PHP Warning: PHP Startup: Unable to load dynamic library 'pdo_sqlsrv.so' (tried: /usr/lib/php/20190902/pdo_sqlsrv.so (/usr/lib/php/20190902/pdo_sqlsrv.so: undefined symbol: php_pdo_unregister_driver), /usr/lib/php/20190902/pdo_sqlsrv.so.so (/usr/lib/php/20190902/pdo_sqlsrv.so.so: cannot open shared object file: No such file or directory)) in Unknown on line 0 PHP Warning: Module 'gettext' already loaded in Unknown on line 0 PHP Warning: Module 'mbstring' already loaded in Unknown on line 0 PHP Warning: Module 'sqlsrv' already loaded in Unknown on line 0 [Sun Dec 07 00:00:02.044905 2025] [mpm_prefork:notice] [pid 1759300] AH00163: Apache/2.4.41 (Ubuntu) OpenSSL/1.1.1f configured -- resuming normal operations [Sun Dec 07 00:00:02.044919 2025] [core:notice] [pid 1759300] AH00094: Command line: '/usr/sbin/apache2' [Sun Dec 07 01:03:10.033409 2025] [php7:error] [pid 375852] [client 219.91.191.218:4626] script '/var/www/html/xmlrpc.php' not found or unable to stat [Sun Dec 07 02:47:45.855015 2025] [php7:error] [pid 375854] [client 4.217.237.240:28516] script '/var/www/html/1.php' not found or unable to stat, referer: https://www.google.de/ [Sun Dec 07 02:47:46.048800 2025] [php7:error] [pid 375854] [client 4.217.237.240:28516] script '/var/www/html/aa.php' not found or unable to stat, referer: https://www.bing.com/ [Sun Dec 07 02:47:46.248294 2025] [php7:error] [pid 375854] [client 4.217.237.240:28516] script '/var/www/html/abcd.php' not found or unable to stat, referer: https://www.google.de/ [Sun Dec 07 02:47:46.465460 2025] [php7:error] [pid 375854] [client 4.217.237.240:28516] script '/var/www/html/about.php' not found or unable to stat, referer: https://www.google.fr/ [Sun Dec 07 02:47:46.854125 2025] [php7:error] [pid 375854] [client 4.217.237.240:28516] script '/var/www/html/admin.php' not found or unable to stat, referer: https://www.google.co.uk/ [Sun Dec 07 02:47:47.101128 2025] [php7:error] [pid 375854] [client 4.217.237.240:28516] script '/var/www/html/adminfuns.php' not found or unable to stat, referer: https://www.google.com/ [Sun Dec 07 02:47:47.294888 2025] [php7:error] [pid 375854] [client 4.217.237.240:28516] script '/var/www/html/alfa.php' not found or unable to stat, referer: https://www.yahoo.com/ [Sun Dec 07 02:47:47.513628 2025] [php7:error] [pid 375854] [client 4.217.237.240:28516] script '/var/www/html/api.php' not found or unable to stat, referer: https://www.google.com/ [Sun Dec 07 02:47:47.903577 2025] [php7:error] [pid 375854] [client 4.217.237.240:28516] script '/var/www/html/bless.php' not found or unable to stat, referer: https://www.yahoo.com/ [Sun Dec 07 02:47:48.294005 2025] [php7:error] [pid 375854] [client 4.217.237.240:28516] script '/var/www/html/classwithtostring.php' not found or unable to stat, referer: https://www.google.com/ [Sun Dec 07 02:47:48.488218 2025] [php7:error] [pid 375854] [client 4.217.237.240:28516] script '/var/www/html/edit.php' not found or unable to stat, referer: https://www.bing.com/ [Sun Dec 07 02:47:48.681772 2025] [php7:error] [pid 375854] [client 4.217.237.240:28516] script '/var/www/html/file.php' not found or unable to stat, referer: https://www.google.fr/ [Sun Dec 07 02:47:48.996600 2025] [php7:error] [pid 375854] [client 4.217.237.240:28516] script '/var/www/html/goods.php' not found or unable to stat, referer: https://www.yahoo.com/ [Sun Dec 07 02:47:49.196290 2025] [php7:error] [pid 375854] [client 4.217.237.240:28516] script '/var/www/html/info.php' not found or unable to stat, referer: https://www.google.co.uk/ [Sun Dec 07 02:47:49.392217 2025] [php7:error] [pid 375854] [client 4.217.237.240:28516] script '/var/www/html/ioxi-o.php' not found or unable to stat, referer: https://www.google.co.uk/ [Sun Dec 07 02:47:49.652945 2025] [php7:error] [pid 375854] [client 4.217.237.240:28516] script '/var/www/html/manager.php' not found or unable to stat, referer: https://www.yahoo.com/ [Sun Dec 07 02:47:50.040492 2025] [php7:error] [pid 375854] [client 4.217.237.240:28516] script '/var/www/html/wp-user.php' not found or unable to stat, referer: https://www.goDec 7 00:00:02 ip-172-31-29-215 systemd[1]: logrotate.service: Succeeded. Dec 7 00:00:02 ip-172-31-29-215 systemd[1]: Finished Rotate log files. Dec 7 00:09:01 ip-172-31-29-215 CRON[375871]: (root) CMD ( [ -x /usr/lib/php/sessionclean ] && if [ ! -d /run/systemd/system ]; then /usr/lib/php/sessionclean; fi) Dec 7 00:09:12 ip-172-31-29-215 systemd[1]: Starting Clean php session files... Dec 7 00:09:12 ip-172-31-29-215 sessionclean[375884]: Cannot load Xdebug - it was already loaded Dec 7 00:09:12 ip-172-31-29-215 sessionclean[375884]: PHP Warning: PHP Startup: Unable to load dynamic library 'pdo_sqlsrv.so' (tried: /usr/lib/php/20190902/pdo_sqlsrv.so (/usr/lib/php/20190902/pdo_sqlsrv.so: undefined symbol: php_pdo_unregister_driver), /usr/lib/php/20190902/pdo_sqlsrv.so.so (/usr/lib/php/20190902/pdo_sqlsrv.so.so: cannot open shared object file: No such file or directory)) in Unknown on line 0 Dec 7 00:09:12 ip-172-31-29-215 sessionclean[375884]: PHP Warning: Module 'gettext' already loaded in Unknown on line 0 Dec 7 00:09:12 ip-172-31-29-215 sessionclean[375884]: PHP Warning: Module 'mbstring' already loaded in Unknown on line 0 Dec 7 00:09:12 ip-172-31-29-215 sessionclean[375884]: PHP Warning: Module 'sqlsrv' already loaded in Unknown on line 0 Dec 7 00:09:12 ip-172-31-29-215 systemd[1]: phpsessionclean.service: Succeeded. Dec 7 00:09:12 ip-172-31-29-215 systemd[1]: Finished Clean php session files. Dec 7 00:12:05 ip-172-31-29-215 amazon-ssm-agent.amazon-ssm-agent[3122439]: 2025-12-07 00:12:05.6942 WARN EC2RoleProvider Failed to connect to Systems Manager with instance profile role credentials. Err: retrieved credentials failed to report to ssm. Error: EC2RoleRequestError: no EC2 instance role found Dec 7 00:12:05 ip-172-31-29-215 amazon-ssm-agent.amazon-ssm-agent[3122439]: 2025-12-07 00:12:05.7384 ERROR EC2RoleProvider Failed to connect to Systems Manager with SSM role credentials. error calling RequestManagedInstanceRoleToken: AccessDeniedException: Systems Manager's instance management role is not configured for account: 