Apache error_log file

[Dustin Decker]

On Thu, 9 May 2002, jose sanchez wrote:

> Hello:
> 
> Today I was checking a webserver's error_log file I
> have running at work and this is snippet of it. This
> server doesn't get much traffic or is not supposed to.
> But I am concern about some of the errors here. Can
> someone explain what are they? Is anyone trying to
> hack into it?
> 
> I also noticed that the httpd daemon was restarted. I
> don't know how. The machine's uptime is 13 days and
> the httpd server was restarted early this morning.
> 
> Thanks in advance for your help.
> 
> [Wed May  8 03:10:59 2002] [error] [client
> 65.56.130.171] File does not 
> exist: /var/www/html/scripts/root.exe

This is a server infected with the Nimda worm actively scanning for the 
presense of root.exe on your machine.  (Or a clever cracker posing as 
the same.)

[snip]

> (Red-Hat/Linux) mod_ssl/2.8.4 OpenSSL/0.9.6b DAV/1.0.2
> PHP/4.0.6 mod_perl/1.24_01 
> configured -- resuming normal operations
> [Wed May  8 04:03:14 2002] [notice] suEXEC mechanism
> enabled (wrapper: 
> /usr/sbin/suexec)

Server restarting as part of the logrotate stuff going on with your Red 
Hat installation.

> 172.139.41.181] File does 
> not exist: /var/www/html/maintain

Someone lookng for the www.yourdomain.com/maintain url - which doesn't 
exist.

Dustin

-- 
No sense being pessimistic.  It wouldn't work anyway.