6 p.m.
Sending logs to a host far far away
Processing logfile /var/log/httpd/access_log-20131213.gz
Pseudo-terminal will not be allocated because stdin is not a terminal.
Address 31.15.26.3 maps to lists.ovirt.org, but this does not map back to the address -
POSSIBLE BREAK-IN ATTEMPT!
Last failed login: Sat Dec 14 22:52:02 UTC 2013 from 61.147.74.149 on ssh:notty
There were 10940 failed login attempts since the last successful login.
Address 31.15.26.3 maps to lists.ovirt.org, but this does not map back to the address -
POSSIBLE BREAK-IN ATTEMPT!
/var/log/httpd/access_log-20131213.gz sent to
stats.ovirt.org:/var/log/awstats/linode01.ovirt.org/
Processing logfile /var/log/httpd/lists.ovirt.org-access_log-20131213.gz
Pseudo-terminal will not be allocated because stdin is not a terminal.
Address 31.15.26.3 maps to lists.ovirt.org, but this does not map back to the address -
POSSIBLE BREAK-IN ATTEMPT!
Last failed login: Sat Dec 14 22:52:02 UTC 2013 from 61.147.74.149 on ssh:notty
There were 10940 failed login attempts since the last successful login.
Address 31.15.26.3 maps to lists.ovirt.org, but this does not map back to the address -
POSSIBLE BREAK-IN ATTEMPT!
/var/log/httpd/lists.ovirt.org-access_log-20131213.gz sent to
stats.ovirt.org:/var/log/awstats/lists.ovirt.org/
Processing logfile /var/log/httpd/resources.ovirt.org-access_log-20131213.gz
Pseudo-terminal will not be allocated because stdin is not a terminal.
Address 31.15.26.3 maps to lists.ovirt.org, but this does not map back to the address -
POSSIBLE BREAK-IN ATTEMPT!
Last failed login: Sat Dec 14 22:52:02 UTC 2013 from 61.147.74.149 on ssh:notty
There were 10940 failed login attempts since the last successful login.
Address 31.15.26.3 maps to lists.ovirt.org, but this does not map back to the address -
POSSIBLE BREAK-IN ATTEMPT!
/var/log/httpd/resources.ovirt.org-access_log-20131213.gz sent to
stats.ovirt.org:/var/log/awstats/resources.ovirt.org/
And they lived happily ever after
2:05 p.m.
New subject: Fwd: Cron <root@linode01> /root/bin/send_stats.sh
This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--fDxuOKNChqG99Jw9gFcPVG8kxkS9HAVli
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
I presume I'm not the only one getting this. I believe the script is one
that I wrote to backup the stats to another machine.
Is this something we can safely turn off? Meaning, stats are now being
gathered and backed-up in another way?
-------- Original Message --------
Subject: Cron <root@linode01> /root/bin/send_stats.sh
Date: Sat, 14 Dec 2013 18:00:02 -0500 (EST)
From: root(a)linode01.ovirt.org (Cron Daemon)
To: root(a)linode01.ovirt.org
Sending logs to a host far far away
Processing logfile /var/log/httpd/access_log-20131213.gz
Pseudo-terminal will not be allocated because stdin is not a terminal.
Address 31.15.26.3 maps to lists.ovirt.org, but this does not map back
to the address - POSSIBLE BREAK-IN ATTEMPT!
Last failed login: Sat Dec 14 22:52:02 UTC 2013 from 61.147.74.149 on
ssh:notty
There were 10940 failed login attempts since the last successful login.
Address 31.15.26.3 maps to lists.ovirt.org, but this does not map back
to the address - POSSIBLE BREAK-IN ATTEMPT!
/var/log/httpd/access_log-20131213.gz sent to
stats.ovirt.org:/var/log/awstats/linode01.ovirt.org/
Processing logfile /var/log/httpd/lists.ovirt.org-access_log-20131213.gz
Pseudo-terminal will not be allocated because stdin is not a terminal.
Address 31.15.26.3 maps to lists.ovirt.org, but this does not map back
to the address - POSSIBLE BREAK-IN ATTEMPT!
Last failed login: Sat Dec 14 22:52:02 UTC 2013 from 61.147.74.149 on
ssh:notty
There were 10940 failed login attempts since the last successful login.
Address 31.15.26.3 maps to lists.ovirt.org, but this does not map back
to the address - POSSIBLE BREAK-IN ATTEMPT!
/var/log/httpd/lists.ovirt.org-access_log-20131213.gz sent to
stats.ovirt.org:/var/log/awstats/lists.ovirt.org/
Processing logfile /var/log/httpd/resources.ovirt.org-access_log-20131213=
=2Egz
Pseudo-terminal will not be allocated because stdin is not a terminal.
Address 31.15.26.3 maps to lists.ovirt.org, but this does not map back
to the address - POSSIBLE BREAK-IN ATTEMPT!
Last failed login: Sat Dec 14 22:52:02 UTC 2013 from 61.147.74.149 on
ssh:notty
There were 10940 failed login attempts since the last successful login.
Address 31.15.26.3 maps to lists.ovirt.org, but this does not map back
to the address - POSSIBLE BREAK-IN ATTEMPT!
/var/log/httpd/resources.ovirt.org-access_log-20131213.gz sent to
stats.ovirt.org:/var/log/awstats/resources.ovirt.org/
And they lived happily ever after
--fDxuOKNChqG99Jw9gFcPVG8kxkS9HAVli
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iD8DBQFSrf122ZIOBq0ODEERAsoWAJ9UmgyFUQGI9dxXCewEDe9qsN2U9ACfbHCL
Eu5b4wIThM7g8VVKdr9G3/E=
=HNtB
-----END PGP SIGNATURE-----
--fDxuOKNChqG99Jw9gFcPVG8kxkS9HAVli--
3:52 p.m.
which stats is this script collecting?
there is the stats.ovirt.org server that has stats on gerrit,ovirt.org,lists and resources
server.
that's a VM sitting on rackspace infra IIRC.
Eyal.
----- Original Message -----
From: "Karsten 'quaid' Wade"
<kwade(a)redhat.com>
To: "infra" <infra(a)ovirt.org>
Sent: Sunday, December 15, 2013 9:05:26 PM
Subject: Fwd: Cron <root@linode01> /root/bin/send_stats.sh
I presume I'm not the only one getting this. I believe the script is one
that I wrote to backup the stats to another machine.
Is this something we can safely turn off? Meaning, stats are now being
gathered and backed-up in another way?
-------- Original Message --------
Subject: Cron <root@linode01> /root/bin/send_stats.sh
Date: Sat, 14 Dec 2013 18:00:02 -0500 (EST)
From: root(a)linode01.ovirt.org (Cron Daemon)
To: root(a)linode01.ovirt.org
Sending logs to a host far far away
Processing logfile /var/log/httpd/access_log-20131213.gz
Pseudo-terminal will not be allocated because stdin is not a terminal.
Address 31.15.26.3 maps to lists.ovirt.org, but this does not map back
to the address - POSSIBLE BREAK-IN ATTEMPT!
Last failed login: Sat Dec 14 22:52:02 UTC 2013 from 61.147.74.149 on
ssh:notty
There were 10940 failed login attempts since the last successful login.
Address 31.15.26.3 maps to lists.ovirt.org, but this does not map back
to the address - POSSIBLE BREAK-IN ATTEMPT!
/var/log/httpd/access_log-20131213.gz sent to
stats.ovirt.org:/var/log/awstats/linode01.ovirt.org/
Processing logfile /var/log/httpd/lists.ovirt.org-access_log-20131213.gz
Pseudo-terminal will not be allocated because stdin is not a terminal.
Address 31.15.26.3 maps to lists.ovirt.org, but this does not map back
to the address - POSSIBLE BREAK-IN ATTEMPT!
Last failed login: Sat Dec 14 22:52:02 UTC 2013 from 61.147.74.149 on
ssh:notty
There were 10940 failed login attempts since the last successful login.
