Apache error log has reams of "host: command not found"

Discussion in 'ISPConfig 3 Priority Support' started by Taleman, Aug 5, 2021.

  1. Taleman

    Taleman Well-Known Member HowtoForge Supporter

    On one of my ISPConfig 3.2.5 hosts running Debian GNU/Linux 10.latest, I have lines like this in apache error log:
    Code:
    sh: host: command not found
    There is no shortatge of those lines:
    Code:
    [email protected]:/etc# grep "host: command" /var/log/apache2/error.log | wc -l
    35735
    
    I checker older error log files, they all have these lines. Oldest log lines I had was from 22rd of July.
    I do not have the host command installed on this machine, and I understand I could get rid of those error messages if I installed it. But I want to find the script that constantly tries to run that command.
     
  2. till

    till Super Moderator Staff Member ISPConfig Developer

    Are there any lines in the log in direct relation to this like a restart or reload of apache?
     
  3. Taleman

    Taleman Well-Known Member HowtoForge Supporter

    No restarts or reloads.
    I tried to see what is in log before the command not found lines, but I think this can not work. There are other lines, but there are so many command not found lines that I can not say that one particular kind of log line is before them. And there are contigous chunks of command not found lines with so I think the script that causes this writes nothing to log.
     
  4. till

    till Super Moderator Staff Member ISPConfig Developer

    Ok, just wanted to ensure that it's not related to an apache restart. But it's in the global apache error.log, right? So it can't be from a specific website in ISPConfig.
     
  5. Taleman

    Taleman Well-Known Member HowtoForge Supporter

    Yes, the /var/log/apache2/error.log file.
    I think it is not started from cron, since it happens more than 1 minute intervals. Checked the cron files nonetheless but did not find host commands.
     
  6. Chris_UK

    Chris_UK Active Member HowtoForge Supporter

    What about the access logs? are they equally frequent?
     
  7. Taleman

    Taleman Well-Known Member HowtoForge Supporter

  8. till

    till Super Moderator Staff Member ISPConfig Developer

    Personally, I would just install the missing host command. All of my servers that run a web server have it installed.
     
  9. Chris_UK

    Chris_UK Active Member HowtoForge Supporter

    I have to say I agree, but if you really want to know for sure, you might grep "host" in the apache and www directories to see where its coming from. At least you can then be sure that its nothing to be concerned about.
     
  10. Chris_UK

    Chris_UK Active Member HowtoForge Supporter

    Sorry taleman, I didnt mean the log count, i meant comparing the log time stamps to see if there is a corresponding access to the web server that triggers the command. (to eliminate it hopefully)
     
  11. Taleman

    Taleman Well-Known Member HowtoForge Supporter

    The command not found lines do no have timestamps.
     
  12. Chris_UK

    Chris_UK Active Member HowtoForge Supporter

    Seems strange, on searching it seems they are related to dns lookups. Likely to be nothing to worry about in that case.

    Can you gauge from other timestamps how often they are running? X per hour or minute or whatever
     

Share This Page