################### Logwatch 7.3.6 (05/19/07) #################### Processing Initiated: Sun Feb 3 03:07:15 2013 Date Range Processed: yesterday ( 2013-Feb-02 ) Period is day. Detail Level of Output: 0 Type of Output: unformatted Logfiles for Host: linode01.ovirt.org ################################################################## --------------------- httpd Begin ------------------------ A total of 3 sites probed the server 133.26.81.168 178.210.163.150 91.193.124.144 A total of 1 possible successful probes were detected (the following URLs contain strings that match one or more of a listing of strings that indicate a possible exploit): null HTTP Response 200 Requests with error response codes 404 Not Found //admin/categories.php/login.php?cPath=&ac ... product_preview: 11 Time(s) //appserv/main.php?appserv_root=http://img ... ma.ro/bot.txt??: 1 Time(s) //appserv/main.php?appserv_root=test??: 1 Time(s) //index.php?option=../../../../../../../.. ... lf/environ%0000: 2 Time(s) //index.php?pg=../../../../../../../../../ ... lf/environ%0000: 2 Time(s) //index.php?route=../../../../../../../../ ... lf/environ%0000: 2 Time(s) //wp-content/plugins/radykal-fancy-gallery ... mage-upload.php: 1 Time(s) //wp-content/themes/edupress/scripts/timth ... ov.tr/cilik.php: 1 Time(s) //wp-content/themes/flashnews/thumb.php?sr ... .com/module.php: 1 Time(s) //wp-content/themes/flashnews/thumb.php?sr ... .net/spread.php: 1 Time(s) /admin/banner_manager.php/login.php: 1 Time(s) /admin/categories.php/login.php: 1 Time(s) /admin/categories.php/login.php?cPath=&act ... product_preview: 1 Time(s) /admin/file_manager.php/login.php: 1 Time(s) /admin/sqlpatch.php/password_forgotten.php?action=execute: 38 Time(s) /apple-touch-icon-144x144-precomposed.png: 1 Time(s) /apple-touch-icon-144x144.png: 1 Time(s) /apple-touch-icon-57x57-precomposed.png: 1 Time(s) /apple-touch-icon-57x57.png: 1 Time(s) /apple-touch-icon-precomposed.png: 14 Time(s) /apple-touch-icon.png: 13 Time(s) /category/news/feed: 24 Time(s) /category/news/feed/: 95 Time(s) /community: 1 Time(s) /contact.php: 1 Time(s) /extras/curltest.php: 4 Time(s) /favicon.ico: 255 Time(s) /listinfo/board: 1 Time(s) /meetings/ovirt/2012/ovirt.2012-11-14-14.00.log.html: 1 Time(s) /news-and-events/workshop/: 1 Time(s) /pipermail/arch/2012-august/000751.html: 1 Time(s) /pipermail/infra//admin/categories.php/log ... product_preview: 1 Time(s) /pipermail/infra/2011-October/000047.html& ... qXQ/contact.php: 1 Time(s) /pipermail/infra/2011-October/contact.php: 1 Time(s) /pipermail/infra/2012-August/000878.html&a ... product_preview: 1 Time(s) /pipermail/infra/2012-August/admin/categor ... product_preview: 1 Time(s) /pipermail/infra/2012-February//appserv/ma ... erv_root=test??: 1 Time(s) /pipermail/infra/2012-February//appserv/ma ... ma.ro/bot.txt??: 1 Time(s) /pipermail/infra/2012-March//admin/categor ... product_preview: 1 Time(s) /pipermail/infra/2012-March/000226.html&am ... bAw/contact.php: 