Question
Why is apache pointing to other IP address?
- Posted on March 14, 2017
- ApacheDNSLoggingDebian
Asked by paulomorais1981
Hy, my apache2 server is not responding. When I access my server, it gives me an error, and when I try to start the server via ssh it also gives an error too.
service apache2 start
[....] Starting web server: apache2Action 'start' failed.
The Apache error log may have more information.
failed!
When I write tail /var/log/apache2/error.log.1, it returns my that message, between others:
[Fri Mar 10 11:25:03 2017] [error] [client 62.210.170.90] File does not exist: /var/www/mysql
The problem is that i don’t recognize this IP 62.210.170.90, and I don’t know why it’s registered in the log file.
This and other IP’s adresses are appearing at the log, and it’s not mine.
What can be happening?
Thx.
This textbox defaults to using Markdown to format your answer.
You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!
These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.
Well, for some reason i don’t really no, the error.log wais saying that apache2 was unable to access the error_log file. I created the error_log empty file at the local it seemed to be pointed (another one at /var/www/logs/error_log) and the server could now restart. Now the problem is solved.
When I try to restar apache, I get this:
When I type “tail /var/log/error.log.1”, i get this:
That’s it. I believe it’s something malicious that cracked my server. I don’t recognize anyone of theses IP addresses.
Hope this information is helpful.
@paulomorais1981
To see what’s going on, if you can run:
… and paste the output in to a code block, we can take a look for you.
The error you’re seeing in line you pasted simply states that
/var/www/mysqldoesn’t exist as a file, which is why it was logged. As far as what was trying to access it, other that the IP logged, it’s hard to say without more information.