Web Hosting Talk : Web Hosting Main Forums : Hosting Security and Technology : accessed pages

[feliper]

Hi, I need see which pages this ip 41.178.234.167 has accessed a particular site, how i make it?


I use:
OS: CentOS
core2quad/8GB ram/2x750GB HD
WHM+cPanel

[boxer]

cat /etc/hosts; and see if there the ip; if not go to the list account and you should see the cPanel account which use this ip there.

[hostechsupport]

You can see that by using following command:

grep 41.178.234.167 /usr/local/apache/logs/access_log

It probably will give you access logs of this particular IP on your server.

[feliper]

I try use "grep 41.178.234.167 /usr/local/apache/logs/access_log" but see anything.

root@flash [~]# grep 41.178.234.167 /usr/local/apache/logs/access_log
root@flash [~]# grep '41.178.234.167' /usr/local/apache/logs/access_log
root@flash [~]#

[boxer]

Is you use cPanel just list the account name page and see if there any account use that ip; if not and your ip located to your range so it's a free ip; you can check it by going to "change account ip" and you will see it listed there.

[feliper]

I think I do not understand, I need to know what pages were accessed by ip 41.178.234.167 on my site.

[boxer]

There is nothing i think,

http://www.bing.com/search?q=ip%3A%2241.178.234.167%22&go=&form=QBRE&filt=all

[feliper]

I am not able to express myself, look problen:

IP 41.178.234.167 have access in my software of control accounts(WHMCS), and i need see what pages this ip access in WHMCS.

understand?

I need view access log of apache and locate folow pages this ip access in my WHMCS.

[boxer]

ah man! what version of WHMCS you have ?

if you log in as root ~ssh run the command

whois 41.178.234.167

and see if the ip is related to your range ip; if not; check your ip address

www.showip.com; if it not your ip; change your password for admin panel WHMCS; and contact whmcs.com to check if you have the latest version or not, i think some attacker has log/get your password or bypass your adminpanel by any 0d4y exploit;

/boxer

[feliper]

boxer u not understand me, look I need know where should I look at the server access logs of apache.

[boxer]

tail -f /usr/local/apache/logs/error_log

[jamjam]

Originally Posted by feliper

I try use "grep 41.178.234.167 /usr/local/apache/logs/access_log" but see anything.

root@flash [~]# grep 41.178.234.167 /usr/local/apache/logs/access_log
root@flash [~]# grep '41.178.234.167' /usr/local/apache/logs/access_log
root@flash [~]#

If you saw nothing most likely that IP did not visited your site

[energizedit]

Why do you think this IP visited your server? If it isn't showing up with a grep to the access log either your logging is broken or they didn't access any page on your server.

[VMhostsTech]

Hello,

Please note that the main log file for apache on a cPanel server is /usr/local/apache/logs/access_log. You can also check the Domain Access Logs:/usr/local/apache/domlogs/domain.com for each domain hosted on the server for any traces of the IP. If both the files do not contain the IP then you can be sure that the IP didn't access the different pages of your websites.

[SPaReK]

Originally Posted by VMhostsTech

Hello,

Please note that the main log file for apache on a cPanel server is /usr/local/apache/logs/access_log. You can also check the Domain Access Logs:/usr/local/apache/domlogs/domain.com for each domain hosted on the server for any traces of the IP. If both the files do not contain the IP then you can be sure that the IP didn't access the different pages of your websites.

Unless the domlogs and access logs are rotated out or cleared after statistic runs.