Address 31.15.26.3 maps to lists.ovirt.org, but this does not map back
to the address - POSSIBLE BREAK-IN ATTEMPT!
/var/log/httpd/lists.ovirt.org-access_log-20131213.gz sent to
stats.ovirt.org:/var/log/awstats/lists.ovirt.org/
Processing logfile /var/log/httpd/resources.ovirt.org-access_log-20131213.gz
Pseudo-terminal will not be allocated because stdin is not a terminal.
Address 31.15.26.3 maps to lists.ovirt.org, but this does not map back
to the address - POSSIBLE BREAK-IN ATTEMPT!
Last failed login: Sat Dec 14 22:52:02 UTC 2013 from 61.147.74.149 on
ssh:notty
There were 10940 failed login attempts since the last successful login.
Address 31.15.26.3 maps to lists.ovirt.org, but this does not map back
to the address - POSSIBLE BREAK-IN ATTEMPT!
/var/log/httpd/resources.ovirt.org-access_log-20131213.gz sent to
stats.ovirt.org:/var/log/awstats/resources.ovirt.org/
And they lived happily ever after
_______________________________________________
Infra mailing list
Infra(a)ovirt.org
http://lists.ovirt.org/mailman/listinfo/infra
6:08 p.m.
I wrote this one, is the one that sends the stats to stats.ovirt.org for awstats to
collect, maybe I should send the email somewhere else?
----- Original Message -----
From: "Eyal Edri" <eedri(a)redhat.com>
To: "Karsten 'quaid' Wade" <kwade(a)redhat.com>, "David
Caro" <dcaroest(a)redhat.com>
Cc: "infra" <infra(a)ovirt.org>
Sent: Sunday, December 15, 2013 9:52:35 PM
Subject: Re: Cron <root@linode01> /root/bin/send_stats.sh
which stats is this script collecting?
there is the stats.ovirt.org server that has stats on gerrit,ovirt.org,lists
and resources server.
that's a VM sitting on rackspace infra IIRC.
Eyal.
----- Original Message -----
> From: "Karsten 'quaid' Wade" <kwade(a)redhat.com>
> To: "infra" <infra(a)ovirt.org>
> Sent: Sunday, December 15, 2013 9:05:26 PM
> Subject: Fwd: Cron <root@linode01> /root/bin/send_stats.sh
>
> I presume I'm not the only one getting this. I believe the script is one
> that I wrote to backup the stats to another machine.
>
> Is this something we can safely turn off? Meaning, stats are now being
> gathered and backed-up in another way?
>
>
> -------- Original Message --------
> Subject: Cron <root@linode01> /root/bin/send_stats.sh
> Date: Sat, 14 Dec 2013 18:00:02 -0500 (EST)
> From: root(a)linode01.ovirt.org (Cron Daemon)
> To: root(a)linode01.ovirt.org
>
> Sending logs to a host far far away
> Processing logfile /var/log/httpd/access_log-20131213.gz
> Pseudo-terminal will not be allocated because stdin is not a terminal.
> Address 31.15.26.3 maps to lists.ovirt.org, but this does not map back
> to the address - POSSIBLE BREAK-IN ATTEMPT!
> Last failed login: Sat Dec 14 22:52:02 UTC 2013 from 61.147.74.149 on
> ssh:notty
> There were 10940 failed login attempts since the last successful login.
> Address 31.15.26.3 maps to lists.ovirt.org, but this does not map back
> to the address - POSSIBLE BREAK-IN ATTEMPT!
> /var/log/httpd/access_log-20131213.gz sent to
> stats.ovirt.org:/var/log/awstats/linode01.ovirt.org/
> Processing logfile /var/log/httpd/lists.ovirt.org-access_log-20131213.gz
> Pseudo-terminal will not be allocated because stdin is not a terminal.
> Address 31.15.26.3 maps to lists.ovirt.org, but this does not map back
> to the address - POSSIBLE BREAK-IN ATTEMPT!
