RE: [cobalt-security] Lame Server messages

["Scott w" <webbcite@xxxxxxxxxxx>]

> It now appears to repeat
> each night in the same time slot and some if not many of the ip's are .kr.
>
> I searched the posts in this and other lists before I put my original post
> up and found nothing similar to what I'm seeing here. I'd like to think 
> that
> any good admin in this list seeing a 1000 new error messages in their logs
> would (again) question the security implications.  Who knows what the next
> exploit looks like until it happens.
>
> I'd still like to hear a good theory as to this sudden burst of activity.

You wouldn't happen to have webalizer installed??  The lame server messages 
would happen to be when cron runs webalizer for all your sites??

The same thing started happening to me after I installed the 
cobalt-aide.sourceforge Webalizer 2.01 package.  At least it is the only 
thing I could think of....

Maybe??

_________________________________________________________________
Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp