How to detect PHP's fsockopen on your server logs?

Question

As stated in the Title.

How can I detect an incoming connection from PHP's fsockopen method in my web server logs?

Which log file records this activity if it gets recorded at all.

Server: Ubuntu 16.04 upto 20.04

I've tried Nginx access.logs, but I think this is a different kind of connection and is not being recorded there.

An example PHP script:

<?php

@fsockopen("anydomain.tld", 80, $errorNo, $errorStr, 3);

score 0 · Answer 1 · answered Sep 04 '20 at 16:07

0

It could be possible to tune nginx error_log level so that it contains the details you are looking for.

However, there will be a lot of other logging included too.

These kinds of requests end up in the main nginx error.log, since there is no HTTP request and therefore no virtual host information.

I recommend you to actually describe what exactly you are looking for, so that we can recommend better approaches for it.

answered Sep 04 '20 at 16:07

Tero Kilkanen

I'm looking to detect this action from a PHP script on my nginx/sever logs. – droplet Sep 05 '20 at 12:14
Sorry, but that does not describe the real objective. Why do you want to detect this action? What will you do with the information? – Tero Kilkanen Sep 05 '20 at 20:16

1 Answers1