1 Time(s) /pipermail/infra/2012-March/000228.html&am ... yEQ/contact.php: 1 Time(s) /pipermail/infra/2012-March/contact.php: 1 Time(s) /pipermail/infra/2012-November//appserv/ma ... erv_root=test??: 1 Time(s) /pipermail/infra/2012-November//appserv/ma ... ma.ro/bot.txt??: 1 Time(s) /pipermail/infra/2012-November//index.php? ... lf/environ%0000: 3 Time(s) /pipermail/infra/2012-November//wp-content ... .com/module.php: 1 Time(s) /pipermail/infra/2012-November//wp-content ... .net/spread.php: 1 Time(s) /pipermail/infra/2012-November//wp-content ... mage-upload.php: 2 Time(s) /pipermail/infra/2012-November//wp-content ... ov.tr/cilik.php: 1 Time(s) /pipermail/infra/2012-November/001288.html ... .com.br/bad.php: 1 Time(s) /pipermail/infra/2012-November/001288.html ... ad.ru/robot.php: 1 Time(s) /pipermail/infra/2012-November/001313.html ... lle.net/bad.php: 1 Time(s) /pipermail/infra/2012-November/001330.html ... .com%2Fstun.php: 9 Time(s) /pipermail/infra/2012-November/001330.html ... /result/bat.php: 1 Time(s) /pipermail/infra/2012-November/001330.html ... a.com%2Fbad.php: 11 Time(s) /pipermail/infra/2012-November/001330.html ... e.net%2Fbad.php: 1 Time(s) /pipermail/infra/2012-November/001330.html ... om%2Fstunxx.php: 2 Time(s) /pipermail/infra/2012-November/001330.html ... ov.tr/cilik.php: 3 Time(s) /pipermail/infra/2012-November/001330.html ... t.net%2Fbad.php: 1 Time(s) /pipermail/infra/2012-November/001410.html ... .es%2Fjahat.php: 1 Time(s) /pipermail/infra/2012-November/001410.html ... /result/bat.php: 1 Time(s) /pipermail/infra/2012-November/001410.html ... co.za/kikok.php: 1 Time(s) /pipermail/infra/2012-November/001410.html ... com%2Fmodar.php: 7 Time(s) /pipermail/infra/2012-November/001410.html ... om%2Fstunxx.php: 1 Time(s) /pipermail/infra/2012-November/001445.html ... .com/module.php: 1 Time(s) /pipermail/infra/2012-November/001445.html ... .es%2Fjahat.php: 1 Time(s) /pipermail/infra/2012-November/001445.html ... .net/spread.php: 1 Time(s) /pipermail/infra/2012-November/001445.html ... /result/bat.php: 2 Time(s) /pipermail/infra/2012-November/001445.html ... e.net%2Fbad.php: 1 Time(s) /pipermail/infra/2012-November/001445.html ... om%2Fstunxx.php: 9 Time(s) /pipermail/infra/2012-November/001445.html ... om/id%2Fbad.php: 1 Time(s) /pipermail/infra/2012-November/001462.html ... co.za/kikok.php: 1 Time(s) /pipermail/infra/2012-November/001462.html ... e.net%2Fbad.php: 6 Time(s) /pipermail/infra/2012-November/001471.html ... .com%2Fstun.php: 1 Time(s) /pipermail/infra/2012-November/001471.html ... om%2Fstunxx.php: 1 Time(s) /pipermail/infra/2012-November/001478.html ... com%2Fmodar.php: 8 Time(s) /pipermail/infra/2012-November/001483.html ... .com%2Fstun.php: 5 Time(s) /pipermail/infra/2012-November/001506.html ... com%2Fmodar.php: 1 Time(s) /pipermail/infra/2012-November/001552.html ... .es%2Fjahat.php: 2 Time(s) /pipermail/infra/2012-November/001552.html ... com%2Fmodar.php: 3 