227937466084 Dec 7 00:12:05 ip-172-31-29-215 amazon-ssm-agent.amazon-ssm-agent[3122439]: #011status code: 400, request id: e4c0e60a-c804-4327-b6cc-cb192363cc26 Dec 7 00:17:01 ip-172-31-29-215 CRON[375925]: (root) CMD ( cd / && run-parts --report /etc/cron.hourly) Dec 7 00:20:01 ip-172-31-29-215 CRON[375930]: (smmsp) CMD (test -x /etc/init.d/sendmail && test -x /usr/share/sendmail/sendmail && test -x /usr/lib/sm.bin/sendmail && /usr/share/sendmail/sendmail cron-msp) Dec 7 00:39:01 ip-172-31-29-215 CRON[375960]: (root) CMD ( [ -x /usr/lib/php/sessionclean ] && if [ ! -d /run/systemd/system ]; then /usr/lib/php/sessionclean; fi) Dec 7 00:39:12 ip-172-31-29-215 systemd[1]: Starting Clean php session files... Dec 7 00:39:12 ip-172-31-29-215 sessionclean[375973]: Cannot load Xdebug - it was already loaded Dec 7 00:39:12 ip-172-31-29-215 sessionclean[375973]: PHP Warning: PHP Startup: Unable to load dynamic library 'pdo_sqlsrv.so' (tried: /usr/lib/php/20190902/pdo_sqlsrv.so (/usr/lib/php/20190902/pdo_sqlsrv.so: undefined symbol: php_pdo_unregister_driver), /usr/lib/php/20190902/pdo_sqlsrv.so.so (/usr/lib/php/20190902/pdo_sqlsrv.so.so: cannot open shared object file: No such file or directory)) in Unknown on line 0 Dec 7 00:39:12 ip-172-31-29-215 sessionclean[375973]: PHP Warning: Module 'gettext' already loaded in Unknown on line 0 Dec 7 00:39:12 ip-172-31-29-215 sessionclean[375973]: PHP Warning: Module 'mbstring' already loaded in Unknown on line 0 Dec 7 00:39:12 ip-172-31-29-215 sessionclean[375973]: PHP Warning: Module 'sqlsrv' already loaded in Unknown on line 0 Dec 7 00:39:12 ip-172-31-29-215 systemd[1]: phpsessionclean.service: Succeeded. Dec 7 00:39:12 ip-172-31-29-215 systemd[1]: Finished Clean php session files. Dec 7 00:40:01 ip-172-31-29-215 CRON[376013]: (smmsp) CMD (test -x /etc/init.d/sendmail && test -x /usr/share/sendmail/sendmail && test -x /usr/lib/sm.bin/sendmail && /usr/share/sendmail/sendmail cron-msp) Dec 7 00:40:33 ip-172-31-29-215 amazon-ssm-agent.91.232.238.112 - - [07/Dec/2025:00:16:48 -0600] "GET /admin/config.php HTTP/1.0" 404 454 "-" "xfa1" 217.182.200.102 - - [07/Dec/2025:00:27:55 -0600] "GET / HTTP/1.1" 200 7173 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.80 Safari/537.36" 138.197.102.123 - - [07/Dec/2025:00:29:39 -0600] "GET /+CSCOL+/Java.jar HTTP/1.1" 404 3539 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" 138.197.102.123 - - [07/Dec/2025:00:29:39 -0600] "GET /+CSCOE+/logon_forms.js HTTP/1.1" 404 3539 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" 138.197.102.123 - - [07/Dec/2025:00:29:40 -0600] "GET /+CSCOL+/a1.jar HTTP/1.1" 404 3539 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" 138.197.102.123 - - [07/Dec/2025:00:29:40 -0600] "GET /+CSCOE+/transfer.js HTTP/1.1" 404 3539 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" 136.143.176.60 - - [07/Dec/2025:00:35:57 -0600] "GET /PCI-test/trademarks.csv HTTP/1.1" 200 37167240 "-" "Zoho_Analytics" 91.232.238.112 - - [07/Dec/2025:00:46:05 -0600] "GET /robots.txt HTTP/1.1" 404 435 "-" "Mozilla/5.0 (compatible; FreePBX-Scanner/1.0)" 135.237.126.220 - - [07/Dec/2025:00:51:37 -0600] "GET /druid/index.html HTTP/1.1" 404 435 "-" "Mozilla/5.0 zgrab/0.x" 219.91.191.218 - - [07/Dec/2025:01:03:10 -0600] "POST /xmlrpc.php HTTP/1.1" 404 4219 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/64.0.0.0 Safari/537.36" 124.156.187.113 - - [07/Dec/2025:01:04:17 -0600] "HEAD /Core/Skin/Login.aspx HTTP/1.1" 404 140 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36" 173.211.8.14 - - [07/Dec/2025:01:05:02 -0600] "GET /.env HTTP/1.1" 404 4228 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36" 173.211.8.14 - - [07/Dec/2025:01:05:03 -0600] "POST / HTTP/1.1" 200 7257 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36" 79.124.40.86 - - [07/Dec/2025:01:13:04 -0600] "HEAD / HTTP/1.0" 200 274 "-" "-" 20.65.195.118 - - [07/Dec/2025:01:17:19 -0600] "GET / HTTP/1.1" 200 3421 "-" "Mozilla/5.0 zgrab/0.x" 20.221.71.226 - - [07/Dec/2025:01:25:26 -0600] "GET /owa/auth/x.js HTTP/1.1" 404 3539 "-" "Mozilla/5.0 zgrab/0.x" 107.175.56.181 - - [07/Dec/2025:01:32:19 -0600] "GET /.env HTTP/1.1" 404 454 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36" 107.175.56.181 - - [07/Dec/2025:01:32:20 -0600] "POST / HTTP/1.1" 200 3440 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36" 135.237.123.168 - - [07/Dec/2025:01:33:44 -0600] "GET /developmentserver/metadatauploader HTTP/1.1" 404 3539 "-" "Mozilla/5.0 zgrab/0.x" 136.143.176.64 - - [07/Dec/2025:01:33:24 -0600] "GET /PCI-test/fetch_trademark_csv.php HTTP/1.1" 200 4030 "-" "Apache-HttpClient/4.5.13 (Java/17.0.17)" 136.143.177.62 - - [07/Dec/2025:01:36:06 -0600] "GET /PCI-test/trademarks.csv HTTP/1.1" 200 37167240 "-" "Zoho_Analytics" 95.214.52.170 - - [07/Dec/2025:01:45:56 -0600] "POST / HTTP/1.1" 200 3440 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" 172.236.228.202 - - [07/Dec/2025:01:46:09 -0600] "\x16\x03\x01\x01\n" 400 488 "-" "-" 172.236.228.202 - - [07/Dec/2025:01:46:10 -0600] "\x16\x03\x01\x01\n" 400 488 "-" "-" 91.232.238.106 - - [07/Dec/2025:01:52:02 -0600] "GET /robots.txt HTTP/1.0" 404 454 "-" "xfa1" 91.232.238.106 - - [07/Dec/2025:02:05:11 -0600] "GET /robots.txt HTTP/1.0" 404 4139 "-" "xfa1" 74.7.228.44 - - [07/Dec/2025:02:17:01 -0600] "GET /robots.txt HTTP/1.1" 404 4200 "-" "Mozilla/5.0 (Macintosh; Itus code: 400, request id: 720f22f2-4eff-444b-8d95-aa04635e00b6 Dec 7 01:39:02 ip-172-31-29-215 CRON[376444]: (root) CMD ( [ -x /usr/lib/php/sessionclean ] && if [ ! -d /run/systemd/system ]; then /usr/lib/php/sessionclean; fi) Dec 7 01:39:12 ip-172-31-29-215 systemd[1]: Starting Clean php session files... Dec 7 01:39:12 ip-172-31-29-215 sessionclean[376457]: Cannot load Xdebug - it was already loaded Dec 7 01:39:12 ip-172-31-29-215 sessionclean[376457]: PHP Warning: PHP Startup: Unable to load dynamic library 'pdo_sqlsrv.so' (tried: /usr/lib/php/20190902/pdo_sqlsrv.so (/usr/lib/php/20190902/pdo_sqlsrv.so: undefined symbol: php_pdo_unregister_driver), /usr/lib/php/20190902/pdo_sqlsrv.so.so (/usr/lib/php/20190902/pdo_sqlsrv.so.so: cannot open shared object file: No such file or directory)) in Unknown on line 0 Dec 7 01:39:12 ip-172-31-29-215 sessionclean[376457]: PHP Warning: Module 'gettext' already loaded in Unknown on line 0 Dec 7 01:39:12 ip-172-31-29-215 sessionclean[376457]: PHP Warning: Module 'mbstring' already loaded in Unknown on line 0 Dec 7 01:39:12 ip-172-31-29-215 sessionclean[376457]: PHP Warning: Module 'sqlsrv' already loaded in Unknown on line 0 Dec 7 01:39:12 ip-172-31-29-215 systemd[1]: phpsessionclean.service: Succeeded. Dec 7 01:39:12 ip-172-31-29-215 systemd[1]: Finished Clean php session files. Dec 7 01:40:01 ip-172-31-29-215 CRON[376504]: (smmsp) CMD (test -x /etc/init.d/sendmail && test -x /usr/share/sendmail/sendmail && test -x /usr/lib/sm.bin/sendmail && /usr/share/sendmail/sendmail cron-msp) Dec 7 02:00:01 ip-172-31-29-215 CRON[376595]: (smmsp) CMD (test -x /etc/init.d/sendmail && test -x /usr/share/sendmail/sendmail && test -x /usr/lib/sm.bin/sendmail && /usr/share/sendmail/sendmail cron-msp) Dec 7 02:01:37 ip-172-31-29-215 amazon-ssm-agent.amazon-ssm-agent[3122439]: 2025-12-07 02:01:37.1433 WARN EC2RoleProvider Failed to connect to Systems Manager with instance profile role credentials. Err: retrieved credentials failed to report to ssm. Error: EC2RoleRequestError: no EC2 instance role found Dec 7 02:01:37 ip-172-31-29-215 amazon-ssm-agent.amazon-ssm-agent[3122439]: 2025-12-07 02:01:37.1910 ERROR EC2RoleProvider Failed to connect to Systems Manager with SSM role credentials. error calling RequestManagedInstanceRoleToken: AccessDeniedException: Systems Manager's instance management role is not configured for account: 227937466084 Dec 7 02:01:37 ip-172-31-29-215 amazon-ssm-agent.amazon-ssm-agent[3122439]: #011status code: 400, request id: 2b3a9bb8-cdd0-44c7-882c-e63fa9f7d903 Dec 7 02:09:01 ip-172-31-29-215 CRON[376620]: (root) CMD ( [ -x /usr/lib/php/sessionclean ] && if [ ! -d /run/systemd/system ]; then /usr/lib/php/sessionclean; fi) Dec 7 02:09:12 ip-172-31-29-215 systemd[1]: Starting Clean php session files... Dec 7 02:09:12 ip-172-31-29-215 sessionclean[376633]: Cannot load Xdebug - it was already loaded Dec 7 02:09:12 ip-172-31-29-215 sessionclean[376633]: PHP Warning: PHP Startup: Unable to load dynamic library 'pdo_sqlsrv.so' (tried: /usr/lib/php/20190902/pdo_sqlsrv.so (/usr/lib/php/20190902/pdo_sqlsrv.so: undefined symbol: php_pdo_unregister_driver), /usr/lib/php/20190902/pdo_sqlsrv.so.so (/usr/lib/php/20190902/pdo_sqlsrv.so.so: cannot open shared object file: No such file or directory)) in Unknown on line 0 Dec 7 02:09:12 ip-172-31-29-215 sessionclean[376633]: PHP Warning: Module 'gettext' already loaded in Unknown on line 0 Dec 7 02:09:12 ip-172-31-29-215 sessionclean[376633]: PHP Warning: Module 'mbstring' already loaded in Unknown on line 0 Dec 7 02:09:12 ip-172-31-29-215 sessionclean[376633]: PHP Warning: Module 'sqlsrv' already loaded in Unknown on line 0 Dec 7 02:09:12 ip-172-31-29-215 systemd[1]: phpsessionclean.service: Succeeded. Dec 7 02:09:12 ip-172-31-29-215 systemd[1]: Finished Clean php session files. Dec 7 02:17:01 ip-172-31-29-215 CRON[376676]: (root) CMD ( cd / && run-parts --report /etc/cron.hourly) Dec 7 02:20:01 ip-172-31-29-215 CRON[376682]: (smmsp) CMD (test -x /etc/init.d/sendmail && test -x /usr/share/sendmail/sendmail && t01:42:26 ip-172-31-29-215 sshd[376539]: Disconnected from authenticating user root 217.160.7.83 port 52792 [preauth] Dec 7 01:42:29 ip-172-31-29-215 sshd[376541]: Received disconnect from 34.91.0.68 port 42052:11: Bye Bye [preauth] Dec 7 01:42:29 ip-172-31-29-215 sshd[376541]: Disconnected from authenticating user root 34.91.0.68 port 42052 [preauth] Dec 7 01:43:15 ip-172-31-29-215 sshd[376544]: Received disconnect from 43.130.90.166 port 33280:11: Bye Bye [preauth] Dec 7 01:43:15 ip-172-31-29-215 sshd[376544]: Disconnected from authenticating user root 43.130.90.166 port 33280 [preauth] Dec 7 01:43:20 ip-172-31-29-215 sshd[376546]: Received disconnect from 101.47.142.215 port 49494:11: Bye Bye [preauth] Dec 7 01:43:20 ip-172-31-29-215 sshd[376546]: Disconnected from authenticating user root 101.47.142.215 port 49494 [preauth] Dec 7 01:43:20 ip-172-31-29-215 sshd[376548]: Received disconnect from 190.119.198.81 port 41530:11: Bye Bye [preauth] Dec 7 01:43:20 ip-172-31-29-215 sshd[376548]: Disconnected from authenticating user root 190.119.198.81 port 41530 [preauth] Dec 7 01:43:52 ip-172-31-29-215 sshd[376550]: Received disconnect from 101.126.67.255 port 39516:11: Bye Bye [preauth] Dec 7 01:43:52 ip-172-31-29-215 sshd[376550]: Disconnected from authenticating user root 101.126.67.255 port 39516 [preauth] Dec 7 01:44:28 ip-172-31-29-215 sshd[376552]: Received disconnect from 43.130.90.166 port 44032:11: Bye Bye [preauth] Dec 7 01:44:28 ip-172-31-29-215 sshd[376552]: Disconnected from authenticating user root 43.130.90.166 port 44032 [preauth] Dec 7 01:44:37 ip-172-31-29-215 sshd[376554]: Received disconnect from 190.119.198.81 port 38278:11: Bye Bye [preauth] Dec 7 01:44:37 ip-172-31-29-215 sshd[376554]: Disconnected from authenticating user root 190.119.198.81 port 38278 [preauth] Dec 7 01:45:18 ip-172-31-29-215 sshd[376556]: Received disconnect from 101.126.67.255 port 54758:11: Bye Bye [preauth] Dec 7 01:45:18 ip-172-31-29-215 sshd[376556]: Disconnected from authenticating user root 101.126.67.255 port 54758 [preauth] Dec 7 01:45:41 ip-172-31-29-215 sshd[376558]: Received disconnect from 43.130.90.166 port 27904:11: Bye Bye [preauth] Dec 7 01:45:41 ip-172-31-29-215 sshd[376558]: Disconnected from authenticating user root 43.130.90.166 port 27904 [preauth] Dec 7 01:45:53 ip-172-31-29-215 sshd[376560]: Received disconnect from 190.119.198.81 port 35020:11: Bye Bye [preauth] Dec 7 01:45:53 ip-172-31-29-215 sshd[376560]: Disconnected from authenticating user root 190.119.198.81 port 35020 [preauth] Dec 7 01:45:59 ip-172-31-29-215 sshd[376562]: Connection closed by 101.47.142.215 port 44350 [preauth] Dec 7 01:46:17 ip-172-31-29-215 sshd[376564]: Received disconnect from 217.160.7.83 port 41086:11: Bye Bye [preauth] Dec 7 01:46:17 ip-172-31-29-215 sshd[376564]: Disconnected from authenticating user root 217.160.7.83 port 41086 [preauth] Dec 