SOLVED File does not exist: /var/www/html/index.php

[Nirjonadda]

I see this error randomly, Please let me know this fix. I see only index.html in /var/www/html/ directory. How to re-adding index.php files?

[Thu Aug 31 15:02:37.526893 2017] [:error] [pid 2193:tid 140073118959360] [client 27.73.202.239:53164] File does not exist: /var/www/html/index.php

 

[cPanelMichael]

Hello,

Could you provide some more details about where you see this error message? Are there any entries before or after that error line in the Apache error log?

Thank you.

 

[Nirjonadda]

Hello,

Could you provide some more details about where you see this error message? Are there any entries before or after that error line in the Apache error log?

Thank you.

This error in /usr/local/apache/logs/error_log

[Sun Sep 03 09:14:56.076624 2017] [proxy_fcgi:error] [pid 6771:tid 139786085988096] (70008)Partial results are valid but processing is incomplete: [client 119.30.47.116:52412] AH01075: Error dispatching request to : (reading input brigade), referer:
[Sun Sep 03 09:15:29.414608 2017] [:error] [pid 6771:tid 139785607603968] [client 94.75.219.9:53604] File does not exist: /var/www/html/index.php
[Sun Sep 03 09:19:51.708256 2017] [:error] [pid 7400:tid 139785683138304] [client 94.75.219.9:54156] File does not exist: /var/www/html/index.php
[Sun Sep 03 09:25:22.440252 2017] [:error] [pid 7124:tid 139785850992384] [client 94.75.219.9:54843] File does not exist: /var/www/html/index.php
[Sun Sep 03 09:27:30.573752 2017] [:error] [pid 9125:tid 139785892955904] [client 171.255.214.190:2629] File does not exist: /var/www/html/index.php
[Sun Sep 03 09:28:19.264356 2017] [:error] [pid 9288:tid 139785641174784] [client 171.255.214.190:3155] File does not exist: /var/www/html/index.php
[Sun Sep 03 09:35:02.752870 2017] [:error] [pid 9451:tid 139785775458048] [client 171.255.214.190:51758] File does not exist: /var/www/html/index.php
[Sun Sep 03 09:37:26.220963 2017] [:error] [pid 9451:tid 139786027239168] [client 171.255.214.190:52018] File does not exist: /var/www/html/index.php
[Sun Sep 03 09:42:39.228017 2017] [:error] [pid 9451:tid 139785850992384] [client 171.255.214.190:5669] File does not exist: /var/www/html/index.php
[Sun Sep 03 09:49:09.494380 2017] [:error] [pid 9288:tid 139785582425856] [client 171.255.214.190:7301] File does not exist: /var/www/html/index.php
[Sun Sep 03 09:51:37.748865 2017] [:error] [pid 9451:tid 139786027239168] [client 171.255.214.190:7737] File does not exist: /var/www/html/index.php
[Sun Sep 03 09:56:55.141736 2017] [:error] [pid 11090:tid 139785607603968] [client 171.255.214.190:8351] File does not exist: /var/www/html/index.php
[Sun Sep 03 09:57:48.820199 2017] [proxy_fcgi:error] [pid 9451:tid 139786269165312] (103)Software caused connection abort: [client 101.2.164.106:27220] AH01075: Error dispatching request to : (reading input brigade), referer:

 

[cPanelMichael]

Hello,

If none of your scripts or web pages are referencing "/var/www/html/index.php", then it's possible someone is simply attempting to access a file path that does not exist over the server's shared IP address. Thus, the error message correctly shows the "File does not exist: /var/www/html/index.php" message.

Thank you.

 

[WorkinOnIt]

Hello

I am seeing a similar error

But it shows this error against my own server IP (example 12.345.67.89).

[:error] [pid 17567] [client 12.345.67.89:39902] File does not exist: /var/www/html/code.php

Is there a way to trace the error using the PID ?

 

[cPanelMichael]

Hello,

If it's your server's IP address, try searching the files within the home directories of your accounts to see if any of them are referencing that file path. EX:

grep -rnw '/home/' -e 'code.php'

Thank you.

 

[WorkinOnIt]

Thanks @cPanelMichael

That brought back too many results - many legit.

I think the issue is, somewhere in one of dozens of accounts, a file is calling to a "code.php" which doesn't exist.

I checked all accounts error logs and cannot find any account showing that error.

Is there a way to identify the offender using process ID... [pid 17341] - or any other suggestions?

 

[cPanelMichael]

That brought back too many results - many legit.

It's unlikely the process ID is still active, so I'm not sure how much it will help. You could try using the specific path, as it's not a standard file location on cPanel servers and thus you may see fewer search results:

grep -rnw '/home/' -e '/var/www/html/code.php'

Thank you.

 

[WorkinOnIt]

Thanks - I finally found the issue - it was a hacked website :-(

Client suspended and problem solved for now (with another one to deal with!)

 

[Miguel G]

@WorkinOnIt how did you track down where the requests were coming? I am experiencing exactly the same issue