webalizer

[hunt695]

Hi guys,
After last cpanel update I keep getting these for several of my domains on VPS:

User:username_goes_here PID:29195 PPID:29194 Run Time:7(secs) Memory:150112(kb) RSS:2708(kb) exe:/usr/local/cpanel/3rdparty/webalizer/bin/english cmd:/usr/local/cpanel/3rdparty/webalizer/bin/english -N 10 -D /home/username_goes_here/tmp/webalizer/ssl/username_goes_here.com/dns_cache.db -R 250 -p -n username_goes_here.com -o /home/username_goes_here/tmp/webalizer/ssl/username_goes_here.com /etc/apache2/logs/domlogs/username_goes_here.com-ssl_log.bkup

Anyone have a clue what it is and how to fix this?
Thank you

 

[cPRex]

Hey there! Can you get me some more details - where exactly are you seeing this on the system? Are these in the domlogs for the domain?

 

[hunt695]

Oh sorry, I havent specified. I get server emails containing that thing.
Will check the domlogs and get back to you.

 

[lightduty]

Hi guys,
After last cpanel update I keep getting these for several of my domains on VPS:

User:username_goes_here PID:29195 PPID:29194 Run Time:7(secs) Memory:150112(kb) RSS:2708(kb) exe:/usr/local/cpanel/3rdparty/webalizer/bin/english cmd:/usr/local/cpanel/3rdparty/webalizer/bin/english -N 10 -D /home/username_goes_here/tmp/webalizer/ssl/username_goes_here.com/dns_cache.db -R 250 -p -n username_goes_here.com -o /home/username_goes_here/tmp/webalizer/ssl/username_goes_here.com /etc/apache2/logs/domlogs/username_goes_here.com-ssl_log.bkup

Anyone have a clue what it is and how to fix this?

Most likely is some setting that was introduced with the update.
Wait a little bit more to get a more detailed response.

 

[hunt695]

Hey there! Can you get me some more details - where exactly are you seeing this on the system? Are these in the domlogs for the domain?

Well, I'll just copy/pasta domlog if you can interpret this:

