how to investigate Firewall blocked outbound TCP

Question

CentOS webserver with CSF (Config Server Firewall) running. Blocking all outbound / Inbound traffic except listed ports 80 81 22 21 etc. for web, mail & FTP services etc.

I'm use to seeing heaps of Inbound blocks from hackers etc. but seeing the below outbound block & appreciate suggestions on where to look to try & discover what is causing this traffic.

Sep 26 12:40:28 thor kernel: Firewall: *TCP_OUT Blocked* IN= OUT=eth0 SRC=xx.xx.xx.xx DST=54.241.137.2 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=54974 DF PROTO=TCP SPT=49907 DPT=31000 WINDOW=14600 RES=0x00 SYN URGP=0 UID=509 GID=509

My server XX is the SRC source IP & destination IP seems to belong to Amazon web services.
The UID GID listed in log is that of user with hosted website but cant see anything obvious in site. I presume there must be some kind of script trying to contact AWS.

Answer 1

How I resolves this just incase it may be helpful to anyone.

After some reading/googling I used the below to track down the source of outbound packets that were been blocked.

UID is mentioned in the Firewall log UID=509

awk -v val=509 -F ":" '$3==val{print $1}' /etc/passwd

This gave the user name, I then did a grep on user account for amazon, as IP belonged to amazon AWS

grep -r amazon /home/username

There was a bit of data to go thru so piped it to a file for further perusal.

grep -r amazon /home/username >/home/filename

WARNING make sure you don't save file to same dir you are grepping or you will get an infinite growing file.

Turned out to be a WordPress plugin, updraftplus, trying to backup users website to amazon cloud on a blocked outbound port.