Time(s) /pipermail/infra/2012-November/001552.html ... e.net%2Fbad.php: 2 Time(s) /pipermail/infra/2012-November/001552.html ... om%2Fstunxx.php: 1 Time(s) /pipermail/infra/2012-November/001552.html ... t.net%2Fbad.php: 1 Time(s) /pipermail/infra/2012-November/001572.html ... mage-upload.php: 1 Time(s) /pipermail/infra/2012-November/wp-content/ ... .com%2Fstun.php: 3 Time(s) /pipermail/infra/2012-November/wp-content/ ... .com.br/bad.php: 1 Time(s) /pipermail/infra/2012-November/wp-content/ ... .es%2Fjahat.php: 3 Time(s) /pipermail/infra/2012-November/wp-content/ ... /result/bat.php: 3 Time(s) /pipermail/infra/2012-November/wp-content/ ... a.com%2Fbad.php: 2 Time(s) /pipermail/infra/2012-November/wp-content/ ... ad.ru/robot.php: 1 Time(s) /pipermail/infra/2012-November/wp-content/ ... co.za/kikok.php: 6 Time(s) /pipermail/infra/2012-November/wp-content/ ... com%2Fmodar.php: 2 Time(s) /pipermail/infra/2012-November/wp-content/ ... e.net%2Fbad.php: 6 Time(s) /pipermail/infra/2012-November/wp-content/ ... l.ro%2Fvera.php: 1 Time(s) /pipermail/infra/2012-November/wp-content/ ... lle.net/bad.php: 1 Time(s) /pipermail/infra/2012-November/wp-content/ ... ma.ro%2Fbad.php: 2 Time(s) /pipermail/infra/2012-November/wp-content/ ... om%2Fstunxx.php: 5 Time(s) /pipermail/infra/2012-November/wp-content/ ... om/id%2Fbad.php: 1 Time(s) /pipermail/infra/2012-November/wp-content/ ... ome.org/cok.php: 4 Time(s) /pipermail/infra/2012-November/wp-content/ ... t.net%2Fbad.php: 2 Time(s) /pipermail/infra/2012-October//admin/categ ... product_preview: 5 Time(s) /pipermail/infra/2012-October//appserv/mai ... erv_root=test??: 1 Time(s) /pipermail/infra/2012-October//appserv/mai ... ma.ro/bot.txt??: 1 Time(s) /pipermail/infra/2012-October//index.php?o ... lf/environ%0000: 1 Time(s) /pipermail/infra/2012-October//index.php?p ... lf/environ%0000: 1 Time(s) /pipermail/infra/2012-October/001166.html& ... r.php/login.php: 2 Time(s) /pipermail/infra/2012-October/001166.html& ... s.php/login.php: 1 Time(s) /pipermail/infra/2012-October/001181.html& ... cp.nl%2Fbad.php: 3 Time(s) /pipermail/infra/2012-October/001232.html& ... product_preview: 1 Time(s) /pipermail/infra/2012-October/001233.html& ... pWg/contact.php: 1 Time(s) /pipermail/infra/2012-October/001235.html/ ... product_preview: 5 Time(s) /pipermail/infra/2012-October/001256.html& ... /result/bat.php: 1 Time(s) /pipermail/infra/2012-October/admin/banner ... r.php/login.php: 1 Time(s) /pipermail/infra/2012-October/admin/catego ... product_preview: 1 Time(s) /pipermail/infra/2012-October/admin/categories.php/login.php: 1 Time(s) /pipermail/infra/2012-October/admin/file_m ... r.php/login.php: 1 Time(s) /pipermail/infra/2012-October/admin/sqlpat ... ?action=execute: 4 Time(s) /pipermail/infra/2012-October/contact.php: 1 Time(s) /pipermail/infra/2012-October/wp-content/t ... /result/bat.php: 1 Time(s) /pipermail/infra/2012-October/wp-content/t ... cp.nl%2Fbad.php: 2 Time(s) /pipermail/infra/2012-September//admin/cat ... product_preview: 6 Time(s) /pipermail/infra/2012-September//index.php ... lf/environ%0000: 6 Time(s) /pipermail/infra/2012-September/001031.htm ... product_preview: 1 Time(s) /pipermail/infra/2012-September/001071.htm ... product_preview: 1 Time(s) /pipermail/infra/2012-September/001106.htm ... product_preview: 6 Time(s) /pipermail/infra/2012-September/001111.htm ... product_preview: 1 Time(s) /pipermail/infra/2012-September/001139.htm ... da.fm%2Fbad.php: 4 Time(s) /pipermail/infra/2012-September/001143.htm ... .es%2Fjahat.php: 1 Time(s) /pipermail/infra/2012-September/001143.htm ... com%2Fmodar.php: 4 Time(s) /pipermail/infra/2012-September/001147.htm ... product_preview: 1 Time(s) /pipermail/infra/2012-September/admin/cate ... product_preview: 1 Time(s) /pipermail/infra/2012-September/admin/sqlp ... ?action=execute: 38 Time(s) /pipermail/infra/2012-September/extras/curltest.php: 4 Time(s) /pipermail/infra/2012-September/wp-content ... .es%2Fjahat.php: 1 Time(s) /pipermail/infra/2012-September/wp-content ... com%2Fmodar.php: 1 Time(s) /pipermail/infra/2012-September/wp-content ... da.fm%2Fbad.php: 2 Time(s) /pipermail/infra/2012-September/wp-content ... l.ro%2Fvera.php: 1 Time(s) /pipermail/infra/admin/sqlpatch.php/passwo ... ?action=execute: 38 Time(s) /pipermail/infra/extras/curltest.php: 4 Time(s) /pipermail/infra/wp-content/themes/Envisio ... co.za/kikok.php: 4 Time(s) /pipermail/infra/wp-content/themes/Envisio ... ome.org/cok.php: 4 Time(s) /pipermail/infra/wp-content/themes/Optimiz ... l.ro%2Fvera.php: 1 Time(s) /pipermail/infra/wp-content/themes/pronto/ ... l.ro%2Fvera.php: 1 Time(s) /pipermail/node-devel/2011-November/000039 ... l/user/register: 1 Time(s) /pipermail/node-devel/2011-November/000039 ... q=user/register: 1 Time(s) /pipermail/node-devel/2011-November/user/register: 3 Time(s) /pipermail/node-devel/user/register: 1 Time(s) /pipermail/user/register: 2 Time(s) /pipermail/users/2012-april/001648.html: 1 Time(s) /pipermail/users/2012-april/001766.html: 1 Time(s) /releases/3.2-alpha/rpm/Fedora/18/repodata/other.xml.gz: 1 Time(s) /releases/3.2/repodata/repomd.xml: 1 Time(s) /releases/beta/fedora/17: 1 Time(s) /releases/beta/fedora/17/repodata/filelists.xml.gz: 24 Time(s) /releases/beta/fedora/17/repodata/other.xml.gz: 1 Time(s) /releases/beta/fedora/17/repodata/repomd.xml: 25 Time(s) /releases/beta/rpm/Fedora/17/noarch/: 1 Time(s) /releases/beta/rpm/Fedora/17/repodata/repomd.xml: 102 Time(s) /releases/beta/src/ovirt-node-2.5.1.tar.gz: 1 Time(s) /releases/beta/src/ovirt-node-iso-2.5.2.tar.gz: 1 Time(s) /releases/nightly/3.1.0-4/repodata/repomd.xml: 1 Time(s) /releases/nightly/binary/: 1 Time(s) /releases/nightly/fedora/16/ovirt-engine-r ... fc16.x86_64.rpm: 1 Time(s) /releases/nightly/fedora/16/ovirt-engine-t ... fc16.x86_64.rpm: 1 Time(s) /releases/nightly/fedora/16/ovirt-engine.repo: 1 Time(s) /releases/nightly/fedora/16/repodata/repomd.xml: 363 Time(s) /releases/stable/binary/: 