> servers. Some perl scripts are trying to delete log > files by trying out various options but getting > permission denied messages. We have tried to locate
Can you elaborate here please? How did you come to know that they are perl scripts? How did you conclude that those perl scripts are trying to delete your logs? 758 Public IPs is massive number and if they are scattered in different geographic locations it is even more strange. This makes me believe that there is an internal compromise (unintentional or otherwise) on httpd (assuming Apache here). Check for any CGI scripts or any URL patterns and post the logs please. -- ________________________________________ -----BEGIN GEEK CODE BLOCK----- Version: 3.1 GCS/>M d- s++:+ a- C++(++++) ULBS++++$ P+++>$ L+++$ E+ W++ N++ O! M! V! PS+ PE+ Y+ PGP>+++ 5! X! R- !tv b++(+++) DI+++ D-- G-- e++>++++ h r+ y+ ------END GEEK CODE BLOCK------ -----------------------------------------------------------------
