Logwatch for linode01.ovirt.org (Linux)

logwatch at lists.ovirt.org logwatch at lists.ovirt.org
Sat Mar 16 07:40:32 UTC 2013


 ################### Logwatch 7.3.6 (05/19/07) #################### 
        Processing Initiated: Sat Mar 16 03:40:32 2013
        Date Range Processed: yesterday
                              ( 2013-Mar-15 )
                              Period is day.
      Detail Level of Output: 0
              Type of Output: unformatted
           Logfiles for Host: linode01.ovirt.org
  ################################################################## 
 
 --------------------- httpd Begin ------------------------ 

 A total of 1 sites probed the server 
    124.77.189.31
 
 A total of 1 possible successful probes were detected (the following URLs
 contain strings that match one or more of a listing of strings that
 indicate a possible exploit):
 
    null HTTP Response 200 
 
 Requests with error response codes
    404 Not Found
       /%22/bbs/%22test: 1 Time(s)
       //admin/record_company.php/password_forgotten.php: 1 Time(s)
       //appserv/main.php?appserv_root=http://pic ... et/indeks.php??: 10 Time(s)
       //appserv/main.php?appserv_root=http://uzv ... u/license.txt??: 10 Time(s)
       //appserv/main.php?appserv_root=http://www ... 010/07/on.png??: 1 Time(s)
       //appserv/main.php?appserv_root=http://www ... 10/07/off.png??: 1 Time(s)
       //appserv/main.php?appserv_root=test??: 6 Time(s)
       //booth.php?include_path=http://picasa.com ... et/indeks.php??: 16 Time(s)
       //booth.php?include_path=http://uzvezdy.ru/license.txt??: 16 Time(s)
       //booth.php?include_path=test??: 8 Time(s)
       //data/shell.php?cmd=: 2 Time(s)
       //wp-content/themes/Envisioned/thumb.php?s ... /cybercrime.php: 2 Time(s)
       /2012/08/08/ovirt-3-1-release/: 1 Time(s)
       /Download: 1 Time(s)
       /admin/banner_manager.php/login.php: 2 Time(s)
       /admin/categories.php/login.php: 3 Time(s)
       /admin/file_manager.php/login.php: 2 Time(s)
       /admin/sqlpatch.php/password_forgotten.php?action=execute: 1 Time(s)
       /apple-touch-icon-precomposed.png: 2 Time(s)
       /apple-touch-icon.png: 2 Time(s)
       /category/news/feed: 19 Time(s)
       /category/news/feed/: 101 Time(s)
       /community: 1 Time(s)
       /favicon.ico: 529 Time(s)
       /licensing: 1 Time(s)
       /marketing: 2 Time(s)
       /models/: 1 Time(s)
       /pipermail/index.php?act=Reg&CODE=00: 1 Time(s)
       /pipermail/index.php?app=core&module=global&section=register: 1 Time(s)
       /pipermail/infra//appserv/main.php?appserv ... 010/07/on.png??: 1 Time(s)
       /pipermail/infra//appserv/main.php?appserv ... 10/07/off.png??: 1 Time(s)
       /pipermail/infra//appserv/main.php?appserv_root=test??: 1 Time(s)
       /pipermail/infra//wp-content/themes/Envisi ... /cybercrime.php: 2 Time(s)
       /pipermail/infra/2012-February//appserv/ma ... erv_root=test??: 4 Time(s)
       /pipermail/infra/2012-February//appserv/ma ... et/indeks.php??: 8 Time(s)
       /pipermail/infra/2012-February//appserv/ma ... u/license.txt??: 8 Time(s)
       /pipermail/infra/2012-February/000224.html ... erv_root=test??: 8 Time(s)
       /pipermail/infra/2012-February/000224.html ... et/indeks.php??: 16 Time(s)
       /pipermail/infra/2012-February/000224.html ... u/license.txt??: 16 Time(s)
