Many "plesk kernel" messages in /var/log/messages?

[james1940]

Good morning,

I have got a new server with plesk installed and got many many log messages in my /var/log/messages. Here is a small portion:

[root@plesk log]# tail /var/log/messages
Feb 26 03:03:40 plesk kernel: audit(1172480616.018:91593490): avc: denied { connectto } for pid=6279 comm="httpd" path=000000008B1E34524756E536DB1D126A5358A52E90889B5F020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 scontext=root:system_r:httpd_t tcontext=user_u:system_r:initrc_t tclass=unix_stream_socket
Feb 26 03:03:40 plesk kernel: audit(1172480616.019:91593491): avc: denied { connectto } for pid=6279 comm="httpd" path=000000008B1E34524756E536DB1D126A5358A52E90889B5F020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 scontext=root:system_r:httpd_t tcontext=user_u:system_r:initrc_t tclass=unix_stream_socket
Feb 26 03:03:40 plesk kernel: audit(1172480616.029:91593492): avc: denied { connectto } for pid=8519 comm="httpd" path=000000008B1E34524756E536DB1D126A5358A52E90889B5F020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 scontext=root:system_r:httpd_t tcontext=user_u:system_r:initrc_t tclass=unix_stream_socket
Feb 26 03:03:40 plesk kernel: audit(1172480616.030:91593493): avc: denied { connectto } for pid=8519 comm="httpd" path=000000008B1E34524756E536DB1D126A5358A52E90889B5F020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 scontext=root:system_r:httpd_t tcontext=user_u:system_r:initrc_t tclass=unix_stream_socket
Feb 26 03:03:40 plesk kernel: audit(1172480616.032:91593494): avc: denied { connectto } for pid=10678 comm="httpd" path=000000008B1E34524756E536DB1D126A5358A52E90889B5F010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 scontext=root:system_r:httpd_t tcontext=user_u:system_r:initrc_t tclass=unix_stream_socket
Feb 26 03:03:40 plesk kernel: audit(1172480616.037:91593495): avc: denied { connectto } for pid=10185 comm="httpd" path=000000008B1E34524756E536DB1D126A5358A52E90889B5F010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 scontext=root:system_r:httpd_t tcontext=user_u:system_r:initrc_t tclass=unix_stream_socket
Feb 26 03:03:40 plesk kernel: audit(1172480616.040:91593496): avc: denied { connectto } for pid=9045 comm="httpd" path=000000008B1E34524756E536DB1D126A5358A52E90889B5F0200000000000000000000000000000000000000000000000000000000000000005358A52E90889B5F010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 scontext=root:system_r:httpd_t tcontext=user_u:system_r:initrc_t tclass=unix_stream_socket
Feb 26 03:03:40 plesk kernel: audit(1172480616.614:91593536): avc: denied { connectto } for pid=11368 comm="httpd" path=000000008B1E34524756E536DB1D126A5358A52E90889B5F020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 scontext=root:system_r:httpd_t tcontext=user_u:system_r:initrc_t tclass=unix_stream_socket
Feb 26 03:03:40 plesk kernel: audit(1172480616.616:91593537): avc: denied { connectto } for pid=8777 comm="httpd" path=000000008B1E34524756E536DB1D126A5358A52E90889B5F020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 scontext=root:system_r:httpd_t tcontext=user_u:system_r:initrc_t tclass=unix_stream_socket
Feb 26 03:03:40 plesk kernel: audit(1172480616.628:91593538): avc: denied { connectto } for pid=8897 comm="httpd" path=000000008B1E34524756E536DB1D126A5358A52E90889B5F010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 scontext=root:system_r:httpd_t tcontext=user_u:system_r:initrc_t tclass=unix_stream_socket

Does anybody know what these messages mean (i get about 10 messages per second)?

Thank you

 

[atomicturtle]

selinux ftw!

Youve got some high weirdness going on there with the path dumped out as hex. Converting that to ascii comes back with garbage. Wild guess here, but maybe frontpage?

 

[phatPhrog]

We had a some of this in our logs and after looking at /var/log/secure and our mod_security logs found the log entries were linked to frontpage and/or some other type of Windows script attempts.