gweather & mgetmetar.pl (Return too soon)

[Mike Vanecek]

On Mon, 14 Jun 2004 07:06:58 +0800, Ed Greshko wrote
> On Mon, 2004-06-14 at 06:43, Mike Vanecek wrote:
> > On Sun, 13 Jun 2004 13:21:36 +0800, Ed Greshko wrote
> > > On Sun, 2004-06-13 at 08:53, Mike Vanecek wrote:
> > > 
> > > > > Q1 - Does /var/www/cgi-bin/mgetmetar.pl  exist?
> > > > 
> > > > Not anywhere on my system. Also, have not been able to find a copy via the
> > > > normal search places.
> > > 
> > > Well, that explains the messages you are seeing in your logs.  
> > > Someone is requesting that cgi program...and it doesn't exist.
> > 
> > Quite so, which brings us full circle back to my original post:
> > 
> > # grep -i mgetmetar.pl /usr/libexec/gweather-applet-2
> > Binary file /usr/libexec/gweather-applet-2 matches
> > 
> > shows that gweather references mgetmetar.pl.
> 
> Sorry, I hit return too soon....
> 
> If you check the gweather applet more closely you will see...
> 
> $ strings /usr/libexec/gweather-applet-2 | grep mgetm
> http://weather.noaa.gov/cgi-bin/mgetmetar.pl?cccc=%s
> 
> Showing that it is calling mgetmetar on an external site...
> 
> So.....
> 
> > Thus the thrust of the problem ...

Arggg .... quite right, thank you.

So back to square 1 - how do I find out from where the call to
/var/www/cgi-bin/mgetmetar.pl originates. I guess I can grep every file on my
system (that will take a while)? The originating ip is internal implying a
local program?