php on line 11
[Mon Jan 12 18:17:57 2015] [error] [client 46.165.222.7] PHP Notice:  Undefined index: title in /data/html/judaism.php on line 18
[Mon Jan 12 18:18:31 2015] [error] [client 66.249.67.35] script '/data/html/go.php' not found or unable to stat
[Mon Jan 12 18:18:36 2015] [error] [client 171.113.243.6] PHP Notice:  Undefined index: categoryname in /data/html/judaism.php on line 11
[Mon Jan 12 18:18:36 2015] [error] [client 171.113.243.6] PHP Notice:  Undefined index: title in /data/html/judaism.php on line 18
[Mon Jan 12 19:05:14 2015] [notice] caught SIGTERM, shutting down
[Mon Jan 12 19:05:33 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.14 with Suhosin-Patch configured -- resuming normal operations
[Mon Jan 12 19:05:33 2015] [error] [client 87.253.132.202] script '/data/html/virtualjerusalem_rss.php' not found or unable to stat
[Mon Jan 12 19:05:33 2015] [error] [client 87.253.132.202] script '/data/html/virtualjerusalem_rss.php' not found or unable to stat
[Mon Jan 12 19:05:51 2015] [error] [client 66.249.67.27] script '/data/html/food/MOVED/Soup_minestrone.php' not found or unable to stat
[Mon Jan 12 19:06:09 2015] [error] [client 87.253.132.203] script '/data/html/virtualjerusalem_rss.php' not found or unable to stat
[Mon Jan 12 19:06:10 2015] [error] [client 87.253.132.203] script '/data/html/virtualjerusalem_rss.php' not found or unable to stat
[Mon Jan 12 19:06:10 2015] [error] [client 66.249.67.133] script '/data/html/virtualjerusalem_rss.php' not found or unable to stat

I have lost logs of almost 45-47 Minutes. Can someone help me with this?

Improve this question

1 Answer 1

Reset to default
1

Seems like your server was down for those 45 minutes. Try to restart your server:

/etc/init.d/apache2 restart

If the problem persists, try a full reboot.

If the problem is gone, apache might have crashed - there was a bug in apache 2.2 (very old, resolved years ago https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=398223)

If the problem persists, Do you have a system image from before the collapse? If so, comparison of configuration files may tell us if something was tempered with your server. If you have an SSH server there, check 

/var/log/auth.log

there may be other files:

/var/log/auth.log.1
/var/log/auth.log.2.tgz etc

find the one that contains the timeframe of interest and see for anything suspicious there.

Improve this answer
2
  • Thanks That helped a lot. It was ftp hack attempt. Thanks for the support.
    – Shailesh Sutar
    Jan 14, 2015 at 14:32
  • if you don't need ftp services it's a good idea to disable ftp server. Same goes for other services you don't need. A STRONG advice - if you are not 100% sure the hacking failed, clear up the server completely and make a clean install. Also install tripwire - an intrusion detection tool.
    – user3002166
    Jan 14, 2015 at 15:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .