| Private Hosting Questions about VPS, dedicated servers and colocation. |
![]() |
|
|
LinkBack | Thread Tools | Search this Thread |
|
|
#1 (permalink) |
|
Registered User
Seasoned Poster
Joined in Aug 2005
40 posts
Gave thanks: 0
Thanked 0 times
|
Tip: Check those logs!!
Howdy,
I though I'd post this since the logwatch package doesn't seem to be installed on the VPS boxes. Since it's extremely important to stay on top of things when you're managing a dedicated or virtual server this may help some. For those who aren't familiar with it, Logwatch is a package that monitors system logs and sends out a daily email digests...accounting information, failed logins, disk space reports etc. So, lets get started! The first step is to visit the official logwatch site ( http://www2.logwatch.org:8080/tabs/download/ ) and download the latest stable binary. As of this posting, it's version 7.2.1: ftp://ftp.kaybee.org/pub/redhat/RPMS...1-2.noarch.rpm The easiest way to accomplish this is to SSH to your VPS machine and run this command: Code:
jgs@vps.diis.net [~]# wget ftp://ftp.kaybee.org/pub/redhat/RPMS/noarch/logwatch-7.2.1-2.noarch.rpm Code:
root@vps [~]# rpm -ivh --test logwatch-7.2.1-2.noarch.rpm Code:
root@vps [~]# rpm -ivh logwatch-7.2.1-2.noarch.rpm Code:
root@vps [~]# updatedb & Code:
root@vps [~]# vi /usr/share/logwatch/default.conf/logwatch.conf Code:
# The default detail level for the report. # This can either be Low, Med, High or a number. # Low = 0 # Med = 5 # High = 10 Detail = High Code:
mailer = "/usr/lib/sendmail -t" Code:
root@vps [/etc/cron.daily]# ln -s /usr/sbin/logwatch /etc/cron.daily/logwatch Code:
root: your_email@host.com Happy VPSing! ![]() Code:
################### Logwatch 7.2.1 (01/18/06) ####################
Processing Initiated: Tue Mar 14 00:16:05 2006
Date Range Processed: yesterday
( 2006-Mar-13 )
Period is day.
Detail Level of Output: 10
Type of Output: unformatted
Logfiles for Host: vps.diis.net
##################################################################
--------------------- Cron Begin ------------------------
Commands Run:
User mailman:
/usr/bin/python -S /usr/local/cpanel/3rdparty/mailman/cron/checkdbs: 1 Time(s)
/usr/bin/python -S /usr/local/cpanel/3rdparty/mailman/cron/disabled: 1 Time(s)
/usr/bin/python -S /usr/local/cpanel/3rdparty/mailman/cron/nightly_gzip: 1 Time(s)
/usr/bin/python -S /usr/local/cpanel/3rdparty/mailman/cron/senddigests: 1 Time(s)
User root:
/scripts/cpbackup: 1 Time(s)
/scripts/exim_tidydb > /dev/null 2>&1: 1 Time(s)
/scripts/upcp: 1 Time(s)
/usr/local/bandmin/bandmin: 48 Time(s)
/usr/local/bandmin/ipaddrmap: 1 Time(s)
/usr/local/cpanel/bin/dcpumon >/dev/null 2>&1: 288 Time(s)
/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1: 96 Time(s)
personal crontab listed: 3 Time(s)
personal crontab reloaded: 1 Time(s)
personal crontab replaced: 1 Time(s)
run-parts /etc/cron.daily: 1 Time(s)
run-parts /etc/cron.hourly: 24 Time(s)
---------------------- Cron End -------------------------
--------------------- pam_unix Begin ------------------------
sshd:
Authentication Failures:
unknown (61-219-243-114.hinet-ip.hinet.net): 254 Time(s)
unknown (dns.telung-trading.com.tw): 254 Time(s)
unknown (dvq194.internetdsl.tpnet.pl): 254 Time(s)
unknown (ip68-10-189-150.hr.hr.cox.net): 144 Time(s)
root (61-219-243-114.hinet-ip.hinet.net): 30 Time(s)
root (dns.telung-trading.com.tw): 30 Time(s)
root (dvq194.internetdsl.tpnet.pl): 30 Time(s)
adm (61-219-243-114.hinet-ip.hinet.net): 2 Time(s)
