What log tells me what servers are trying to connect to me

Question

I'm running on a CentOS box.

There's something (a cron job, Jenkins job, not sure) that's hitting my server but I don't know which server. Every 5 minutes, I see some log msgs like this:

2017-03-31 08:49:15,696 - [INFO] - from application in Timer-1 
Application: checkBD2Health end - true

2017-03-31 08:54:13,878 - [INFO] - from application in Timer-1 
ChartManager: getIncompleteJobs request select chartID,userEmail from dashboard.saved_charts_staging where queryComplete = 0

2017-03-31 08:54:14,545 - [INFO] - from application in Timer-1 
ChartManager: getIncompleteJobs success with 0 incomplete jobs.

2017-03-31 08:54:14,545 - [INFO] - from application in Timer-1 
ChartManager: Checked QueryNow background jobs.

2017-03-31 08:54:14,546 - [INFO] - from application in Timer-1 
Application: checkBD2Health initial - true

2017-03-31 08:54:14,546 - [INFO] - from application in Timer-1 
Application: bd2Endpoint

2017-03-31 08:54:14,546 - [INFO] - from application in Timer-1 
Application: bd2Endpoint - http://server.domainname.com:9090/job/request?dataSource=impala&webDataFormat=CSV&sqlStatement=select count(*) from bigdata.cmdb

2017-03-31 08:54:15,631 - [INFO] - from application in Timer-1 
Application: checkBD2Health - 200 count(*)
27066092


2017-03-31 08:54:15,632 - [INFO] - from application in Timer-1 
Application: checkBD2Health end - true

2017-03-31 08:59:13,878 - [INFO] - from application in Timer-1 
ChartManager: getIncompleteJobs request select chartID,userEmail from dashboard.saved_charts_staging where queryComplete = 0

I went to server.domainname.com to look for a job called bd2Endpoint and checkBD2Health but didn't find anything in Jenkins or in the service account's crontab.

I tried to check the /var/log/secure file but the times someone accessed the server via ssh didn't match with the times in the log.

In any case, back to my initial question, is there a way to tell who or what connected to my server that's not ssh?

Answer 1

netstat -pan Will show the ports in use and the process that's using them.

watch netstat -pan Will display that info dynamically and may help you figure out what's hitting your server.