I'm running on a CentOS box.
There's something (a cron job, Jenkins job, not sure) that's hitting my server but I don't know which server. Every 5 minutes, I see some log msgs like this:
2017-03-31 08:49:15,696 - [INFO] - from application in Timer-1
Application: checkBD2Health end - true
2017-03-31 08:54:13,878 - [INFO] - from application in Timer-1
ChartManager: getIncompleteJobs request select chartID,userEmail from dashboard.saved_charts_staging where queryComplete = 0
2017-03-31 08:54:14,545 - [INFO] - from application in Timer-1
ChartManager: getIncompleteJobs success with 0 incomplete jobs.
2017-03-31 08:54:14,545 - [INFO] - from application in Timer-1
ChartManager: Checked QueryNow background jobs.
2017-03-31 08:54:14,546 - [INFO] - from application in Timer-1
Application: checkBD2Health initial - true
2017-03-31 08:54:14,546 - [INFO] - from application in Timer-1
Application: bd2Endpoint
2017-03-31 08:54:14,546 - [INFO] - from application in Timer-1
Application: bd2Endpoint - http://server.domainname.com:9090/job/request?dataSource=impala&webDataFormat=CSV&sqlStatement=select count(*) from bigdata.cmdb
2017-03-31 08:54:15,631 - [INFO] - from application in Timer-1
Application: checkBD2Health - 200 count(*)
27066092
2017-03-31 08:54:15,632 - [INFO] - from application in Timer-1
Application: checkBD2Health end - true
2017-03-31 08:59:13,878 - [INFO] - from application in Timer-1
ChartManager: getIncompleteJobs request select chartID,userEmail from dashboard.saved_charts_staging where queryComplete = 0
I went to server.domainname.com to look for a job called bd2Endpoint and checkBD2Health but didn't find anything in Jenkins or in the service account's crontab.
I tried to check the /var/log/secure file but the times someone accessed the server via ssh didn't match with the times in the log.
In any case, back to my initial question, is there a way to tell who or what connected to my server that's not ssh?