adm (dns.telung-trading.com.tw): 2 Time(s)
adm (dvq194.internetdsl.tpnet.pl): 2 Time(s)
apache (61-219-243-114.hinet-ip.hinet.net): 2 Time(s)
apache (dns.telung-trading.com.tw): 2 Time(s)
apache (dvq194.internetdsl.tpnet.pl): 2 Time(s)
bin (61-219-243-114.hinet-ip.hinet.net): 2 Time(s)
bin (dns.telung-trading.com.tw): 2 Time(s)
bin (dvq194.internetdsl.tpnet.pl): 2 Time(s)
daemon (61-219-243-114.hinet-ip.hinet.net): 2 Time(s)
daemon (dns.telung-trading.com.tw): 2 Time(s)
daemon (dvq194.internetdsl.tpnet.pl): 2 Time(s)
ftp (61-219-243-114.hinet-ip.hinet.net): 2 Time(s)
ftp (dns.telung-trading.com.tw): 2 Time(s)
ftp (dvq194.internetdsl.tpnet.pl): 2 Time(s)
games (61-219-243-114.hinet-ip.hinet.net): 2 Time(s)
games (dns.telung-trading.com.tw): 2 Time(s)
games (dvq194.internetdsl.tpnet.pl): 2 Time(s)
gopher (61-219-243-114.hinet-ip.hinet.net): 2 Time(s)
gopher (dns.telung-trading.com.tw): 2 Time(s)
gopher (dvq194.internetdsl.tpnet.pl): 2 Time(s)
halt (61-219-243-114.hinet-ip.hinet.net): 2 Time(s)
halt (dns.telung-trading.com.tw): 2 Time(s)
halt (dvq194.internetdsl.tpnet.pl): 2 Time(s)
lp (61-219-243-114.hinet-ip.hinet.net): 2 Time(s)
lp (dns.telung-trading.com.tw): 2 Time(s)
lp (dvq194.internetdsl.tpnet.pl): 2 Time(s)
mail (61-219-243-114.hinet-ip.hinet.net): 2 Time(s)
mail (dns.telung-trading.com.tw): 2 Time(s)
mail (dvq194.internetdsl.tpnet.pl): 2 Time(s)
mailman (61-219-243-114.hinet-ip.hinet.net): 2 Time(s)
mailman (dns.telung-trading.com.tw): 2 Time(s)
mailman (dvq194.internetdsl.tpnet.pl): 2 Time(s)
mailnull (61-219-243-114.hinet-ip.hinet.net): 2 Time(s)
mailnull (dns.telung-trading.com.tw): 2 Time(s)
mailnull (dvq194.internetdsl.tpnet.pl): 2 Time(s)
mysql (61-219-243-114.hinet-ip.hinet.net): 2 Time(s)
mysql (dns.telung-trading.com.tw): 2 Time(s)
mysql (dvq194.internetdsl.tpnet.pl): 2 Time(s)
named (61-219-243-114.hinet-ip.hinet.net): 2 Time(s)
named (dns.telung-trading.com.tw): 2 Time(s)
named (dvq194.internetdsl.tpnet.pl): 2 Time(s)
news (61-219-243-114.hinet-ip.hinet.net): 2 Time(s)
news (dns.telung-trading.com.tw): 2 Time(s)
news (dvq194.internetdsl.tpnet.pl): 2 Time(s)
nobody (61-219-243-114.hinet-ip.hinet.net): 2 Time(s)
nobody (dns.telung-trading.com.tw): 2 Time(s)
nobody (dvq194.internetdsl.tpnet.pl): 2 Time(s)
operator (61-219-243-114.hinet-ip.hinet.net): 2 Time(s)
operator (dns.telung-trading.com.tw): 2 Time(s)
operator (dvq194.internetdsl.tpnet.pl): 2 Time(s)
popa3d (61-219-243-114.hinet-ip.hinet.net): 2 Time(s)
popa3d (dns.telung-trading.com.tw): 2 Time(s)
popa3d (dvq194.internetdsl.tpnet.pl): 2 Time(s)
rpc (61-219-243-114.hinet-ip.hinet.net): 2 Time(s)
rpc (dns.telung-trading.com.tw): 2 Time(s)
rpc (dvq194.internetdsl.tpnet.pl): 2 Time(s)
rpm (61-219-243-114.hinet-ip.hinet.net): 2 Time(s)
rpm (dns.telung-trading.com.tw): 2 Time(s)
rpm (dvq194.internetdsl.tpnet.pl): 2 Time(s)
shutdown (61-219-243-114.hinet-ip.hinet.net): 2 Time(s)
shutdown (dns.telung-trading.com.tw): 2 Time(s)
shutdown (dvq194.internetdsl.tpnet.pl): 2 Time(s)
smmsp (61-219-243-114.hinet-ip.hinet.net): 2 Time(s)
smmsp (dns.telung-trading.com.tw): 2 Time(s)
smmsp (dvq194.internetdsl.tpnet.pl): 2 Time(s)
sshd (61-219-243-114.hinet-ip.hinet.net): 2 Time(s)
sshd (dns.telung-trading.com.tw): 2 Time(s)
sshd (dvq194.internetdsl.tpnet.pl): 2 Time(s)
sync (61-219-243-114.hinet-ip.hinet.net): 2 Time(s)
sync (dns.telung-trading.com.tw): 2 Time(s)
sync (dvq194.internetdsl.tpnet.pl): 2 Time(s)
uucp (61-219-243-114.hinet-ip.hinet.net): 2 Time(s)
uucp (dns.telung-trading.com.tw): 2 Time(s)
uucp (dvq194.internetdsl.tpnet.pl): 2 Time(s)
webadmin (61-219-243-114.hinet-ip.hinet.net): 2 Time(s)
webadmin (dns.telung-trading.com.tw): 2 Time(s)
webadmin (dvq194.internetdsl.tpnet.pl): 2 Time(s)
Invalid Users:
Unknown Account: 1194 Time(s)
Sessions Opened:
jgs: 29 Time(s)
Unknown Entries:
2 more authentication failures; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=ip68-10-x.x.hr.hr.cox.net : 144 Time(s)
---------------------- pam_unix End -------------------------
--------------------- Connections (secure-log) Begin ------------------------
Connections:
Service pop3 [Connection(s) per day]:
127.0.0.1 (localhost): 172 Time(s)
Total Connections: 172
---------------------- Connections (secure-log) End -------------------------
--------------------- SSHD Begin ------------------------
Didn't receive an ident from these IPs:
61.219.243.114 (61-219-243-114.HINET-IP.hinet.net): 2 Time(s)
62.75.240.124 (vs240124.vserver.de): 2 Time(s)
65.254.63.248: 2 Time(s)
Failed logins from:
59.124.127.103 (dns.telung-trading.com.tw): 80 times
root/password: 30 times
adm/password: 2 times
apache/password: 2 times
bin/password: 2 times
daemon/password: 2 times
ftp/password: 2 times
games/password: 2 times
gopher/password: 2 times
halt/password: 2 times
lp/password: 2 times
mail/password: 2 times
mailman/password: 2 times
mailnull/password: 2 times
mysql/password: 2 times
named/password: 2 times
news/password: 2 times
nobody/password: 2 times
operator/password: 2 times
rpc/password: 2 times
rpm/password: 2 times
shutdown/password: 2 times
smmsp/password: 2 times
sshd/password: 2 times
sync/password: 2 times
uucp/password: 2 times
webadmin/password: 2 times
61.219.243.114 (61-219-243-114.HINET-IP.hinet.net): 80 times
root/password: 30 times
adm/password: 2 times
apache/password: 2 times
bin/password: 2 times
daemon/password: 2 times
ftp/password: 2 times
games/password: 2 times
gopher/password: 2 times
halt/password: 2 times
lp/password: 2 times
mail/password: 2 times
mailman/password: 2 times
mailnull/password: 2 times
mysql/password: 2 times
named/password: 2 times
news/password: 2 times
nobody/password: 2 times
operator/password: 2 times
rpc/password: 2 times
rpm/password: 2 times
shutdown/password: 2 times
smmsp/password: 2 times
sshd/password: 2 times
sync/password: 2 times
uucp/password: 2 times
webadmin/password: 2 times
83.19.254.194 (dvq194.internetdsl.tpnet.pl): 80 times
root/password: 30 times
adm/password: 2 times
apache/password: 2 times
bin/password: 2 times
daemon/password: 2 times
ftp/password: 2 times
games/password: 2 times
gopher/password: 2 times
halt/password: 2 times
lp/password: 2 times
mail/password: 2 times
mailman/password: 2 times
mailnull/password: 2 times
mysql/password: 2 times
named/password: 2 times
news/password: 2 times
nobody/password: 2 times
operator/password: 2 times
rpc/password: 2 times
rpm/password: 2 times
shutdown/password: 2 times
smmsp/password: 2 times
sshd/password: 2 times
sync/password: 2 times
uucp/password: 2 times
webadmin/password: 2 times
Illegal users from:
59.124.127.103 (dns.telung-trading.com.tw): 256 times
admin/password: 14 times
test/password: 10 times
admins/password: 4 times
guest/password: 4 times
info/password: 4 times
pgsql/password: 4 times
richard/password: 4 times
sales/password: 4 times
user/password: 4 times
username/password: 4 times
web/password: 4 times
webmaster/password: 4 times
adam/password: 2 times