       /pipermail/infra/2012-November//appserv/ma ... erv_root=test??: 3 Time(s)
       /pipermail/infra/2012-November//appserv/ma ... et/indeks.php??: 6 Time(s)
       /pipermail/infra/2012-November//appserv/ma ... u/license.txt??: 6 Time(s)
       /pipermail/infra/2012-November//wp-content ... /cybercrime.php: 2 Time(s)
       /pipermail/infra/2012-November/001285.html ... inc.com/jos.php: 2 Time(s)
       /pipermail/infra/2012-November/001285.html ... nc.com/jack.php: 1 Time(s)
       /pipermail/infra/2012-November/001330.html ... .net/indeks.php: 20 Time(s)
       /pipermail/infra/2012-November/001330.html ... .ru/license.txt: 10 Time(s)
       /pipermail/infra/2012-November/001330.html ... ema.com/bad.php: 1 Time(s)
       /pipermail/infra/2012-November/001330.html ... g.ro%2Frawk.php: 2 Time(s)
       /pipermail/infra/2012-November/001330.html ... l.com/stunz.php: 1 Time(s)
       /pipermail/infra/2012-November/001330.html ... om%2Fstunxx.php: 1 Time(s)
       /pipermail/infra/2012-November/001330.html ... om%2Fupload.php: 1 Time(s)
       /pipermail/infra/2012-November/001330.html ... uk%2Fsimple.php: 3 Time(s)
       /pipermail/infra/2012-November/001393.html ... al.com%2Fsh.php: 1 Time(s)
       /pipermail/infra/2012-November/001445.html ... e.com%2Fbad.php: 1 Time(s)
       /pipermail/infra/2012-November/001445.html ... x.com/users.php: 4 Time(s)
       /pipermail/infra/2012-November/001462.html ... ill.com/bad.php: 1 Time(s)
       /pipermail/infra/2012-November/001471.html ... uk%2Fsimple.php: 3 Time(s)
       /pipermail/infra/2012-November/001483.html ... om%2Fstunxx.php: 1 Time(s)
       /pipermail/infra/2012-November/001552.html ... c.com%2Fbad.php: 1 Time(s)
       /pipermail/infra/2012-November/001552.html ... erv_root=test??: 7 Time(s)
       /pipermail/infra/2012-November/001552.html ... et/indeks.php??: 14 Time(s)
       /pipermail/infra/2012-November/001552.html ... u/license.txt??: 14 Time(s)
       /pipermail/infra/2012-November/001572.html ... mage-upload.php: 1 Time(s)
       /pipermail/infra/2012-November/wp-content/ ... .net/indeks.php: 2 Time(s)
       /pipermail/infra/2012-November/wp-content/ ... .ru/license.txt: 1 Time(s)
       /pipermail/infra/2012-November/wp-content/ ... al.com%2Fsh.php: 1 Time(s)
       /pipermail/infra/2012-November/wp-content/ ... c.com%2Fbad.php: 3 Time(s)
       /pipermail/infra/2012-November/wp-content/ ... e.com%2Fbad.php: 1 Time(s)
       /pipermail/infra/2012-November/wp-content/ ... ema.com/bad.php: 1 Time(s)
       /pipermail/infra/2012-November/wp-content/ ... et%2Findeks.php: 1 Time(s)
       /pipermail/infra/2012-November/wp-content/ ... g.org%2Fbad.php: 1 Time(s)
       /pipermail/infra/2012-November/wp-content/ ... g.ro%2Frawk.php: 1 Time(s)
       /pipermail/infra/2012-November/wp-content/ ... ill.com/bad.php: 1 Time(s)
       /pipermail/infra/2012-November/wp-content/ ... inc.com/jos.php: 2 Time(s)
       /pipermail/infra/2012-November/wp-content/ ... l.com/stunz.php: 1 Time(s)
       /pipermail/infra/2012-November/wp-content/ ... mage-upload.php: 2 Time(s)
       /pipermail/infra/2012-November/wp-content/ ... n.com%2Fbad.php: 3 Time(s)
       /pipermail/infra/2012-November/wp-content/ ... nc.com/jack.php: 1 Time(s)
       /pipermail/infra/2012-November/wp-content/ ... om%2Fstunxx.php: 1 Time(s)
       /pipermail/infra/2012-November/wp-content/ ... om%2Fupload.php: 2 Time(s)
       /pipermail/infra/2012-November/wp-content/ ... uk%2Fsimple.php: 1 Time(s)
       /pipermail/infra/2012-November/wp-content/ ... x.com/users.php: 4 Time(s)
       /pipermail/infra/2012-October//appserv/mai ... 010/07/on.png??: 1 Time(s)
       /pipermail/infra/2012-October//appserv/mai ... 10/07/off.png??: 1 Time(s)
       /pipermail/infra/2012-October//appserv/mai ... erv_root=test??: 4 Time(s)
       /pipermail/infra/2012-October//appserv/mai ... et/indeks.php??: 6 Time(s)
       /pipermail/infra/2012-October//appserv/mai ... u/license.txt??: 6 Time(s)
       /pipermail/infra/2012-October//booth.php?i ... et/indeks.php??: 16 Time(s)
       /pipermail/infra/2012-October//booth.php?i ... u/license.txt??: 16 Time(s)
       /pipermail/infra/2012-October//booth.php?include_path=test??: 8 Time(s)
       /pipermail/infra/2012-October/001166.html& ... r.php/login.php: 2 Time(s)
       /pipermail/infra/2012-October/001166.html& ... s.php/login.php: 2 Time(s)
       /pipermail/infra/2012-October/001166.html/ ... tals.ro/tim.php: 1 Time(s)
       /pipermail/infra/2012-October/001181.html& ... inc.com/jos.php: 1 Time(s)
       /pipermail/infra/2012-October/001234.html& ... et/indeks.php??: 84 Time(s)
       /pipermail/infra/2012-October/001234.html& ... u/license.txt??: 84 Time(s)
       /pipermail/infra/2012-October/001234.html& ... ude_path=test??: 42 Time(s)
       /pipermail/infra/2012-October/001235.html& ... r.php/login.php: 4 Time(s)
       /pipermail/infra/2012-October/001235.html& ... s.php/login.php: 2 Time(s)
       /pipermail/infra/2012-October/001244.html& ... erv_root=test??: 17 Time(s)
       /pipermail/infra/2012-October/001244.html& ... et/indeks.php??: 34 Time(s)
       /pipermail/infra/2012-October/001244.html& ... u/license.txt??: 34 Time(s)
       /pipermail/infra/2012-October/admin/banner ... r.php/login.php: 2 Time(s)
       /pipermail/infra/2012-October/admin/categories.php/login.php: 3 Time(s)
       /pipermail/infra/2012-October/admin/file_m ... r.php/login.php: 2 Time(s)
       /pipermail/infra/2012-October/wp-content/t ... inc.com/jos.php: 1 Time(s)
       /pipermail/infra/2012-October/wp-content/t ... tals.ro/tim.php: 1 Time(s)
       /pipermail/infra/2012-September/%22/bbs/%22test: 1 Time(s)
       /pipermail/infra/2012-September//admin/rec ... d_forgotten.php: 1 Time(s)
       /pipermail/infra/2012-September//data/shell.php?cmd=: 2 Time(s)
       /pipermail/infra/2012-September/001024.htm ... r.php/login.php: 2 Time(s)
       /pipermail/infra/2012-September/001024.htm ... s.php/login.php: 4 Time(s)
       /pipermail/infra/2012-September/001139.htm ... inc.com/jos.php: 1 Time(s)
       /pipermail/infra/2012-September/001139.htm ... nc.com/jack.php: 1 Time(s)
       /pipermail/infra/2012-September/001144.htm ... %22/bbs/%22test: 1 Time(s)
       /pipermail/infra/2012-September/001144.htm ... /shell.php?cmd=: 2 Time(s)
       /pipermail/infra/2012-September/001144.htm ... ard.php?id=test: 1 Time(s)
       /pipermail/infra/2012-September/001161.htm ... ?action=execute: 1 Time(s)
       /pipermail/infra/2012-September/001161.htm ... d_forgotten.php: 1 Time(s)
       /pipermail/infra/2012-September/admin/bann ... r.php/login.php: 1 Time(s)
       /pipermail/infra/2012-September/admin/cate ... s.php/login.php: 1 Time(s)
       /pipermail/infra/2012-September/admin/sqlp ... ?action=execute: 1 Time(s)
       /pipermail/infra/2012-September/wp-content ... inc.com/jos.php: 1 Time(s)
       /pipermail/infra/2012-September/wp-content ... nc.com/jack.php: 1 Time(s)
       /pipermail/infra/2012-September/zboard.php?id=test: 1 Time(s)
       /pipermail/infra/wp-content/themes/edupres ... et%2Findeks.php: 1 Time(s)
       /pipermail/infra/wp-content/themes/edupres ... om%2Fupload.php: 1 Time(s)
       /pipermail/user/register: 1 Time(s)
       /pipermail/users/2013: 1 Time(s)
       /releases/3.1/rpm/fedora/17/noarch/old: 1 Time(s)
       /releases/3.1/rpm/fedora/17/noarch/ovirt-e ... fc17.noarch.rpm: 1 Time(s)
       /releases/3.1/rpm/fedora/17/noarch/repodata: 1 Time(s)
       /releases/3.1/rpm/fedora/17/srpms/repodata: 1 Time(s)
       /releases/3.1/tools/oVirt-Live-0.6.iso: 1 Time(s)
       /releases/alpha/iso/ovirt-node-iso-2.6.0-2 ... 290835.fc18.iso: 1 Time(s)
       /releases/beta.old.20120808/fedora/17/: 1 Time(s)
       /releases/beta/fedora/17/repodata/filelists.xml.gz: 7 Time(s)
       /releases/beta/fedora/17/repodata/repomd.xml: 25 Time(s)
       /releases/beta/ovirt-engine.repo: 2 Time(s)
       /releases/nightly/fedora/16/ovirt-engine-s ... fc16.noarch.rpm: 1 Time(s)
       /releases/nightly/fedora/16/ovirt-engine.repo: 1 Time(s)
       /releases/nightly/fedora/16/repodata/repomd.xml: 13 Time(s)
       /releases/nightly/rpm/EL/6/noarch/repodata/repomd.xml: 1 Time(s)
       /releases/nightly/rpm/Fedora/17/ovirt-engine.repo: 1 Time(s)
       /releases/nightly/tools/ovirt-node-iso-2.5 ... c3.533.fc18.iso: 1 Time(s)
       /releases/nightly/tools/ovirt-node-iso-2.6 ... ca.639.fc18.iso: 1 Time(s)
       /releases/ovirt-release-fedora.noarch.rpm+: 1 Time(s)
       /releases/stable/binary/: 3 Time(s)
       /releases/stable/fedora/16/: 1 Time(s)
       /releases/stable/fedora/16/ovirt-engine.repo: 1 Time(s)
       /releases/stable/fedora/16/repodata/primary.xml.gz: 26 Time(s)
       /releases/stable/fedora/16/repodata/repomd.xml: 212 Time(s)
       /releases/stable/fedora/18/ovirt-engine.repo: 1 Time(s)
       /releases/stable/ovirt-engine.repo%20-O%20 ... virtengine.repo: 1 Time(s)
       /releases/stable/rpm/EL/6/noarch/: 1 Time(s)
       /releases/stable/rpm/EL/6/repodata/repomd.xml: 8 Time(s)
       /releases/stable/rpm/EL6: 1 Time(s)
       /releases/stable/rpm/EL6/6/repodata/: 1 Time(s)
       /releases/stable/rpm/EL6/6/repodata/repomd.xml: 71 Time(s)
       /releases/stable/rpm/EL6/6Server/repodata/repomd.xml: 31 Time(s)
       /releases/stable/rpm/EL6/6Workstation/repodata/repomd.xml: 8 Time(s)
       /releases/stable/rpm/Fedora/16/repodata/repomd.xml: 17 Time(s)
       /releases/stable/src/%25: 1 Time(s)
       /releases/stable/src/ovirt-node-2.5.0.tar.gz: 1 Time(s)
       /robots.txt: 38 Time(s)
       /trafficbasedsspsitemap.xml: 1 Time(s)
       /wiki/OVirt_3.0_to_3.1_upgrade: 1 Time(s)
       /wiki/OVirt_3.1_release_notes: 1 Time(s)
       /wp-content/plugins/radykal-fancy-gallery/ ... mage-upload.php: 2 Time(s)
       /wp-content/themes/Minimal/timthumb.php?sr ... tals.ro/tim.php: 1 Time(s)
       /wp-content/themes/TheProfessional/timthum ... al.com%2Fsh.php: 1 Time(s)
