Take the 2-minute tour ×

I've been seeing the following log entry in /var/log/mysqld.log and am trying to pinpoint the source of the request:

130313 10:10:48 [Warning] Access denied for user 'admin'@'localhost' (using password: YES)

This started on Monday evening right on 8pm and continued until last night at 23:59:57, once every minute (roughly).

I thought that was the end of it until it started back up again this morning at 10:00:03, again, every minute.

I am running CentOS 5.9 X64 with Plesk 11 and Atomicorp's ASL security system.

I have went through all Cron tasks, none start at 8pm nor 10am and the only hourly ones are run through PHP and don't use admin as the login.

I have also, one by one, disabled services to try to figure it out, the following didn't make a difference when off:

httpd xinetd sshd psmon named crond couriercpd postfix

I have also enabled verbose logging with mySQL using the General Query Log, but it doesn't show anything of use.

Can anyone suggest a way of tracking down the source of these attempted logins? Or even to show the password the system is trying to connect with?

That way, I can figure out if it is friend or foe.


share|improve this question
add comment

1 Answer

up vote 0 down vote accepted

Apparently, since the source of the connection is made through a socket, neither mySQL or any Linux Kernel can identify the source.

I'm now working with Atomicorp (www.atomicorp.com) as they are developing a kernel patch which will allow this to be traced in the future.

share|improve this answer
add comment

Your Answer