7 01:46:41 ip-172-31-29-215 sshd[376567]: Received disconnect from 101.126.67.255 port 33986:11: Bye Bye [preauth] Dec 7 01:46:41 ip-172-31-29-215 sshd[376567]: Disconnected from authenticating user root 101.126.67.255 port 33986 [preauth] Dec 7 01:47:08 ip-172-31-29-215 sshd[376569]: Received disconnect from 190.119.198.81 port 60000:11: Bye Bye [preauth] Dec 7 01:47:08 ip-172-31-29-215 sshd[376569]: Disconnected from authenticating user root 190.119.198.81 port 60000 [preauth] Dec 7 01:48:04 ip-172-31-29-215 sshd[376572]: Received disconnect from 101.126.67.255 port 33820:11: Bye Bye [preauth] Dec 7 01:48:04 ip-172-31-29-215 sshd[376572]: Disconnected from authenticating user root 101.126.67.255 port 33820 [preauth] Dec 7 01:48:31 ip-172-31-29-215 sshd[376574]: Received disconnect from 101.47.142.215 port 37816:11: Bye Bye [preauth] Dec 7 01:48:31 ip-172-31-29-215 sshd[376574]: Disconnected from authenticating user root 101.47.142.215 port 37816 [preauth] Dec 7 01:49:25 ip-172-31-29-215 sshd[376578]: Received disconnect from 101.126.67.255 port 54104:11: Bye Bye [preauth] Dec 7 01:49:25 ip-172-31-29-215 sshd[376578]: Disconnected from authenticating usentel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.3; robots.txt; +https://openai.com/searchbot" 172.236.228.197 - - [07/Dec/2025:02:24:19 -0600] "GET / HTTP/1.1" 200 3421 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" 130.49.216.33 - - [07/Dec/2025:02:28:28 -0600] "GET /service/api-docs/ HTTP/1.1" 404 4148 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.18363" 74.7.241.168 - - [07/Dec/2025:02:29:37 -0600] "GET /robots.txt HTTP/1.1" 404 4210 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.3; robots.txt; +https://openai.com/searchbot" 136.143.176.60 - - [07/Dec/2025:02:29:46 -0600] "GET /PCI-test/trademarks.csv HTTP/1.1" 200 37167240 "-" "Zoho_Analytics" 136.143.177.62 - - [07/Dec/2025:02:36:12 -0600] "GET /PCI-test/trademarks.csv HTTP/1.1" 200 37167240 "-" "Zoho_Analytics" 4.217.237.240 - - [07/Dec/2025:02:47:45 -0600] "GET /.well-known/acme-challenge/file.php HTTP/1.1" 404 437 "https://www.google.de/" "Mozilla/5.0 (Linux; Android 12; SM-A525F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Mobile Safari/537.36" 4.217.237.240 - - [07/Dec/2025:02:47:45 -0600] "GET /.well-known/acme-challenge/wp-login.php HTTP/1.1" 404 437 "https://www.bing.com/" "Mozilla/5.0 (iPhone; CPU iPhone OS 16_6_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6 Mobile/15E148 Safari/604.1" 4.217.237.240 - - [07/Dec/2025:02:47:45 -0600] "GET /.well-known/pki-validation/index.php HTTP/1.1" 404 437 "https://www.google.com/" "Mozilla/5.0 (Linux; Android 12; 2201116SG) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Mobile Safari/537.36" 4.217.237.240 - - [07/Dec/2025:02:47:45 -0600] "GET /1.php HTTP/1.1" 404 437 "https://www.google.de/" "Mozilla/5.0 (iPhone; CPU iPhone OS 16_6_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6 Mobile/15E148 Safari/604.1" 4.217.237.240 - - [07/Dec/2025:02:47:46 -0600] "GET /aa.php HTTP/1.1" 404 437 "https://www.bing.com/" "Mozilla/5.0 (Linux; Android 12; 2201116SG) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Mobile Safari/537.36" 4.217.237.240 - - [07/Dec/2025:02:47:46 -0600] "GET /abcd.php HTTP/1.1" 404 437 "https://www.google.de/" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/119.0.6045.109 Mobile/15E148 Safari/604.1" 4.217.237.240 - - [07/Dec/2025:02:47:46 -0600] "GET /about.php HTTP/1.1" 404 437 "https://www.google.fr/" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/119.0.6045.109 Mobile/15E148 Safari/604.1" 4.217.237.240 - - [07/Dec/2025:02:47:46 -0600] "GET /.well-known/index.php HTTP/1.1" 404 437 "https://www.bing.com/" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/119.0.6045.109 Mobile/15E148 Safari/604.1" 4.217.237.240 - - [07/Dec/2025:02:47:46 -0600] "GET /admin.php HTTP/1.1" 404 437 "https://www.google.co.uk/" "Mozilla/5.0 (iPhone; CPU iPhone OS 16_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/118.0 Mobile/15E148 Safari/605.1.15" 4.217.237.240 - - [07/Dec/2025:02:47:47 -0600] "GET /adminfuns.php HTTP/1.1" 404 437 "https://www.google.com/" "Mozilla/5.0 (iPad; CPU OS 16_7_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6 Mobile/15E148 Safari/604.1" 4.217.237.240 - - [07/Dec/2025:02:47:47 -0600] "GET /alfa.php HTTP/1.1" 404 437 "https://www.yahoo.com/" "Mozilla/5.0 (Linux; Android 12; SM-A525F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Mobile Safari/537.36" 4.217.237.240 - - [07/Dec/2025:02:47:47 -0600] "GET /api.php HTTP/1.1" 404 437 "https://www.google.com/" "Mozilla/5.0 (Linux; Android 12; V2134) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Mobile Safari/537.36" 4.217.237.240 - - [07/Dec/el 7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Mobile Safari/537.36" 4.217.237.240 - - [07/Dec/2025:02:48:08 -0600] "GET /wp-includes/rest-api/search/index.php HTTP/1.1" 404 437 "https://duckduckgo.com/" "Mozilla/5.g (Linux; Android 13; Pixel 7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Mobile Safari/537.36" 4.217.237.240 - - [07/Dec/2025:02:48:08 -0600] "GET /wp-includes/sitemaps/ HTTP/1.1" 404 437 "https://www.bing.com/" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Mobile/15E148 Safari/604.1" 4.217.237.240 - - [07/Dec/2025:02:48:08 -0600] "GET /wp-includes/sitemaps/wp-conflg.php HTTP/1.1" 404 437 "https://www.google.de/" "Mozilla/5.0 (iPhone; CPU iPhone OS 15_7_9 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6.5 Mobile/15E148 Safari/604.1" 4.217.237.240 - - [07/Dec/2025:02:48:09 -0600] "GET /wp-themes.php HTTP/1.1" 404 437 "https://www.google.com/" "Mozilla/5.0 (iPhone; CPU iPhone OS 16_6_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6 Mobile/15E148 Safari/604.1" 4.217.237.240 - - [07/Dec/2025:02:48:09 -0600] "GET /x.php HTTP/1.1" 404 437 "https://www.google.fr/" "Mozilla/5.0 (Linux; Android 12; 2201116SG) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Mobile Safari/537.36" 4.217.237.240 - - [07/Dec/2025:02:48:09 -0600] "GET /yas.php HTTP/1.1" 404 437 "https://duckduckgo.com/" "Mozilla/5.0 (Linux; Android 