> Last failed login: Sat Dec 14 22:52:02 UTC 2013 from 61.147.74.149 on
> ssh:notty
> There were 10940 failed login attempts since the last successful login.
> Address 31.15.26.3 maps to lists.ovirt.org, but this does not map back
> to the address - POSSIBLE BREAK-IN ATTEMPT!
> /var/log/httpd/lists.ovirt.org-access_log-20131213.gz sent to
> stats.ovirt.org:/var/log/awstats/lists.ovirt.org/
> Processing logfile
> /var/log/httpd/resources.ovirt.org-access_log-20131213.gz
> Pseudo-terminal will not be allocated because stdin is not a terminal.
> Address 31.15.26.3 maps to lists.ovirt.org, but this does not map back
> to the address - POSSIBLE BREAK-IN ATTEMPT!
> Last failed login: Sat Dec 14 22:52:02 UTC 2013 from 61.147.74.149 on
> ssh:notty
> There were 10940 failed login attempts since the last successful login.
> Address 31.15.26.3 maps to lists.ovirt.org, but this does not map back
> to the address - POSSIBLE BREAK-IN ATTEMPT!
> /var/log/httpd/resources.ovirt.org-access_log-20131213.gz sent to
> stats.ovirt.org:/var/log/awstats/resources.ovirt.org/
> And they lived happily ever after
>
>
>
>
> _______________________________________________
> Infra mailing list
> Infra(a)ovirt.org
> http://lists.ovirt.org/mailman/listinfo/infra
>
7:24 p.m.
On Sun, Dec 15, 2013 at 06:08:48PM -0500, David Caro Estevez wrote:
I wrote this one, is the one that sends the stats to stats.ovirt.org
for awstats to collect, maybe I should send the email somewhere else?
Actually the
warning shows because because the reverse does't map to the
forward. We should contact AlterWay to fix this because I'm unaware of
any option to do this ourselves.
----- Original Message -----
> From: "Eyal Edri" <eedri(a)redhat.com>
> To: "Karsten 'quaid' Wade" <kwade(a)redhat.com>, "David
Caro" <dcaroest(a)redhat.com>
> Cc: "infra" <infra(a)ovirt.org>
> Sent: Sunday, December 15, 2013 9:52:35 PM
> Subject: Re: Cron <root@linode01> /root/bin/send_stats.sh
>
> which stats is this script collecting?
>
> there is the stats.ovirt.org server that has stats on gerrit,ovirt.org,lists
> and resources server.
> that's a VM sitting on rackspace infra IIRC.
>
> Eyal.
>
> ----- Original Message -----
> > From: "Karsten 'quaid' Wade" <kwade(a)redhat.com>
> > To: "infra" <infra(a)ovirt.org>
> > Sent: Sunday, December 15, 2013 9:05:26 PM
> > Subject: Fwd: Cron <root@linode01> /root/bin/send_stats.sh
> >
> > I presume I'm not the only one getting this. I believe the script is one
> > that I wrote to backup the stats to another machine.
> >
> > Is this something we can safely turn off? Meaning, stats are now being
> > gathered and backed-up in another way?
> >
> >
> > -------- Original Message --------
> > Subject: Cron <root@linode01> /root/bin/send_stats.sh
> > Date: Sat, 14 Dec 2013 18:00:02 -0500 (EST)
> > From: root(a)linode01.ovirt.org (Cron Daemon)
> > To: root(a)linode01.ovirt.org
> >
> > Sending logs to a host far far away
> > Processing logfile /var/log/httpd/access_log-20131213.gz
> > Pseudo-terminal will not be allocated because stdin is not a terminal.
> > Address 31.15.26.3 maps to lists.ovirt.org, but this does not map back
> > to the address - POSSIBLE BREAK-IN ATTEMPT!
> > Last failed login: Sat Dec 14 22:52:02 UTC 2013 from 61.147.74.149 on
> > ssh:notty
> > There were 10940 failed login attempts since the last successful login.
> > Address 31.15.26.3 maps to lists.ovirt.org, but this does not map back
> > to the address - POSSIBLE BREAK-IN ATTEMPT!