       /wp-content/themes/TheTravelTheme/includes ... .net/indeks.php: 2 Time(s)
       /wp-content/themes/TheTravelTheme/includes ... .ru/license.txt: 1 Time(s)
       /wp-content/themes/TheTravelTheme/includes ... ema.com/bad.php: 1 Time(s)
       /wp-content/themes/TheTravelTheme/includes ... l.com/stunz.php: 1 Time(s)
       /wp-content/themes/TheTravelTheme/includes ... om%2Fstunxx.php: 1 Time(s)
       /wp-content/themes/TheTravelTheme/includes ... uk%2Fsimple.php: 1 Time(s)
       /wp-content/themes/arras/library/timthumb. ... inc.com/jos.php: 1 Time(s)
       /wp-content/themes/biznizz/functions/thumb ... ill.com/bad.php: 1 Time(s)
       /wp-content/themes/delicate/thumb.php?src= ... g.org%2Fbad.php: 1 Time(s)
       /wp-content/themes/delicate/thumb.php?src= ... inc.com/jos.php: 2 Time(s)
       /wp-content/themes/delicate/thumb.php?src= ... nc.com/jack.php: 1 Time(s)
       /wp-content/themes/edupress/scripts/timthu ... et%2Findeks.php: 1 Time(s)
       /wp-content/themes/edupress/scripts/timthu ... g.ro%2Frawk.php: 1 Time(s)
       /wp-content/themes/edupress/scripts/timthu ... om%2Fupload.php: 2 Time(s)
       /wp-content/themes/mainstream/thumb.php?sr ... c.com%2Fbad.php: 1 Time(s)
       /wp-content/themes/overeasy/thumb.php?src= ... c.com%2Fbad.php: 1 Time(s)
       /wp-content/themes/pico/scripts/timthumb.p ... nc.com/jack.php: 1 Time(s)
       /wp-content/themes/skeptical/tools/timthum ... n.com%2Fbad.php: 1 Time(s)
       /wp-content/themes/themorningafter/thumb.p ... c.com%2Fbad.php: 1 Time(s)
       /wp-content/themes/u-design/scripts/timthu ... inc.com/jos.php: 1 Time(s)
       /wp-content/themes/welcome_inn/thumb.php?s ... e.com%2Fbad.php: 1 Time(s)
       /wp-content/themes/welcome_inn/thumb.php?s ... x.com/users.php: 4 Time(s)
       /wp-content/themes/welcome_inn/timthumb.ph ... n.com%2Fbad.php: 2 Time(s)
       /wp-login.php: 67 Time(s)
       /zboard.php?id=test: 1 Time(s)
       http://lists.ovirt.org/pipermail/infra/201 ... HTTP_ENV_VARS=1: 1 Time(s)
       http://lists.ovirt.org/zboard.php?id=test/ ... HTTP_ENV_VARS=1: 1 Time(s)
       http://www.ovirt.org/azenv.php: 1 Time(s)
    416 Request Range Not Satisfiable
       /releases/3.2/rpm/Fedora/18/x86_64/libgude ... 18.2.x86_64.rpm: 1 Time(s)
       /releases/3.2/rpm/Fedora/18/x86_64/vdsm-4. ... fc18.x86_64.rpm: 1 Time(s)
       /releases/beta/rpm/Fedora/18/repodata/other.xml.gz: 10 Time(s)
       /releases/beta/rpm/Fedora/18/x86_64/vdsm-4 ... fc18.x86_64.rpm: 1 Time(s)
       /releases/nightly/rpm/Fedora/17/repodata/other.xml.gz: 1 Time(s)
       /releases/nightly/rpm/Fedora/18/noarch/ovi ... fc18.noarch.rpm: 1 Time(s)
       /releases/nightly/rpm/Fedora/18/repodata/filelists.xml.gz: 1 Time(s)
       /releases/nightly/rpm/Fedora/18/repodata/other.xml.gz: 8 Time(s)
       /releases/stable/rpm/Fedora/18/i686/vdsm-4 ... 6.fc18.i686.rpm: 1 Time(s)
       /releases/stable/rpm/Fedora/18/i686/vdsm-4 ... 8.fc18.i686.rpm: 1 Time(s)
       /releases/stable/rpm/Fedora/18/noarch/ovir ... fc18.noarch.rpm: 11 Time(s)
       /releases/stable/rpm/Fedora/18/noarch/vdsm ... fc18.noarch.rpm: 20 Time(s)
       /releases/stable/rpm/Fedora/18/repodata/other.xml.gz: 83 Time(s)
       /releases/stable/rpm/Fedora/18/x86_64/libg ... 18.2.x86_64.rpm: 18 Time(s)
       /releases/stable/rpm/Fedora/18/x86_64/vdsm ... fc18.x86_64.rpm: 2 Time(s)
 
 ---------------------- httpd End ------------------------- 

 
 --------------------- Postfix Begin ------------------------ 

        5   *Warning: Pre-queue content-filter connection overload 
 
    5.218M  Bytes accepted                         5,471,691
  186.008M  Bytes delivered                      195,043,607
 ========   ================================================
 
      856   Accepted                                  99.07%
        8   Rejected                                   0.93%
 --------   ------------------------------------------------
      864   Total                                    100.00%
 ========   ================================================
 
        4   Reject relay denied                       50.00%
        4   Reject unknown user                       50.00%
 --------   ------------------------------------------------
        8   Total Rejects                            100.00%
 ========   ================================================
 
      451   Connections made      
       25   Connections lost      
      451   Disconnections        
      840   Removed from queue    
      260   Delivered             
    33814   Sent via SMTP         
        3   Forwarded             
       51   Deferred              
      517   Deferrals             
       25   Bounce (remote)       
       16   Expired and returned to sender 
       41   DSNs undeliverable    
 
      712   Connection failure (outbound) 
       19   Timeout (inbound)     
       11   Hostname verification errors 
      264   Enabled PIX workaround 
 
 
 
 ---------------------- Postfix End ------------------------- 

 
 --------------------- SSHD Begin ------------------------ 

 
 Users logging in through sshd:
    gerrit-backup:
       107.22.212.69 (gerrit.ovirt.org): 3 times
    jenkins:
       93.186.181.42 (jenkins.ekohl.nl): 2 times
    jslave:
       23.20.17.161 (ec2-23-20-17-161.compute-1.amazonaws.com): 1 time
    mburns:
       24.63.186.29 (c-24-63-186-29.hsd1.vt.comcast.net): 2 times
 
 
 Received disconnect:
    11: Bye Bye : 2210 Time(s)
    11: disconnected by user : 4 Time(s)
 
 SFTP subsystem requests: 3 Time(s)
 
 **Unmatched Entries**
 Disconnecting: Change of username or service not allowed: (nickname,ssh-connection) -> (name,ssh-connection) : 1 time(s)
 Disconnecting: Change of username or service not allowed: (sharon,ssh-connection) -> (aron,ssh-connection) : 1 time(s)
 Disconnecting: Change of username or service not allowed: (username,ssh-connection) -> (user,ssh-connection) : 1 time(s)
 Disconnecting: Change of username or service not allowed: (mcedit,ssh-connection) -> (edit,ssh-connection) : 1 time(s)
 Disconnecting: Change of username or service not allowed: (kathi,ssh-connection) -> (at,ssh-connection) : 1 time(s)
 
 ---------------------- SSHD End ------------------------- 

 
 --------------------- Sudo (secure-log) Begin ------------------------ 

 
 ==============================================================================
 
 mburns => root
 --------------
 /bin/cp - 1 Times.
 /bin/mv - 7 Times.
 /bin/rm - 1 Times.
 /usr/bin/createrepo - 2 Times.
 
 ---------------------- Sudo (secure-log) End ------------------------- 

 
 --------------------- Disk Space Begin ------------------------ 

 Filesystem            Size  Used Avail Use% Mounted on
 /dev/xvda              48G   45G  2.9G  94% /
 
 /dev/xvda => 94% Used. Warning. Disk Filling up.
 
 ---------------------- Disk Space End ------------------------- 

 
 ###################### Logwatch End ######################### 

 



More information about the Infra mailing list