administrator/password: 2 times
agent/password: 2 times
alan/password: 2 times
alex/password: 2 times
alias/password: 2 times
amanda/password: 2 times
amavisd/password: 2 times
angel/password: 2 times
appowner/password: 2 times
appserver/password: 2 times
aptproxy/password: 2 times
backup/password: 2 times
brett/password: 2 times
clamav/password: 2 times
core/password: 2 times
cyrus/password: 2 times
cyrusimap/password: 2 times
dan/password: 2 times
danny/password: 2 times
data/password: 2 times
david/password: 2 times
dean/password: 2 times
desktop/password: 2 times
divine/password: 2 times
eleve/password: 2 times
eppc/password: 2 times
frank/password: 2 times
ftpuser/password: 2 times
george/password: 2 times
gnats/password: 2 times
harrypotter/password: 2 times
http/password: 2 times
httpd/password: 2 times
ident/password: 2 times
identd/password: 2 times
irc/password: 2 times
jabber/password: 2 times
james/password: 2 times
jeff/password: 2 times
john/password: 2 times
library/password: 2 times
linux/password: 2 times
list/password: 2 times
master/password: 2 times
michael/password: 2 times
mike/password: 2 times
newsletter/password: 2 times
nfsnobody/password: 2 times
office/password: 2 times
oracle/password: 2 times
party/password: 2 times
paul/password: 2 times
pop/password: 2 times
popa3d/password: 2 times
postfix/password: 2 times
postgres/password: 2 times
postmaster/password: 2 times
proxy/password: 2 times
qtss/password: 2 times
radiomail/password: 2 times
recruit/password: 2 times
robert/password: 2 times
rpcuser/password: 2 times
samba/password: 2 times
sara/password: 2 times
search/password: 2 times
securityagent/password: 2 times
sgi/password: 2 times
shop/password: 2 times
snort/password: 2 times
spam/password: 2 times
ssh/password: 2 times
staff/password: 2 times
stephen/password: 2 times
steven/password: 2 times
sunny/password: 2 times
susan/password: 2 times
sys/password: 2 times
telnetd/password: 2 times
tokend/password: 2 times
tomcat/password: 2 times
tony/password: 2 times
unknown/password: 2 times
users/password: 2 times
virus/password: 2 times
visitor/password: 2 times
webpop/password: 2 times
windowserver/password: 2 times
workshop/password: 2 times
www-data/password: 2 times
www/password: 2 times
wwwrun/password: 2 times
xgridagent/password: 2 times
xgridcontroller/password: 2 times
zzz/password: 2 times
61.219.243.114 (61-219-243-114.HINET-IP.hinet.net): 256 times
admin/password: 14 times
test/password: 10 times
admins/password: 4 times
guest/password: 4 times
info/password: 4 times
pgsql/password: 4 times
richard/password: 4 times
sales/password: 4 times
user/password: 4 times
username/password: 4 times
web/password: 4 times
webmaster/password: 4 times
adam/password: 2 times
administrator/password: 2 times
agent/password: 2 times
alan/password: 2 times
alex/password: 2 times
alias/password: 2 times
amanda/password: 2 times
amavisd/password: 2 times
angel/password: 2 times
appowner/password: 2 times
appserver/password: 2 times
aptproxy/password: 2 times
backup/password: 2 times
brett/password: 2 times
clamav/password: 2 times
core/password: 2 times
cyrus/password: 2 times
cyrusimap/password: 2 times
dan/password: 2 times
danny/password: 2 times
data/password: 2 times
david/password: 2 times
dean/password: 2 times
desktop/password: 2 times
divine/password: 2 times
eleve/password: 2 times
eppc/password: 2 times
frank/password: 2 times
ftpuser/password: 2 times
george/password: 2 times
gnats/password: 2 times
