topic Re: Web Server Access: Identifying connections in Operating System - HP-UX

Web Server Access: Identifying connections

Sanjay Verma — Thu, 21 Nov 2002 07:29:49 GMT

Hi Friends,

I've Web server configured on HP-UX 11.0. I normally view the syslog file to identify the connection being made to the server. But when I access the server from the web through a specific port e.g, 5020, I can not see any entry in the syslog file.

Is there any way I can identify the connections being made to my web server?

Regards,
Sanjay

Re: Web Server Access: Identifying connections

U.SivaKumar_2 — Thu, 21 Nov 2002 08:25:34 GMT

Hi,

What webserver are you running ? Apache server has access logs .

regards,
U.SivaKumar

Re: Web Server Access: Identifying connections

Bill McNAMARA_1 — Thu, 21 Nov 2002 08:38:45 GMT

try
netstat -an | grep 5020
and
netstat -a | grep 5020

Your web server may have and access_log to id connections and requests also.

Later,
Bill

Re: Web Server Access: Identifying connections

kish_1 — Thu, 21 Nov 2002 09:58:02 GMT

In apache server check access_log and you can enable HostnameLookups On on httpd.conf

Re: Web Server Access: Identifying connections

Oleg Zieaev_1 — Thu, 21 Nov 2002 19:33:01 GMT

Hello.

You can see users connections in access_log, error_log for Apache.
If you want to see on the unix level, netstat or lsof -i tcp | grep -i established | grep 5020 will do the trick.

Hope this helps,
0leg

Re: Web Server Access: Identifying connections

Sanjay Verma — Thu, 21 Nov 2002 22:23:42 GMT

Hi Friends,
Web Logic 6.1 is configured on the HP-UX machine. Just like we trace the IP's connecting to the system from syslog.log file, I would like to capture the IP's connecting to my Web Logic server.

Re: Web Server Access: Identifying connections

Oleg Zieaev_1 — Thu, 21 Nov 2002 22:51:51 GMT

lsof is a way to do it.
run
lsof -i tcp@your_host_name:5020

don't have lsof -
http://hpux.ee.ualberta.ca/hppd/hpux/Sysadmin/lsof-4.64/

Hope this helps.
0leg

Re: Web Server Access: Identifying connections

Sanjay Verma — Thu, 21 Nov 2002 23:09:18 GMT

Hi Oleg,

I get the following output after giving the lsof command:

#lsof -i tcp

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
java 19920 myapp 49u inet 0x516e7b80 0t0 TCP *:5020 (LISTEN)

#lsof -i tcp@myhost:5020
=> NO OUTPUT

Although the first command indicates that port 5020 is in LISTEN mode. I would like to identify as what connections (IP Address of the intruder) are being made to this port and from which IP address.

Re: Web Server Access: Identifying connections

Jeff Schussele — Thu, 21 Nov 2002 23:13:24 GMT

Hi Sanjay,

WebLogic uses .properties files as it's configuration files.
I don't have a WebLogic manual handy, but I think that you should be able set something in that file to turn on connection logging.
Check your manual or access the support pages at bea.com

Rgds,
Jeff

Re: Web Server Access: Identifying connections

Sanjay Verma — Thu, 21 Nov 2002 23:54:13 GMT

yes Jeff, I'm digging my head in the docs and will appreciate to have your findings too.

Re: Web Server Access: Identifying connections

Jeff Schussele — Fri, 22 Nov 2002 00:53:41 GMT

Well, I'm not having much luck finding that exact piece of info.

Here's the link to the 6.1 admin guide:

http://edocs.bea.com/wls/docs61/adminguide/index.html

And here's the link to the logging section specifically:

http://edocs.bea.com/wls/docs61/adminguide/logging.html#1029443

But I am not able to bring up an admin console on my WL6.1 server. The app admins have the PW - we sys admins don't.

And here's the the section you really need - the web server section:

http://edocs.bea.com/wls/docs61/adminguide/web_server.html#113868

Sure looks to me like you can set this up via the Admin Console GUI.

Sorry I couldn't be more helpful.

Rgds,
Jeff

Re: Web Server Access: Identifying connections

U.SivaKumar_2 — Fri, 22 Nov 2002 03:51:08 GMT

Re: Web Server Access: Identifying connections

Sanjay Verma — Fri, 22 Nov 2002 04:14:44 GMT

Hi Siva,

Thanks for providing the comprehensive information. I went through the complete list but could not the location where the log files are logged?

Would you be able to indicate whether the files will be logged?

Rgds, Sanjay

Re: Web Server Access: Identifying connections

Sanjay Verma — Fri, 22 Nov 2002 05:04:21 GMT

Hi Friends,

Let me explain what the critical problem I am faxing.

User connects to the Web Server to access the Oracle database through PeopleSoft (PIA) architecture.

Now, users can connect to the Web Server if they are connecting through port 9000 or 9010 but not able to connect when trying to connect through port 5020 which in turns directs them to the production server.

Any idea whey users can not see the page when connected through port 5020 but able to connect when coming through port 9000 or 9010.

I've checked everything on the Unix box and no restrictions etc. have been defined. Also services, inetd.sec & inetd.conf files does not contain any specific information about these ports or services.

Going crazyyyyyyyyyyyyyy

Re: Web Server Access: Identifying connections

Sanjay Verma — Mon, 25 Nov 2002 06:22:42 GMT

Hello Friends,

Achieved the desired result. The steps mentioned in the following url is really useful:
http://edocs.bea.com/wls/docs61/adminguide/web_server.html#113868

Also, following the following steps to achieve the results:

(a) Go to the respective domain directory under Weblogic folder:
/opt/weblogic/6.10/config/mydomain

(b) Modify config.xml file
(c) Set LoggingEnabled=true
(d) Save and exit
(e) /opt/weblogic/6.10/config/mydomain/logs directory
(f) The new "access.log" file will be created which will contain all the access information.

Cheers,
Sanjay