[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: logwatch?



On Sun, 2007-01-21 at 09:37 -0500, Jeffrey Ross wrote:
> When logwatch reports that a host probed the server, what information 
> does it use to determine that?  I tried to grep for the IP address
> that did the probing in /var/log/* and came up empty handed.

I've only seen that when the webserver has been accessed by a non-LAN
address.  I haven't looked into what it considers to be an external
address, I presume it's using the netmask.

e.g. If a server's at 192.168.1.6 with a netmask of 255.255.255.0, then
anything from 192.168.1.0 to 192.168.1.255 is on the LAN, anything else
is considered external.

Do you run a webserver?  Is it accessible externally?  Do you want it to
be?

-- 
(Currently running FC4, in case that's important to the thread)

Don't send private replies to my address, the mailbox is ignored.
I read messages from the public lists.


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]