harrypotter/password: 2 times
http/password: 2 times
httpd/password: 2 times
ident/password: 2 times
identd/password: 2 times
irc/password: 2 times
jabber/password: 2 times
james/password: 2 times
jeff/password: 2 times
john/password: 2 times
library/password: 2 times
linux/password: 2 times
list/password: 2 times
master/password: 2 times
michael/password: 2 times
mike/password: 2 times
newsletter/password: 2 times
nfsnobody/password: 2 times
office/password: 2 times
oracle/password: 2 times
party/password: 2 times
paul/password: 2 times
pop/password: 2 times
popa3d/password: 2 times
postfix/password: 2 times
postgres/password: 2 times
postmaster/password: 2 times
proxy/password: 2 times
qtss/password: 2 times
radiomail/password: 2 times
recruit/password: 2 times
robert/password: 2 times
rpcuser/password: 2 times
samba/password: 2 times
sara/password: 2 times
search/password: 2 times
securityagent/password: 2 times
sgi/password: 2 times
shop/password: 2 times
snort/password: 2 times
spam/password: 2 times
ssh/password: 2 times
staff/password: 2 times
stephen/password: 2 times
steven/password: 2 times
sunny/password: 2 times
susan/password: 2 times
sys/password: 2 times
telnetd/password: 2 times
tokend/password: 2 times
tomcat/password: 2 times
tony/password: 2 times
unknown/password: 2 times
users/password: 2 times
virus/password: 2 times
visitor/password: 2 times
webpop/password: 2 times
windowserver/password: 2 times
workshop/password: 2 times
www-data/password: 2 times
www/password: 2 times
wwwrun/password: 2 times
xgridagent/password: 2 times
xgridcontroller/password: 2 times
zzz/password: 2 times
68.10.189.150 (ip68-10-189-150.hr.hr.cox.net): 432 times
u39202017/password: 288 times
u39202017/none: 144 times
83.19.254.194 (dvq194.internetdsl.tpnet.pl): 256 times
admin/password: 14 times
test/password: 10 times
admins/password: 4 times
guest/password: 4 times
info/password: 4 times
pgsql/password: 4 times
richard/password: 4 times
sales/password: 4 times
user/password: 4 times
username/password: 4 times
web/password: 4 times
webmaster/password: 4 times
adam/password: 2 times
administrator/password: 2 times
agent/password: 2 times
alan/password: 2 times
alex/password: 2 times
alias/password: 2 times
amanda/password: 2 times
amavisd/password: 2 times
angel/password: 2 times
appowner/password: 2 times
appserver/password: 2 times
aptproxy/password: 2 times
backup/password: 2 times
brett/password: 2 times
clamav/password: 2 times
core/password: 2 times
cyrus/password: 2 times
cyrusimap/password: 2 times
dan/password: 2 times
danny/password: 2 times
data/password: 2 times
david/password: 2 times
dean/password: 2 times
desktop/password: 2 times
divine/password: 2 times
eleve/password: 2 times
eppc/password: 2 times
frank/password: 2 times
ftpuser/password: 2 times
george/password: 2 times
gnats/password: 2 times
harrypotter/password: 2 times
http/password: 2 times
httpd/password: 2 times
ident/password: 2 times
identd/password: 2 times
irc/password: 2 times
jabber/password: 2 times
james/password: 2 times
jeff/password: 2 times
john/password: 2 times
library/password: 2 times
linux/password: 2 times
list/password: 2 times
master/password: 2 times
michael/password: 2 times
mike/password: 2 times
newsletter/password: 2 times
nfsnobody/password: 2 times
office/password: 2 times
oracle/password: 2 times
party/password: 2 times
paul/password: 2 times
pop/password: 2 times
popa3d/password: 2 times
postfix/password: 2 times