13; SM-G991U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Mobile Safari/537.36" 185.16.39.146 - - [07/Dec/2025:02:53:07 -0600] "GET / HTTP/1.1" 200 11192 "-" "Wget" 43.166.250.187 - - [07/Dec/2025:03:10:20 -0600] "GET / HTTP/1.1" 200 3440 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1" 43.135.142.7 - - [07/Dec/2025:03:13:06 -0600] "GET / HTTP/1.1" 200 3440 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1" 134.209.225.34 - - [07/Dec/2025:03:13:49 -0600] "GET / HTTP/1.1" 200 3477 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" 134.209.225.34 - - [07/Dec/2025:03:13:50 -0600] "GET /favicon.ico HTTP/1.1" 404 498 "http://cfdi.aptuslegal.app/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" 134.209.225.34 - - [07/Dec/2025:03:13:50 -0600] "GET / HTTP/1.1" 200 7278 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" 134.209.225.34 - - [07/Dec/2025:03:13:54 -0600] "GET /favicon.ico HTTP/1.1" 404 4256 "https://cfdi.aptuslegal.app/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" 43.153.87.54 - - [07/Dec/2025:03:27:27 -0600] "GET / HTTP/1.1" 200 3440 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1" 146.59.34.59 - - [07/Dec/2025:03:29:12 -0600] "GET / HTTP/1.1" 200 7209 "-" "Mozilla/5.0" 136.143.176.64 - - [07/Dec/2025:03:36:17 -0600] "GET /PCI-test/trademarks.csv HTTP/1.1" 200 37167240 "-" "Zoho_Analytics" 136.143.176.60 - - [07/Dec/2025:03:35:06 -0600] "GET /PCI-test/fetch_trademark_csv.php HTTP/1.1" 200 4030 "-" "Apache-HttpClient/4.5.13 (Java/17.0.17)" 43.154.140.188 - - [07/Dec/2025:03:37:30 -0600] "GET /manual HTTP/1.1" 404 456 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1" 159.203.87.81 - - [07/Dec/2025:03:40:21 -0600] "GET / HTTP/1.1" 200 7210 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" 159.203.87.81 - - [07/Dec/2025:03:40:22 -0600] "GET /favicon.ico HTTP/1.1" 404 4181 "https://3.22.251.217/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" 9ch file or directory)) in Unknown on line 0 Dec 7 03:09:03 ip-172-31-29-215 sessionclean[376838]: PHP Warning: Module 'gettext' already loaded in Unknown on line 0 Dec 7 03:09:03 ip-172-31-29-215 sessionclean[376838]: PHP Warning: Module 'mbstring' already loaded in Unknown on line 0 Dec 7 03:09:03 ip-172-31-29-215 sessionclean[376838]: PHP Warning: Module 'sqlsrv' already loaded in Unknown on line 0 Dec 7 03:09:03 ip-172-31-29-215 systemd[1]: phpsessionclean.service: Succeeded. Dec 7 03:09:03 ip-172-31-29-215 systemd[1]: Finished Clean php session files. Dec 7 03:10:01 ip-172-31-29-215 CRON[376879]: (root) CMD (test -e /run/systemd/system || SERVICE_MODE=1 /sbin/e2scrub_all -A -r) Dec 7 03:11:02 ip-172-31-29-215 systemd[1]: Starting Online ext4 Metadata Check for All Filesystems... Dec 7 03:11:02 ip-172-31-29-215 systemd[1]: e2scrub_all.service: Succeeded. Dec 7 03:11:02 ip-172-31-29-215 systemd[1]: Finished Online ext4 Metadata Check for All Filesystems. Dec 7 03:17:01 ip-172-31-29-215 CRON[376883]: (root) CMD ( cd / && run-parts --report /etc/cron.hourly) Dec 7 03:20:01 ip-172-31-29-215 CRON[376888]: (smmsp) CMD (test -x /etc/init.d/sendmail && test -x /usr/share/sendmail/sendmail && test -x /usr/lib/sm.bin/sendmail && /usr/share/sendmail/sendmail cron-msp) Dec 7 03:25:31 ip-172-31-29-215 amazon-ssm-agent.amazon-ssm-agent[3122439]: 2025-12-07 03:25:31.4520 WARN EC2RoleProvider Failed to connect to Systems Manager with instance profile role credentials. Err: retrieved credentials failed to report to ssm. Error: EC2RoleRequestError: no EC2 instance role found Dec 7 03:25:31 ip-172-31-29-215 amazon-ssm-agent.amazon-ssm-agent[3122439]: 2025-12-07 03:25:31.4920 ERROR EC2RoleProvider Failed to connect to Systems Manager with SSM role credentials. error calling RequestManagedInstanceRoleToken: AccessDeniedException: Systems Manager's instance management role is not configured for account: 227937466084 Dec 7 03:25:31 ip-172-31-29-215 amazon-ssm-agent.amazon-ssm-agent[3122439]: #011status code: 400, request id: b7bf91c5-cbe6-4338-853a-a63776ecec81 Dec 7 03:30:01 ip-172-31-29-215 CRON[376930]: (root) CMD (test -e /run/systemd/system || SERVICE_MODE=1 /usr/lib/x86_64-linux-gnu/e2fsprogs/e2scrub_all_cron) Dec 7 03:39:01 ip-172-31-29-215 CRON[377169]: (root) CMD ( [ -x /usr/lib/php/sessionclean ] && if [ ! -d /run/systemd/system ]; then /usr/lib/php/sessionclean; fi) Dec 7 03:39:12 ip-172-31-29-215 systemd[1]: Starting Clean php session files... Dec 7 03:39:12 ip-172-31-29-215 sessionclean[377182]: Cannot load Xdebug - it was already loaded Dec 7 03:39:12 ip-172-31-29-215 sessionclean[377182]: PHP Warning: PHP Startup: Unable to load dynamic library 'pdo_sqlsrv.so' (tried: /usr/lib/php/20190902/pdo_sqlsrv.so (/usr/lib/php/20190902/pdo_sqlsrv.so: undefined symbol: php_pdo_unregister_driver), /usr/lib/php/20190902/pdo_sqlsrv.so.so (/usr/lib/php/20190902/pdo_sqlsrv.so.so: cannot open shared object file: No such file or directory)) in Unknown on line 0 Dec 7 03:39:12 ip-172-31-29-215 sessionclean[377182]: PHP Warning: Module 'gettext' already loaded in Unknown on line 0 Dec 7 03:39:12 ip-172-31-29-215 sessionclean[377182]: PHP Warning: Module 'mbstring' already loaded in Unknown on line 0 Dec 7 03:39:12 ip-172-31-29-215 sessionclean[377182]: PHP Warning: Module 'sqlsrv' already loaded in Unknown on line 0 Dec 7 03:39:12 ip-172-31-29-215 systemd[1]: phpsessionclean.service: Succeeded. Dec 7 03:39:12 ip-172-31-29-215 systemd[1]: Finished Clean php session files. Dec 7 03:40:01 ip-172-31-29-215 CRON[377226]: (smmsp) CMD (test -x /etc/init.d/sendmail && test -x /usr/share/sendmail/sendmail && test -x /usr/lib/sm.bin/sendmail && /usr/share/sendmail/sendmail cron-msp) Dec 7 03:44:13 ip-172-31-29-215 snapd[4073729]: storehelpers.go:916: cannot refresh: snap has no updates available: "amazon-ssm-agent", "core18", "core20", "core22", "lxd", "snapd" Dec 7 03:50:19 ip-172-31-29-215 systemd[1]: Starting Ubuntu Advantage Timer for running repeated jobs... Dec 7 03:50:20 ip-172-31-29-215 systemd[1]: ua-timer.se5 sshd[376924]: Received disconnect from 172.190.42.55 port 39802:11: Bye Bye [preauth] Dec 7 03:28:51 ip-172-31-29-215 sshd[376924]: Disconnected from authenticating user root 172.190.42.55 