> > /var/log/httpd/access_log-20131213.gz sent to
> > stats.ovirt.org:/var/log/awstats/linode01.ovirt.org/
> > Processing logfile /var/log/httpd/lists.ovirt.org-access_log-20131213.gz
> > Pseudo-terminal will not be allocated because stdin is not a terminal.
> > Address 31.15.26.3 maps to lists.ovirt.org, but this does not map back
> > to the address - POSSIBLE BREAK-IN ATTEMPT!
> > Last failed login: Sat Dec 14 22:52:02 UTC 2013 from 61.147.74.149 on
> > ssh:notty
> > There were 10940 failed login attempts since the last successful login.
> > Address 31.15.26.3 maps to lists.ovirt.org, but this does not map back
> > to the address - POSSIBLE BREAK-IN ATTEMPT!
> > /var/log/httpd/lists.ovirt.org-access_log-20131213.gz sent to
> > stats.ovirt.org:/var/log/awstats/lists.ovirt.org/
> > Processing logfile
> > /var/log/httpd/resources.ovirt.org-access_log-20131213.gz
> > Pseudo-terminal will not be allocated because stdin is not a terminal.
> > Address 31.15.26.3 maps to lists.ovirt.org, but this does not map back
> > to the address - POSSIBLE BREAK-IN ATTEMPT!
> > Last failed login: Sat Dec 14 22:52:02 UTC 2013 from 61.147.74.149 on
> > ssh:notty
> > There were 10940 failed login attempts since the last successful login.
> > Address 31.15.26.3 maps to lists.ovirt.org, but this does not map back
> > to the address - POSSIBLE BREAK-IN ATTEMPT!
> > /var/log/httpd/resources.ovirt.org-access_log-20131213.gz sent to
> > stats.ovirt.org:/var/log/awstats/resources.ovirt.org/
> > And they lived happily ever after
> >
> >
> >
> >
> > _______________________________________________
> > Infra mailing list
> > Infra(a)ovirt.org
> > http://lists.ovirt.org/mailman/listinfo/infra
> >
>
_______________________________________________
Infra mailing list
Infra(a)ovirt.org
http://lists.ovirt.org/mailman/listinfo/infra
3:40 a.m.
not optimal but we could supress these on the cron job with redirection to a log file
instead of stdout, but we're OK not to get emails on it.
e.
----- Original Message -----
From: "Ewoud Kohl van Wijngaarden"
<ewoud+ovirt(a)kohlvanwijngaarden.nl>
To: infra(a)ovirt.org
Sent: Monday, December 16, 2013 2:24:43 AM
Subject: Re: Cron <root@linode01> /root/bin/send_stats.sh
On Sun, Dec 15, 2013 at 06:08:48PM -0500, David Caro Estevez wrote:
> I wrote this one, is the one that sends the stats to stats.ovirt.org for
> awstats to collect, maybe I should send the email somewhere else?
Actually the warning shows because because the reverse does't map to the
forward. We should contact AlterWay to fix this because I'm unaware of
any option to do this ourselves.
>
> ----- Original Message -----
> > From: "Eyal Edri" <eedri(a)redhat.com>
> > To: "Karsten 'quaid' Wade" <kwade(a)redhat.com>,
"David Caro"
> > <dcaroest(a)redhat.com>
> > Cc: "infra" <infra(a)ovirt.org>
> > Sent: Sunday, December 15, 2013 9:52:35 PM
> > Subject: Re: Cron <root@linode01> /root/bin/send_stats.sh
> >
> > which stats is this script collecting?
> >
> > there is the stats.ovirt.org server that has stats on
> > gerrit,ovirt.org,lists
> > and resources server.
> > that's a VM sitting on rackspace infra IIRC.
> >
> > Eyal.
> >
> > ----- Original Message -----
> > > From: "Karsten 'quaid' Wade" <kwade(a)redhat.com>
> > > To: "infra" <infra(a)ovirt.org>
> > > Sent: Sunday, December 15, 2013 9:05:26 PM
> > > Subject: Fwd: Cron <root@linode01> /root/bin/send_stats.sh
> > >
> > > I presume I'm not the only one getting this. I believe the script is
> > > one
> > > that I wrote to backup the stats to another machine.