2 Time(s) /releases/stable/binary/ovirt-node-image-2.2.2-2.2.fc16.iso: 1 Time(s) /releases/stable/fedora/16//repodata/repomd.xml: 1 Time(s) /releases/stable/fedora/16/ovirt-engine-no ... fc16.x86_64.rpm: 1 Time(s) /releases/stable/fedora/16/repodata/primary.xml.gz: 24 Time(s) /releases/stable/fedora/16/repodata/repomd.xml: 163 Time(s) /releases/stable/rpm/EL/6/repodata/repomd.xml: 1 Time(s) /releases/stable/rpm/EL6: 1 Time(s) /releases/stable/rpm/EL6/: 1 Time(s) /releases/stable/rpm/EL6/3.2/repodata/repomd.xml: 1 Time(s) /releases/stable/rpm/EL6/6.1/repodata/repomd.xml: 4 Time(s) /releases/stable/rpm/EL6/6.3: 1 Time(s) /releases/stable/rpm/EL6/6.3/repodata/repomd.xml: 7 Time(s) /releases/stable/rpm/EL6/6/repodata/repomd.xml: 38 Time(s) /releases/stable/rpm/EL6/6Server/: 1 Time(s) /releases/stable/rpm/EL6/6Server/rep%20odata/repomd.xml: 1 Time(s) /releases/stable/rpm/EL6/6Server/repodata/repomd.xml: 24 Time(s) /releases/stable/rpm/EL6/6Workstation/repodata/repomd.xml: 8 Time(s) /releases/stable/rpm/Fedora/15/repodata/repomd.xml: 4 Time(s) /releases/stable/rpm/Fedora/16/repodata/repomd.xml: 97 Time(s) /releases/stable/src/ovirt-node-2.2.2.tar.gz: 1 Time(s) /robots.txt: 35 Time(s) /user/register: 3 Time(s) /wp-content/themes/Avenue/timthumb.php?src ... co.za/kikok.php: 1 Time(s) /wp-content/themes/Envisioned/timthumb.php ... .es%2Fjahat.php: 2 Time(s) /wp-content/themes/Envisioned/timthumb.php ... co.za/kikok.php: 4 Time(s) /wp-content/themes/Envisioned/timthumb.php ... com%2Fmodar.php: 1 Time(s) /wp-content/themes/Envisioned/timthumb.php ... e.net%2Fbad.php: 2 Time(s) /wp-content/themes/Envisioned/timthumb.php ... om%2Fstunxx.php: 2 Time(s) /wp-content/themes/Envisioned/timthumb.php ... ome.org/cok.php: 4 Time(s) /wp-content/themes/OptimizePress/timthumb. ... l.ro%2Fvera.php: 1 Time(s) /wp-content/themes/OptimizePress/timthumb. ... om%2Fstunxx.php: 1 Time(s) /wp-content/themes/TheTravelTheme/includes ... .com%2Fstun.php: 3 Time(s) /wp-content/themes/auctionpress/thumbs/_tb ... co.za/kikok.php: 1 Time(s) /wp-content/themes/auctionpress/thumbs/_tb ... e.net%2Fbad.php: 2 Time(s) /wp-content/themes/ecobiz/timthumb.php?src ... /result/bat.php: 1 Time(s) /wp-content/themes/ecobiz/timthumb.php?src ... a.com%2Fbad.php: 1 Time(s) /wp-content/themes/ecobiz/timthumb.php?src ... om%2Fstunxx.php: 1 Time(s) /wp-content/themes/ecobiz/timthumb.php?src ... t.net%2Fbad.php: 1 Time(s) /wp-content/themes/edupress/scripts/timthu ... a.com%2Fbad.php: 2 Time(s) /wp-content/themes/flashnews/scripts/timth ... om/id%2Fbad.php: 1 Time(s) /wp-content/themes/flashnews/thumb.php?src ... .es%2Fjahat.php: 1 Time(s) /wp-content/themes/flashnews/timthumb.php? ... e.net%2Fbad.php: 1 Time(s) /wp-content/themes/gazette/includes/timthu ... ad.ru/robot.php: 1 Time(s) /wp-content/themes/moi-magazine/timthumb.p ... da.fm%2Fbad.php: 2 Time(s) /wp-content/themes/multidesign/scripts/tim ... lle.net/bad.php: 1 Time(s) /wp-content/themes/newspress/thumb.php?src ... com%2Fmodar.php: 1 Time(s) /wp-content/themes/overeasy/thumb.php?src= ... t.net%2Fbad.php: 1 Time(s) /wp-content/themes/pronto/cjl/pronto/uploa ... l.ro%2Fvera.php: 1 Time(s) /wp-content/themes/simplicity/thumb.php?sr ... ma.ro%2Fbad.php: 1 Time(s) /wp-content/themes/thedawn/lib/scripts/tim ... e.net%2Fbad.php: 1 Time(s) /wp-content/themes/themorningafter/thumb.p ... .com.br/bad.php: 1 Time(s) /wp-content/themes/typebased/thumb.php?src ... ma.ro%2Fbad.php: 1 Time(s) /wp-content/themes/u-design/scripts/timthu ... cp.nl%2Fbad.php: 2 Time(s) /wp-content/themes/versatile/timthumb.php? ... /result/bat.php: 1 Time(s) /wp-content/themes/welcome_inn/thumb.ph?sr ... om%2Fstunxx.php: 1 Time(s) /wp-content/themes/welcome_inn/thumb.php?s ... /result/bat.php: 1 Time(s) /wp-login.php: 97 Time(s) 416 Request Range Not Satisfiable /releases/beta/rpm/Fedora/18/noarch/vdsm-x ... fc18.noarch.rpm: 1 Time(s) /releases/nightly/rpm/Fedora/18/noarch/ovi ... fc18.noarch.rpm: 2 Time(s) /releases/nightly/rpm/Fedora/18/repodata/filelists.xml.gz: 1 Time(s) /releases/stable/rpm/Fedora/18/noarch/ovir ... fc17.noarch.rpm: 1 Time(s) ---------------------- httpd End ------------------------- --------------------- Postfix Begin ------------------------ 46 *Warning: Pre-queue content-filter connection overload 2.107M Bytes accepted 2,208,988 31.705M Bytes delivered 33,245,110 ======== ================================================ 290 Accepted 99.66% 1 Rejected 0.34% -------- ------------------------------------------------ 291 Total 100.00% ======== ================================================ 1 Reject relay denied 100.00% -------- ------------------------------------------------ 1 Total Rejects 100.00% ======== ================================================ 230 Connections made 2 Connections lost 230 Disconnections 275 Removed from queue 98 Delivered 4964 Sent via SMTP 2 Forwarded 26 Deferred 329 Deferrals 10 Bounce (remote) 8 DSNs undeliverable 275 Connection failure (outbound) 1 Timeout (inbound) 4 Hostname verification errors 53 Enabled PIX workaround ---------------------- Postfix End ------------------------- --------------------- SSHD Begin ------------------------ Users logging in through sshd: gerrit-backup: 107.22.212.69 (gerrit.ovirt.org): 3 times jenkins: 107.22.215.130 (ec2-107-22-215-130.compute-1.amazonaws.com): 1 time Received disconnect: 11: Bye Bye : 126 Time(s) 11: disconnected by user : 3 Time(s) SFTP subsystem requests: 1 Time(s) **Unmatched Entries** reverse mapping checking getaddrinfo for 78.30.232.27.sevstar.net [78.30.232.27] failed - POSSIBLE BREAK-IN ATTEMPT! : 58 time(s) ---------------------- SSHD End ------------------------- --------------------- Disk Space Begin ------------------------ Filesystem Size Used Avail Use% Mounted on /dev/xvda 48G 38G 9.8G 80% / ---------------------- Disk Space End ------------------------- ###################### Logwatch End #########################