1

My Ec2 instance configured with apache2 was running fine and all of a sudden web-server stopped serving pages. I checked all the logs but it didn't help or may i am missing something here. Below are the error logs of apache2

[Mon Jan 12 18:15:49 2015] [error] [client 76.164.202.114] PHP Notice:  Undefined index: categoryname in /data/html/judaism.php on line 11
[Mon Jan 12 18:15:49 2015] [error] [client 76.164.202.114] PHP Notice:  Undefined index: title in /data/html/judaism.php on line 18
[Mon Jan 12 18:16:29 2015] [error] [client 114.124.39.172] PHP Notice:  Undefined variable: link in /data/html/article_emailconfig.php on line 37
[Mon Jan 12 18:16:29 2015] [error] [client 114.124.39.172] PHP Notice:  Undefined variable: link in /data/html/article_emailconfig.php on line 37
[Mon Jan 12 18:16:46 2015] [error] [client 5.44.217.87] File does not exist: /data/html/old
[Mon Jan 12 18:16:56 2015] [error] [client 114.124.39.172] PHP Notice:  Undefined variable: link in /data/html/article_emailconfig.php on line 37
[Mon Jan 12 18:16:56 2015] [error] [client 114.124.39.172] PHP Notice:  Undefined index: urlid in /data/html/friend.php on line 67
[Mon Jan 12 18:16:56 2015] [error] [client 114.124.39.172] PHP Notice:  Undefined variable: link in /data/html/article_emailconfig.php on line 37
[Mon Jan 12 18:17:27 2015] [error] [client 188.165.15.117] PHP Notice:  Undefined index: categoryname in /data/html/judaism.php on line 11
[Mon Jan 12 18:17:27 2015] [error] [client 188.165.15.117] PHP Notice:  Undefined index: title in /data/html/judaism.php on line 18
[Mon Jan 12 18:17:36 2015] [error] [client 120.40.144.203] PHP Notice:  Undefined index: categoryname in /data/html/judaism.php on line 11
[Mon Jan 12 18:17:36 2015] [error] [client 120.40.144.203] PHP Notice:  Undefined index: title in /data/html/judaism.php on line 18
[Mon Jan 12 18:17:39 2015] [error] [client 12.218.42.6] PHP Notice:  Undefined index: categoryname in /data/html/judaism.php on line 11, referer: http://search.pch.com/frontpagesearch?q=shovavim
[Mon Jan 12 18:17:39 2015] [error] [client 12.218.42.6] PHP Notice:  Undefined index: title in /data/html/judaism.php on line 18, referer: http://search.pch.com/frontpagesearch?q=shovavim
[Mon Jan 12 18:17:45 2015] [error] [client 66.249.67.27] script '/data/html/go.php' not found or unable to stat
[Mon Jan 12 18:17:57 2015] [error] [client 46.165.222.7] PHP Notice:  Undefined index: categoryname in /data/html/judaism.php on line 11
[Mon Jan 12 18:17:57 2015] [error] [client 46.165.222.7] PHP Notice:  Undefined index: title in /data/html/judaism.php on line 18
[Mon Jan 12 18:18:31 2015] [error] [client 66.249.67.35] script '/data/html/go.php' not found or unable to stat
[Mon Jan 12 18:18:36 2015] [error] [client 171.113.243.6] PHP Notice:  Undefined index: categoryname in /data/html/judaism.php on line 11
[Mon Jan 12 18:18:36 2015] [error] [client 171.113.243.6] PHP Notice:  Undefined index: title in /data/html/judaism.php on line 18
[Mon Jan 12 19:05:14 2015] [notice] caught SIGTERM, shutting down
[Mon Jan 12 19:05:33 2015] [notice] Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3.14 with Suhosin-Patch configured -- resuming normal operations
[Mon Jan 12 19:05:33 2015] [error] [client 87.253.132.202] script '/data/html/virtualjerusalem_rss.php' not found or unable to stat
[Mon Jan 12 19:05:33 2015] [error] [client 87.253.132.202] script '/data/html/virtualjerusalem_rss.php' not found or unable to stat
[Mon Jan 12 19:05:51 2015] [error] [client 66.249.67.27] script '/data/html/food/MOVED/Soup_minestrone.php' not found or unable to stat
[Mon Jan 12 19:06:09 2015] [error] [client 87.253.132.203] script '/data/html/virtualjerusalem_rss.php' not found or unable to stat
[Mon Jan 12 19:06:10 2015] [error] [client 87.253.132.203] script '/data/html/virtualjerusalem_rss.php' not found or unable to stat
[Mon Jan 12 19:06:10 2015] [error] [client 66.249.67.133] script '/data/html/virtualjerusalem_rss.php' not found or unable to stat

I have lost logs of almost 45-47 Minutes. Can someone help me with this?

1

Seems like your server was down for those 45 minutes. Try to restart your server:

/etc/init.d/apache2 restart

If the problem persists, try a full reboot.

If the problem is gone, apache might have crashed - there was a bug in apache 2.2 (very old, resolved years ago https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=398223)

If the problem persists, Do you have a system image from before the collapse? If so, comparison of configuration files may tell us if something was tempered with your server. If you have an SSH server there, check

/var/log/auth.log

there may be other files:

/var/log/auth.log.1
/var/log/auth.log.2.tgz etc

find the one that contains the timeframe of interest and see for anything suspicious there.

  • Thanks That helped a lot. It was ftp hack attempt. Thanks for the support. – Shailesh Sutar Jan 14 '15 at 14:32
  • if you don't need ftp services it's a good idea to disable ftp server. Same goes for other services you don't need. A STRONG advice - if you are not 100% sure the hacking failed, clear up the server completely and make a clean install. Also install tripwire - an intrusion detection tool. – user3002166 Jan 14 '15 at 15:26

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.