port 39802 [preauth] Dec 7 03:29:59 ip-172-31-29-215 sshd[376927]: Received disconnect from 172.190.42.55 port 48440:11: Bye Bye [preauth] Dec 7 03:29:59 ip-172-31-29-215 sshd[376927]: Disconnected from authenticating user root 172.190.42.55 port 48440 [preauth] Dec 7 03:30:01 ip-172-31-29-215 CRON[376929]: pam_unix(cron:session): session opened for user root by (uid=0) Dec 7 03:30:01 ip-172-31-29-215 CRON[376929]: pam_unix(cron:session): session closed for user root Dec 7 03:31:09 ip-172-31-29-215 sshd[376931]: Received disconnect from 172.190.42.55 port 53070:11: Bye Bye [preauth] Dec 7 03:31:09 ip-172-31-29-215 sshd[376931]: Disconnected from authenticating user root 172.190.42.55 port 53070 [preauth] Dec 7 03:32:23 ip-172-31-29-215 sshd[376933]: Received disconnect from 172.190.42.55 port 33024:11: Bye Bye [preauth] Dec 7 03:32:23 ip-172-31-29-215 sshd[376933]: Disconnected from authenticating user root 172.190.42.55 port 33024 [preauth] Dec 7 03:33:35 ip-172-31-29-215 sshd[376935]: Received disconnect from 172.190.42.55 port 38004:11: Bye Bye [preauth] Dec 7 03:33:35 ip-172-31-29-215 sshd[376935]: Disconnected from authenticating user root 172.190.42.55 port 38004 [preauth] Dec 7 03:34:46 ip-172-31-29-215 sshd[376939]: Received disconnect from 172.190.42.55 port 34570:11: Bye Bye [preauth] Dec 7 03:34:46 ip-172-31-29-215 sshd[376939]: Disconnected from authenticating user root 172.190.42.55 port 34570 [preauth] Dec 7 03:35:56 ip-172-31-29-215 sshd[377074]: Received disconnect from 172.190.42.55 port 37488:11: Bye Bye [preauth] Dec 7 03:35:56 ip-172-31-29-215 sshd[377074]: Disconnected from authenticating user root 172.190.42.55 port 37488 [preauth] Dec 7 03:37:09 ip-172-31-29-215 sshd[377163]: Received disconnect from 172.190.42.55 port 55376:11: Bye Bye [preauth] Dec 7 03:37:09 ip-172-31-29-215 sshd[377163]: Disconnected from authenticating user root 172.190.42.55 port 55376 [preauth] Dec 7 03:38:23 ip-172-31-29-215 sshd[377166]: Received disconnect from 172.190.42.55 port 36148:11: Bye Bye [preauth] Dec 7 03:38:23 ip-172-31-29-215 sshd[377166]: Disconnected from authenticating user root 172.190.42.55 port 36148 [preauth] Dec 7 03:39:01 ip-172-31-29-215 CRON[377168]: pam_unix(cron:session): session opened for user root by (uid=0) Dec 7 03:39:01 ip-172-31-29-215 CRON[377168]: pam_unix(cron:session): session closed for user root Dec 7 03:39:35 ip-172-31-29-215 sshd[377222]: Received disconnect from 172.190.42.55 port 43290:11: Bye Bye [preauth] Dec 7 03:39:35 ip-172-31-29-215 sshd[377222]: Disconnected from authenticating user root 172.190.42.55 port 43290 [preauth] Dec 7 03:40:01 ip-172-31-29-215 CRON[377225]: pam_unix(cron:session): session opened for user smmsp by (uid=0) Dec 7 03:40:01 ip-172-31-29-215 CRON[377225]: pam_unix(cron:session): session closed for user smmsp Dec 7 03:40:45 ip-172-31-29-215 sshd[377247]: Received disconnect from 172.190.42.55 port 38046:11: Bye Bye [preauth] Dec 7 03:40:45 ip-172-31-29-215 sshd[377247]: Disconnected from authenticating user root 172.190.42.55 port 38046 [preauth] Dec 7 03:41:53 ip-172-31-29-215 sshd[377249]: Received disconnect from 172.190.42.55 port 54340:11: Bye Bye [preauth] Dec 7 03:41:53 ip-172-31-29-215 sshd[377249]: Disconnected from authenticating user root 172.190.42.55 port 54340 [preauth] Dec 7 03:43:01 ip-172-31-29-215 sshd[377251]: Received disconnect from 172.190.42.55 port 44006:11: Bye Bye [preauth] Dec 7 03:43:01 ip-172-31-29-215 sshd[377251]: Disconnected from authenticating user root 172.190.42.55 port 44006 [preauth] Dec 7 03:44:13 ip-172-31-29-215 sshd[377253]: Received disconnect from 172.190.42.55 port 33126:11: Bye Bye [preauth] Dec 7 03:44:13 ip-172-31-29-215 sshd[377253]: Disconnected from authenticating user root 172.190.42.55 port 33126 [preauth] Dec 7 03:45:26 ip-172-31-29-215 sshd[377257]: Received disconnect from 172.c 7 05:55:37 ip-172-31-29-215 sshd[377968]: Received disconnect from 102.88.137.213 port 1149:11: Bye Bye [preauth] Dec 7 05:55:37 ip-172-31-29-215 sshd[377968]: Disconnected from authenticating user root 102.88.137.213 port 1149 [preauth] Dec 7 05:56:53 ip-172-31-29-215 sshd[377971]: Received disconnect from 102.88.137.213 port 33413:11: Bye Bye [preauth] Dec 7 05:56:53 ip-172-31-29-215 sshd[377971]: Disconnected from authenticating user root 102.88.137.213 port 33413 [preauth] Dec 7 05:57:22 ip-172-31-29-215 sshd[377973]: Received disconnect from 118.70.128.176 port 39050:11: Bye Bye [preauth] Dec 7 05:57:22 ip-172-31-29-215 sshd[377973]: Disconnected from authenticating user root 118.70.128.176 port 39050 [preauth] Dec 7 05:58:11 ip-172-31-29-215 sshd[377976]: Received disconnect from 102.88.137.213 port 1333:11: Bye Bye [preauth] Dec 7 05:58:11 ip-172-31-29-215 sshd[377976]: Disconnected from authenticating user root 102.88.137.213 port 1333 [preauth] Dec 7 05:59:28 ip-172-31-29-215 sshd[377981]: Received disconnect from 102.88.137.213 port 17476:11: Bye Bye [preauth] Dec 7 05:59:28 ip-172-31-29-215 sshd[377981]: Disconnected from authenticating user root 102.88.137.213 port 17476 [preauth] Dec 7 06:00:01 ip-172-31-29-215 CRON[377983]: pam_unix(cron:session): session opened for user smmsp by (uid=0) Dec 7 06:00:01 ip-172-31-29-215 CRON[377983]: pam_unix(cron:session): session closed for user smmsp Dec 7 06:00:20 ip-172-31-29-215 sshd[378005]: Received disconnect from 118.70.125.77 port 13625:11: Bye Bye [preauth] Dec 7 06:00:20 ip-172-31-29-215 sshd[378005]: Disconnected from authenticating user root 118.70.125.77 port 13625 [preauth] Dec 7 06:00:41 ip-172-31-29-215 sshd[378007]: Received disconnect from 102.88.137.213 port 49616:11: Bye Bye [preauth] Dec 7 06:00:41 ip-172-31-29-215 sshd[378007]: Disconnected from authenticating user root 102.88.137.213 port 49616 [preauth] Dec 7 06:01:17 ip-172-31-29-215 sshd[378009]: Received disconnect from 118.70.128.176 port 60728:11: Bye Bye [preauth] Dec 7 06:01:17 ip-172-31-29-215 sshd[378009]: Disconnected from authenticating user root 118.70.128.176 port 60728 [preauth] Dec 7 06:01:53 ip-172-31-29-215 sshd[378011]: Received disconnect from 102.88.137.213 port 1209:11: Bye Bye [preauth] Dec 7 