87.250.224.184 - - [03/Apr/2022:16:09:16 +0200] "GET /robots.txt HTTP/1.1" 301 246 "-" "Mozilla/5.0 (compatible; YandexBot/3.0; +How can I add a site to search? - Webmaster. Help)"
95.108.213.71 - - [03/Apr/2022:16:09:20 +0200] "GET / HTTP/1.1" 301 236 "-" "Mozilla/5.0 (compatible; YandexBot/3.0; +How can I add a site to search? - Webmaster. Help)"
34.209.232.6 - - [03/Apr/2022:18:21:15 +0200] "GET / HTTP/1.1" 301 236 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.97 Safari/537.36"
54.201.217.87 - - [03/Apr/2022:18:24:28 +0200] "GET /favicon.ico HTTP/1.1" 301 247 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.97 Safari/537.36"
54.201.217.87 - - [03/Apr/2022:18:24:32 +0200] "GET / HTTP/1.1" 301 236 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.97 Safari/537.36"
34.209.125.26 - - [03/Apr/2022:18:31:00 +0200] "GET / HTTP/1.1" 301 236 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.97 Safari/537.36"
54.201.217.87 - - [03/Apr/2022:18:31:39 +0200] "GET /favicon.ico HTTP/1.1" 301 247 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.97 Safari/537.36"
54.201.217.87 - - [03/Apr/2022:18:31:44 +0200] "GET / HTTP/1.1" 301 236 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.97 Safari/537.36"
77.77.150.95 - - [03/Apr/2022:18:52:08 +0200] "GET /wp-login.php HTTP/1.1" 301 253 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
66.33.212.126 - - [03/Apr/2022:20:46:28 +0200] "GET /wp-login.php HTTP/1.1" 301 248 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
69.171.249.19 - - [03/Apr/2022:21:06:35 +0200] "GET /wp-content/uploads/2020/08/WhatsApp-Image-2020-08-17-at-16.16.51.jpeg HTTP/1.1" 301 305 "-" "facebookexternalhit/1.1 (+External User Agent Text - Help For Webmasters | Facebook)"
114.119.137.174 - - [04/Apr/2022:00:29:29 +0200] "GET /robots.txt HTTP/1.1" 301 246 "-" "Mozilla/5.0 (compatible;PetalBot;+Webmaster certification site)"
93.140.135.102 - - [04/Apr/2022:04:58:35 +0200] "GET /?fbclid=IwAR3imeve6C2pi7SEKcsfwrJQWWw15Yw8D0re1SkbvV2g5dbLX7weiI1e7WE HTTP/1.1" 301 305 "http://m.facebook.com" "Mozilla/5.0 (iPhone; CPU iPhone OS 15_3_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/19D52 [FBAN/FBIOS;FBDV/iPhone14,2;FBMD/iPhone;FBSN/iOS;FBSV/15.3.1;FBSS/3;FBID/phone;FBLC/en_GB;FBOP/5]"
54.73.194.192 - - [04/Apr/2022:05:52:03 +0200] "GET / HTTP/1.1" 301 236 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:81.0) Gecko/20100101 Firefox/81.0"
211.208.31.24 - - [04/Apr/2022:06:10:00 +0200] "GET /temp/license.txt HTTP/1.1" 301 252 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
198.46.81.49 - - [04/Apr/2022:07:07:25 +0200] "GET /.well-known/pki-validation/167AE465B05DA62ECA52682512F85F30.txt HTTP/1.1" 404 - "-" "COMODO DCV"
198.46.81.49 - - [04/Apr/2022:07:07:25 +0200] "GET /.well-known/pki-validation/C9E37C9142CA80B8276262430D361063.txt HTTP/1.1" 404 - "-" "COMODO DCV"
198.46.81.49 - - [04/Apr/2022:07:07:25 +0200] "GET /.well-known/pki-validation/07E4447BEC0145AA437A40ACD4E0829E.txt HTTP/1.1" 404 - "-" "COMODO DCV"
164.68.97.162 - - [04/Apr/2022:07:07:25 +0200] "GET /.well-known/pki-validation/CD897BD8DE0FD07F1E3E88A2FFD3FBD0.txt HTTP/1.1" 404 - "-" "COMODO DCV"
164.68.97.162 - - [04/Apr/2022:07:07:26 +0200] "GET /.well-known/pki-validation/E139CCF285B905A5C0245648966C7EC2.txt HTTP/1.1" 404 - "-" "COMODO DCV"
164.68.97.162 - - [04/Apr/2022:07:07:26 +0200] "GET /.well-known/pki-validation/6E66BD10C01AD678FAE132CBFF6123CF.txt HTTP/1.1" 404 - "-" "COMODO DCV"
164.68.97.162 - - [04/Apr/2022:07:07:26 +0200] "GET /.well-known/pki-validation/51C07F5D16701FCF41BCBB63778BFC0D.txt HTTP/1.1" 404 - "-" "COMODO DCV"
164.68.97.162 - - [04/Apr/2022:07:07:26 +0200] "GET /.well-known/pki-validation/A7FB51ACF9905D427B1DA06E61134240.txt HTTP/1.1" 404 - "-" "COMODO DCV"
194.38.20.161 - - [04/Apr/2022:07:48:37 +0200] "GET /assets/admin/plugins/plupload/examples/upload.php HTTP/1.1" 301 285 "-" "ALittle Client"

and in SSL_log I have a whole buch of these:
93.140.135.102 - - [04/Apr/2022:04:58:36 +0200] "GET /vendor/js/fancybox.min.js HTTP/1.1" 200 22013 "https://domain_name_here.com/?fbclid=IwAR3imeve6C2pi7SEKcsfwrJQWWw15Yw8D0re1SkbvV2g5dbLX7weiI1e7WE" "Mozilla/5.0 (iPhone; CPU iPhone OS 15_3_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/19D52 [FBAN/FBIOS;FBDV/iPhone14,2;FBMD/iPhone;FBSN/iOS;FBSV/15.3.1;FBSS/3;FBID/phone;FBLC/en_GB;FBOP/5]"

Anything to worry about?

 

[cPRex]

That all looks like normal traffic to me - I don't see anything concerning there.

 

[lightduty]

Anything to worry about?

There is no problem with your traffic.

That all looks like normal traffic to me - I don't see anything concerning there.

Yes that's what i thought.