Web Server Access: Identifying connections

[Sanjay Verma]

Hi Friends,

I've Web server configured on HP-UX 11.0. I normally view the syslog file to identify the connection being made to the server. But when I access the server from the web through a specific port e.g, 5020, I can not see any entry in the syslog file.

Is there any way I can identify the connections being made to my web server?

Regards,
Sanjay

[U.SivaKumar_2]

Hi,

What webserver are you running ? Apache server has access logs .

regards,
U.SivaKumar

[Bill McNAMARA_1]

try
netstat -an | grep 5020
and
netstat -a | grep 5020

Your web server may have and access_log to id connections and requests also.

Later,
Bill

[kish_1 · Accepted solution]

In apache server check access_log and you can enable HostnameLookups On on httpd.conf

[Oleg Zieaev_1]

Hello.

You can see users connections in access_log, error_log for Apache.
If you want to see on the unix level, netstat or lsof -i tcp | grep -i established | grep 5020 will do the trick.

Hope this helps,
0leg

[Sanjay Verma]

Hi Friends,
Web Logic 6.1 is configured on the HP-UX machine. Just like we trace the IP's connecting to the system from syslog.log file, I would like to capture the IP's connecting to my Web Logic server.

[Oleg Zieaev_1]

lsof is a way to do it.
run
lsof -i tcp@your_host_name:5020

don't have lsof -
http://hpux.ee.ualberta.ca/hppd/hpux/Sysadmin/lsof-4.64/

Hope this helps.
0leg

[Sanjay Verma]

Hi Oleg,

I get the following output after giving the lsof command:

#lsof -i tcp

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
java 19920 myapp 49u inet 0x516e7b80 0t0 TCP *:5020 (LISTEN)

#lsof -i tcp@myhost:5020
=> NO OUTPUT

Although the first command indicates that port 5020 is in LISTEN mode. I would like to identify as what connections (IP Address of the intruder) are being made to this port and from which IP address.

[Jeff Schussele]

Hi Sanjay,

WebLogic uses .properties files as it's configuration files.
I don't have a WebLogic manual handy, but I think that you should be able set something in that file to turn on connection logging.
Check your manual or access the support pages at bea.com

Rgds,
Jeff

[Sanjay Verma]

yes Jeff, I'm digging my head in the docs and will appreciate to have your findings too.

[Jeff Schussele]

Well, I'm not having much luck finding that exact piece of info.

Here's the link to the 6.1 admin guide:

http://edocs.bea.com/wls/docs61/adminguide/index.html

And here's the link to the logging section specifically:

http://edocs.bea.com/wls/docs61/adminguide/logging.html#1029443

But I am not able to bring up an admin console on my WL6.1 server. The app admins have the PW - we sys admins don't.

And here's the the section you really need - the web server section:

http://edocs.bea.com/wls/docs61/adminguide/web_server.html#113868

Sure looks to me like you can set this up via the Admin Console GUI.

Sorry I couldn't be more helpful.

Rgds,
Jeff

[Sanjay Verma]

Hi Siva,

Thanks for providing the comprehensive information. I went through the complete list but could not the location where the log files are logged?

Would you be able to indicate whether the files will be logged?

Rgds, Sanjay

[Sanjay Verma]

Hi Friends,

Let me explain what the critical problem I am faxing.

User connects to the Web Server to access the Oracle database through PeopleSoft (PIA) architecture.

Now, users can connect to the Web Server if they are connecting through port 9000 or 9010 but not able to connect when trying to connect through port 5020 which in turns directs them to the production server.

Any idea whey users can not see the page when connected through port 5020 but able to connect when coming through port 9000 or 9010.

I've checked everything on the Unix box and no restrictions etc. have been defined. Also services, inetd.sec & inetd.conf files does not contain any specific information about these ports or services.

Going crazyyyyyyyyyyyyyy

[Sanjay Verma]

Hello Friends,

Achieved the desired result. The steps mentioned in the following url is really useful:
http://edocs.bea.com/wls/docs61/adminguide/web_server.html#113868

Also, following the following steps to achieve the results:

(a) Go to the respective domain directory under Weblogic folder:
/opt/weblogic/6.10/config/mydomain

(b) Modify config.xml file
(c) Set LoggingEnabled=true
(d) Save and exit
(e) /opt/weblogic/6.10/config/mydomain/logs directory
(f) The new "access.log" file will be created which will contain all the access information.

Cheers,
Sanjay