06:01:53 ip-172-31-29-215 sshd[378011]: Disconnected from authenticating user root 102.88.137.213 port 1209 [preauth] Dec 7 06:02:16 ip-172-31-29-215 sshd[378013]: Received disconnect from 118.70.128.176 port 39123:11: Bye Bye [preauth] Dec 7 06:02:16 ip-172-31-29-215 sshd[378013]: Disconnected from authenticating user root 118.70.128.176 port 39123 [preauth] Dec 7 06:03:13 ip-172-31-29-215 sshd[378016]: Received disconnect from 102.88.137.213 port 49516:11: Bye Bye [preauth] Dec 7 06:03:13 ip-172-31-29-215 sshd[378016]: Disconnected from authenticating user root 102.88.137.213 port 49516 [preauth] Dec 7 06:04:32 ip-172-31-29-215 sshd[378019]: Received disconnect from 102.88.137.213 port 49518:11: Bye Bye [preauth] Dec 7 06:04:32 ip-172-31-29-215 sshd[378019]: Disconnected from authenticating user root 102.88.137.213 port 49518 [preauth] Dec 7 06:05:45 ip-172-31-29-215 sshd[378021]: Received disconnect from 102.88.137.213 port 49626:11: Bye Bye [preauth] Dec 7 06:05:45 ip-172-31-29-215 sshd[378021]: Disconnected from authenticating user root 102.88.137.213 port 49626 [preauth] Dec 7 06:06:58 ip-172-31-29-215 sshd[378023]: Received disconnect from 102.88.137.213 port 17292:11: Bye Bye [preauth] Dec 7 06:06:58 ip-172-31-29-215 sshd[378023]: Disconnected from authenticating user root 102.88.137.213 port 17292 [preauth] Dec 7 06:08:08 ip-172-31-29-215 sshd[378026]: Received disconnect from 102.88.137.213 port 33561:11: Bye Bye [preauth] Dec 7 06:08:08 ip-172-31-29-215 sshd[378026]: Disconnected from authenticating user root 102.88.137.213 port 33561 [preauth] Dec 7 06:09:01 ip-172-31-29-215 CRON[378028]: pam_unix(cron:session): session opened for user root by (uid=0) Dec 7 06:09:01 ip-172-31-29-215 CRON[378028]: pam_unix(cron:session): session closed for user root Dec 7 06:09:24 ip-172-31-29-215 sshd[378084]: Received disconnect from 102.88.137.213 port 1419:11: Bye Bye [preauth] Dec 7 06:09:24 ip-172-31-29-215 sshd[378084]: Disconnected from authenticating user root 102.88.137.213 port 1419 [preauth] Dec 7 06:10:24 ip-172-31-29-215 sshd[378090]: Connection closed by 13.220.89.31 port 51378 [preauth] Dec 7 06:10:44 ip-172-31-29-215 sshd[378092]: Received disconnect from 102.88.137.213 port 49564:11: Bye Bye [preauth] Dec 7 06:10:44 ip-172-31-29-215 sshd[378092]: Disconnected from authenticating user root 102.88.137.213 port 49564 [preauth] Dec 7 06:11:18 ip-172-31-29-215 sshd[378094]: Received disconnect from 118.70.125.77 port 13731:11: Bye Bye [preauth] Dec 7 06:11:18 ip-172-31-29-215 sshd[378094]: Disconnected from authenticating user root 118.70.125.77 port 13731 [preauth] Dec 7 06:12:01 ip-172-31-29-215 sshd[378096]: Received disconnect from 102.88.137.213 port 1089:11: Bye Bye [preauth] Dec 7 06:12:01 ip-172-31-29-215 sshd[378096]: Disconnected from authenticating user root 102.88.137.213 port 1089 [preauth] Dec 7 06:13:19 ip-172-31-29-215 sshd[378098]: Received disconnect from 102.88.137.213 port 49634:11: Bye Bye [preauth] Dec 7 06:13:19 ip-172-31-29-215 sshd[378098]: Disconnected from authenticating user root 102.88.137.213 port 49634 [preauth] Dec 7 06:14:32 ip-172-31-29-215 sshd[378100]: Received disconnect from 102.88.137.213 port 1303:11: Bye Bye [preauth] Dec 7 06:14:32 ip-172-31-29-215 sshd[378100]: Disconnected from authenticating user root 102.88.137.213 port 1303 [preauth] Dec 7 06:15:19 ip-172-31-29-215 sshd[378102]: Received disconnect from 118.70.125.77 port 13761:11: Bye Bye [preauth] Dec 7 06:15:19 ip-172-31-29-215 sshd[378102]: Disconnected from authenticating user root 118.70.125.77 port 13761 [preauth] Dec 7 06:15:48 ip-172-31-29-215 sshd[378106]: Received disconnect from 102.88.137.213 port 1093:11: Bye Bye [preauth] Dec 7 06:15:48 ip-172-31-29-215 sshd[378106]: Disconnected from authenticating user root 102.88.137.213 port 1093 [preauth] Dec 7 06:16:21 ip-172-31-29-215 sshd[378108]: Received disconnect from 118.70.125.77 port 37454:11: Bye Bye [preauth] Dec 7 06:16:21 ip-172-31-29-215 sshd[378108]: Disconnected from authenticating user root 118.70.125.77 port 37454 [preauth] Dec 7 06:17:01 ip-172-31-29-215 CRON[378110]: pam_unix(cron:session): session opened for user root by (uid=0) Dec 7 06:17:01 ip-172-31-29-215 CRON[378110]: pam_unix(cron:session): session closed for user root Dec 7 06:17:06 ip-172-31-29-215 sshd[378113]: Received disconnect from 102.88.137.213 port 1347:11: Bye Bye [preauth] Dec 7 06:17:06 ip-172-31-29-215 sshd[378113]: Disconnected from authenticating user root 102.88.137.213 port 1347 [preauth] Dec 7 06:18:24 ip-172-31-29-215 sshd[378116]: Received disconnect from 102.88.137.213 port 17602:11: Bye Bye [preauth] Dec 7 06:18:24 ip-172-31-29-215 sshd[378116]: Disconnected from authenticating user root 102.88.137.213 port 17602 [preauth] Dec 7 06:19:39 ip-172-31-29-215 sshd[378119]: Received disconnect from 102.88.137.213 port 49754:11: Bye Bye [preauth] Dec 7 06:19:39 ip-172-31-29-215 sshd[378119]: Disconnected from authenticating user root 102.88.137.213 port 49754 [preauth] Dec 7 06:20:01 ip-172-31-29-215 CRON[378121]: pam_unix(cron:session): session opened for user smmsp by (uid=0) Dec 7 06:20:01 ip-172-31-29-215 CRON[378121]: pam_unix(cron:session): session closed for user smmsp Dec 7 06:20:50 ip-172-31-29-215 sshd[378144]: Received disconnect from 102.88.137.213 port 1197:11: Bye Bye [preauth] Dec 7 06:20:50 ip-172-31-29-215 sshd[378144]: Disconnected from authenticating user root 102.88.137.213 port 1197 [preauth] Dec 7 06:22:03 ip-172-31-29-215 sshd[378147]: Received disconnect from 102.88.137.213 port 49560:11: Bye Bye [preauth] Dec 7 06:22:03 ip-172-31-29-215 sshd[378147]: Disconnected from authenticating user root 102.88.137.213 port 49560 [preauth] Dec 7 06:23:22 ip-172-31-29-215 sshd[378149]: Received disconnect from 102.88.137.213 port 1031:11: Bye Bye [preauth] Dec 7 06:23:22 iessionclean[378042]: PHP Warning: PHP Startup: Unable to load dynamic library 'pdo_sqlsrv.so' (tried: /usr/lib/php/20190902/pdo_sqlsrv.so (/usr/lib/php/20190902/pdo_sqlsrv.so: undefined symbol: php_pdo_unregister_driver), /usr/lib/php/20190902/pdo_sqlsrv.so.so (/usr/lib/php/20190902/pdo_sqlsrv.so.so: cannot