> > >
> > > Is this something we can safely turn off? Meaning, stats are now being
> > > gathered and backed-up in another way?
> > >
> > >
> > > -------- Original Message --------
> > > Subject: Cron <root@linode01> /root/bin/send_stats.sh
> > > Date: Sat, 14 Dec 2013 18:00:02 -0500 (EST)
> > > From: root(a)linode01.ovirt.org (Cron Daemon)
> > > To: root(a)linode01.ovirt.org
> > >
> > > Sending logs to a host far far away
> > > Processing logfile /var/log/httpd/access_log-20131213.gz
> > > Pseudo-terminal will not be allocated because stdin is not a terminal.
> > > Address 31.15.26.3 maps to lists.ovirt.org, but this does not map back
> > > to the address - POSSIBLE BREAK-IN ATTEMPT!
> > > Last failed login: Sat Dec 14 22:52:02 UTC 2013 from 61.147.74.149 on
> > > ssh:notty
> > > There were 10940 failed login attempts since the last successful login.
> > > Address 31.15.26.3 maps to lists.ovirt.org, but this does not map back
> > > to the address - POSSIBLE BREAK-IN ATTEMPT!
> > > /var/log/httpd/access_log-20131213.gz sent to
> > > stats.ovirt.org:/var/log/awstats/linode01.ovirt.org/
> > > Processing logfile
> > > /var/log/httpd/lists.ovirt.org-access_log-20131213.gz
> > > Pseudo-terminal will not be allocated because stdin is not a terminal.
> > > Address 31.15.26.3 maps to lists.ovirt.org, but this does not map back
> > > to the address - POSSIBLE BREAK-IN ATTEMPT!
> > > Last failed login: Sat Dec 14 22:52:02 UTC 2013 from 61.147.74.149 on
> > > ssh:notty
> > > There were 10940 failed login attempts since the last successful login.
> > > Address 31.15.26.3 maps to lists.ovirt.org, but this does not map back
> > > to the address - POSSIBLE BREAK-IN ATTEMPT!
> > > /var/log/httpd/lists.ovirt.org-access_log-20131213.gz sent to
> > > stats.ovirt.org:/var/log/awstats/lists.ovirt.org/
> > > Processing logfile
> > > /var/log/httpd/resources.ovirt.org-access_log-20131213.gz
> > > Pseudo-terminal will not be allocated because stdin is not a terminal.
> > > Address 31.15.26.3 maps to lists.ovirt.org, but this does not map back
> > > to the address - POSSIBLE BREAK-IN ATTEMPT!
> > > Last failed login: Sat Dec 14 22:52:02 UTC 2013 from 61.147.74.149 on
> > > ssh:notty
> > > There were 10940 failed login attempts since the last successful login.
> > > Address 31.15.26.3 maps to lists.ovirt.org, but this does not map back
> > > to the address - POSSIBLE BREAK-IN ATTEMPT!
> > > /var/log/httpd/resources.ovirt.org-access_log-20131213.gz sent to
> > > stats.ovirt.org:/var/log/awstats/resources.ovirt.org/
> > > And they lived happily ever after
> > >
> > >
> > >
> > >
> > > _______________________________________________
> > > Infra mailing list
> > > Infra(a)ovirt.org
> > > http://lists.ovirt.org/mailman/listinfo/infra
> > >
> >
> _______________________________________________
> Infra mailing list
> Infra(a)ovirt.org
> http://lists.ovirt.org/mailman/listinfo/infra
_______________________________________________
Infra mailing list
Infra(a)ovirt.org
http://lists.ovirt.org/mailman/listinfo/infra
4024
days inactive
4027
days old
5 comments
5 participants
participants (5)
-
Cron Daemon -
David Caro Estevez -
Ewoud Kohl van Wijngaarden -
Eyal Edri -
Karsten 'quaid' Wade