postgres/password: 2 times
postmaster/password: 2 times
proxy/password: 2 times
qtss/password: 2 times
radiomail/password: 2 times
recruit/password: 2 times
robert/password: 2 times
rpcuser/password: 2 times
samba/password: 2 times
sara/password: 2 times
search/password: 2 times
securityagent/password: 2 times
sgi/password: 2 times
shop/password: 2 times
snort/password: 2 times
spam/password: 2 times
ssh/password: 2 times
staff/password: 2 times
stephen/password: 2 times
steven/password: 2 times
sunny/password: 2 times
susan/password: 2 times
sys/password: 2 times
telnetd/password: 2 times
tokend/password: 2 times
tomcat/password: 2 times
tony/password: 2 times
unknown/password: 2 times
users/password: 2 times
virus/password: 2 times
visitor/password: 2 times
webpop/password: 2 times
windowserver/password: 2 times
workshop/password: 2 times
www-data/password: 2 times
www/password: 2 times
wwwrun/password: 2 times
xgridagent/password: 2 times
xgridcontroller/password: 2 times
zzz/password: 2 times
Users logging in through sshd:
SOMEONE:
68.10.x.x (ip68-10-x.x.hr.hr.cox.net): 29 times
Setting tty modes failed:
Invalid argument : 1 Time(s)
SFTP subsystem requests: 2 Time(s)
**Unmatched Entries**
User popa3d not allowed because shell /dev/null is not executable : 6 time(s)
---------------------- SSHD End -------------------------
--------------------- Disk Space Begin ------------------------
Filesystem Size Used Avail Use% Mounted on
/tmp 9.6G 4.4G 5.3G 46% /var/tmp
/dev/vzfs 9.6G 4.4G 5.3G 46% /
---------------------- Disk Space End -------------------------
###################### Logwatch End #########################
|
|
|
|
|
|
#2 (permalink) |
|
Registered User
Seasoned Poster
Joined in Aug 2004
76 posts
Gave thanks: 0
Thanked 0 times
|
Absolutely excellent post. Many thanks!!!
__________________
server : VPS (?) Xoops Media Streaming and Project Management Modules PHP and Client/Server Development |
|
|
|
|
|
#3 (permalink) |
|
Surpass Fan
On a golden path...
Joined in Feb 2006
Lives in Arizona
344 posts
Gave thanks: 3
Thanked 16 times
|
Very nice - thanks. I just followed your directions and hope to have an email tomorrow
![]() (man -- I had to google vi commands...its been too long) ![]()
__________________
"Argue for your limitations, and sure enough, they are yours" |
|
|
|
|
|
#5 (permalink) |
|
Registered User
Comfy Contributor
Joined in Oct 2004
Lives in Reykjavík/Toronto
Hosted on Pass16/18
168 posts
Gave thanks: 0
Thanked 0 times
|
What OS is installed on a VPS? It isn't Centos 4.2 like the reseller servers? Would a "yum install logwatch" do the job in one shot including any dependencies? I ran it on my home Centos server and it did the job in one step including downloading..
__________________
Pass16 Pass39 |
|
|
|
|
|
#6 (permalink) |
|
All Ur Base R Belong 2 Us
Excelling Contributor
Joined in Feb 2005
Lives in Vegas & New York
824 posts
Gave thanks: 2
Thanked 6 times
|
I'm assuming it's probably CentOS. If anything you can just type the command and see if it works. If not, no harm done, just a "yum not found" message
__________________
Nobody doing nothing |
|
|
|
|
|
#9 (permalink) |
|
All Ur Base R Belong 2 Us
Excelling Contributor
Joined in Feb 2005
Lives in Vegas & New York
824 posts
Gave thanks: 2
Thanked 6 times
|
Hey Kayla, notice how his profile info is squeezed in and made smaller for his first post, that wouldn't happen with the stuff on top *cough* lol
:P
__________________
Nobody doing nothing |
|
|
|