API-RPC - Request more details

[Frank.P]

Username:

TITLE

API-RPC - Request more details

PRODUCT, VERSION, OPERATING SYSTEM, ARCHITECTURE

Last version

PROBLEM DESCRIPTION

php_error.log with a lot of request

[2026-11-08 14:07:33] 23072:6af07414bfb71 INFO C:\Program Files (x86)\Plesk\admin\plib\api-rpc\Agent.php:52 [api-rpc][] Incoming API-RPC request [f8a20618ae764f23eaa9cbad370cc18b]:
<?xml version="1.0" encoding="UTF-8"?>
<packet version="1.6.5.0">
<server>
<get>
<admin/>
</get>
</server>
</packet>

STEPS TO REPRODUCE

-

ACTUAL RESULT

the request show:

[2026-11-08 14:07:33] 23072:6af07414bfb71 INFO C:\Program Files (x86)\Plesk\admin\plib\api-rpc\Agent.php:52 [api-rpc][] API-RPC response [f8a20618ae764f23eaa9cbad370cc18b]:
<?xml version="1.0" encoding="UTF-8"?>
<packet version="1.6.9.1">
<server>
<get>
<result>
<status>ok</status>
<admin>
<admin_cname/>
<admin_pname>Administrator</admin_pname>
<admin_phone/>
<admin_fax/>
<admin_email>*******@*******</admin_email>
<admin_address/>
<admin_city/>
<admin_state/>
<admin_pcode/>
<admin_country>**</admin_country>
<send_announce>false</send_announce>
<admin_locale>****</admin_locale>
<admin_multiple_sessions>true</admin_multiple_sessions>
</admin>
</result>
</get>
</server>
</packet>

EXPECTED RESULT

I expected in log more details, like ip of request, extension name or script path/url because I don't know if that request is legitimate or are try to hacking.

ANY ADDITIONAL INFORMATION

panel.ini code:
[debug]
enabled = on
api-rpc.enabled = on

[log]
show.util_exec = on
show.util_exec_io = on
show.source = true
show.thread = true
system_log = true
show.scenario = true
filter.priority = 6

YOUR EXPECTATIONS FROM PLESK SERVICE TEAM

Help with sorting out

 

[tessa67]

Hi @Frank.P

After digging into this, here's the honest answer: there is no panel.ini switch that will add IP or extension info to that specific Agent.php log line. The [log] options you've set control Plesk's general debug output, not the API-RPC agent's fixed format. So tweaking panel.ini further won't get you what you want.

What will actually tell you where the request comes from is the web server access log. Every API-RPC call hits /enterprise/control/agent.php, and that request gets logged with the source IP.

On Windows Plesk, the access log location is under the admin logs directory. Based on the Plesk forum thread about the same kind of traffic, look for lines like this:

127.0.0.1 - - [timestamp] "POST /enterprise/control/agent.php HTTP/1.1" 200 ...

Check the log file around 2026-11-08 14:07:33 and see what IP shows up next to that agent.php POST . That timestamp in your php_error.log is your anchor. Match it to the access log entry.

If the IP is 127.0.0.1, it's local. That means it's almost certainly an extension or Plesk internal process doing a health check or connectivity test. The get admin request itself is read-only. It pulls admin profile fields and returns status: ok. Nothing is being modified. In the forum thread about this exact kind of access log noise, the culprit turned out to be an extension (Patchman, Watchdog, or similar) doing automated checks . You could disable extensions one by one temporarily and see if the requests stop.

If it's an external IP, then at least you know where it's coming from and can decide whether it's something you recognize (monitoring, backup service, etc.) or something to block.

One more thing: the action log in Plesk (Tools & Settings > Action Log) records the IP of API actions, but that's for actions performed by Plesk users. It won't necessarily help with machine-to-machine API-RPC calls like this one. The access log is your best bet.

Regards
Tessa