open shared object file: No such file or directory)) in Unknown on line 0 Dec 7 06:09:12 ip-172-31-29-215 sessionclean[378042]: PHP Warning: Module 'gettext' already loaded in Unknown on line 0 Dec 7 06:09:12 ip-172-31-29-215 sessionclean[378042]: PHP Warning: Module 'mbstring' already loaded in Unknown on line 0 Dec 7 06:09:12 ip-172-31-29-215 sessionclean[378042]: PHP Warning: Module 'sqlsrv' already loaded in Unknown on line 0 Dec 7 06:09:12 ip-172-31-29-215 systemd[1]: phpsessionclean.service: Succeeded. Dec 7 06:09:12 ip-172-31-29-215 systemd[1]: Finished Clean php session files. Dec 7 06:14:23 ip-172-31-29-215 amazon-ssm-agent.amazon-ssm-agent[3122439]: 2025-12-07 06:14:23.0216 WARN EC2RoleProvider Failed to connect to Systems Manager with instance profile role credentials. Err: retrieved credentials failed to report to ssm. Error: EC2RoleRequestError: no EC2 instance role found Dec 7 06:14:23 ip-172-31-29-215 amazon-ssm-agent.amazon-ssm-agent[3122439]: 2025-12-07 06:14:23.0684 ERROR EC2RoleProvider Failed to connect to Systems Manager with SSM role credentials. error calling RequestManagedInstanceRoleToken: AccessDeniedException: Systems Manager's instance management role is not configured for account: 227937466084 Dec 7 06:14:23 ip-172-31-29-215 amazon-ssm-agent.amazon-ssm-agent[3122439]: #011status code: 400, request id: 01964c95-6892-443b-917e-cc155fad8cdd Dec 7 06:17:01 ip-172-31-29-215 CRON[378111]: (root) CMD ( cd / && run-parts --report /etc/cron.hourly) Dec 7 06:20:01 ip-172-31-29-215 CRON[378122]: (smmsp) CMD (test -x /etc/init.d/sendmail && test -x /usr/share/sendmail/sendmail && test -x /usr/lib/sm.bin/sendmail && /usr/share/sendmail/sendmail cron-msp) Dec 7 06:25:01 ip-172-31-29-215 CRON[378156]: (root) CMD (test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )) Dec 7 06:25:01 ip-172-31-29-215 cracklib: no dictionary update necessary. Dec 7 06:37:33 ip-172-31-29-215 systemd[1]: Starting Message of the Day... Dec 7 06:38:54 ip-172-31-29-215 50-motd-news[378287]: * Ubuntu Pro delivers the most comprehensive open source security and Dec 7 06:38:54 ip-172-31-29-215 50-motd-news[378287]: compliance features. Dec 7 06:38:54 ip-172-31-29-215 50-motd-news[378287]: https://ubuntu.com/aws/pro Dec 7 06:38:54 ip-172-31-29-215 systemd[1]: motd-news.service: Succeeded. Dec 7 06:38:54 ip-172-31-29-215 systemd[1]: Finished Message of the Day. Dec 7 06:39:01 ip-172-31-29-215 CRON[378295]: (root) CMD ( [ -x /usr/lib/php/sessionclean ] && if [ ! -d /run/systemd/system ]; then /usr/lib/php/sessionclean; fi) Dec 7 06:39:12 ip-172-31-29-215 systemd[1]: Starting Clean php session files... Dec 7 06:39:12 ip-172-31-29-215 sessionclean[378308]: Cannot load Xdebug - it was already loaded Dec 7 06:39:12 ip-172-31-29-215 sessionclean[378308]: PHP Warning: PHP Startup: Unable to load dynamic library 'pdo_sqlsrv.so' (tried: /usr/lib/php/20190902/pdo_sqlsrv.so (/usr/lib/php/20190902/pdo_sqlsrv.so: undefined symbol: php_pdo_unregister_driver), /usr/lib/php/20190902/pdo_sqlsrv.so.so (/usr/lib/php/20190902/pdo_sqlsrv.so.so: cannot open shared object file: No such file or directory)) in Unknown on line 0 Dec 7 06:39:12 ip-172-31-29-215 sessionclean[378308]: PHP Warning: Module 'gettext' already loaded in Unknown on line 0 Dec 7 06:39:12 ip-172-31-29-215 sessionclean[378308]: PHP Warning: Module 'mbstring' already loaded in Unknown on line 0 Dec 7 06:39:12 ip-172-31-29-215 sessionclean[378308]: PHP Warning: Module 'sqlsrv' already loaded in Unknown on line 0 Dec 7 06:39:12 ip-172-31-29-215 systemd[1]: phpsessionclean.service: Succeeded. Dec 7 06:39:12 ip-172-31-29-215 systemd[1]: Finished Clean php session files. Dec 7 06:40:01 ip-172-31-29-215 CRON[378350]: (smmsp) CMp-172-31-29-215 sshd[378149]: Disconnected from authenticating user root 102.88.137.213 port 1031 [preauth] Dec 7 06:23:24 ip-172-31-29-215 sshd[378151]: Received disconnect from 118.70.125.77 port 38644:11: Bye Bye [preauth] Dec 7 06:23:24 ip-172-31-29-215 sshd[378151]: Disconnected from authenticating user root 118.70.125.77 port 38644 [preauth] Dec 7 06:24:39 ip-172-31-29-215 sshd[378153]: Received disconnect from 102.88.137.213 port 1227:11: Bye Bye [preauth] Dec 7 06:24:39 ip-172-31-29-215 sshd[378153]: Disconnected from authenticating user root 102.88.137.213 port 1227 [preauth] Dec 7 06:25:01 ip-172-31-29-215 CRON[378155]: pam_unix(cron:session): session opened for user root by (uid=0) Dec 7 06:25:01 ip-172-31-29-215 CRON[378155]: pam_unix(cron:session): session closed for user root Dec 7 06:25:56 ip-172-31-29-215 sshd[378247]: Received disconnect from 102.88.137.213 port 1523:11: Bye Bye [preauth] Dec 7 06:25:56 ip-172-31-29-215 sshd[378247]: Disconnected from authenticating user root 102.88.137.213 port 1523 [preauth] Dec 7 06:27:11 ip-172-31-29-215 sshd[378249]: Received disconnect from 102.88.137.213 port 49546:11: Bye Bye [preauth] Dec 7 06:27:11 ip-172-31-29-215 sshd[378249]: Disconnected from authenticating user root 102.88.137.213 port 49546 [preauth] Dec 7 06:28:29 ip-172-31-29-215 sshd[378252]: Received disconnect from 102.88.137.213 port 33533:11: Bye Bye [preauth] Dec 7 06:28:29 ip-172-31-29-215 sshd[378252]: Disconnected from authenticating user root 102.88.137.213 port 33533 [preauth] Dec 7 06:39:01 ip-172-31-29-215 CRON[378294]: pam_unix(cron:session): session opened for user root by (uid=0) Dec 7 06:39:01 ip-172-31-29-215 CRON[378294]: pam_unix(cron:session): session closed for user root Dec 7 06:40:01 ip-172-31-29-215 CRON[378349]: pam_unix(cron:session): session opened for user smmsp by (uid=0) Dec 7 06:40:01 ip-172-31-29-215 CRON[378349]: pam_unix(cron:session): session closed for user smmsp Dec 7 06:47:01 ip-172-31-29-215 CRON[378449]: pam_unix(cron:session): session opened for user root by (uid=0) Dec 7 06:47:01 ip-172-31-29-215 CRON[378449]: pam_unix(cron:session): session closed for user root Dec 7 07:00:01 ip-172-31-29-215 CRON[378464]: pam_unix(cron:session): session opened for user smmsp by (uid=0) Dec 7 07:00:01 ip-172-31-29-215 CRON[378464]: pam_unix(cron:session): session closed for user smmsp Dec 7 07:09:01 ip-172-31-29-215 CRON[378489]: pam_unix(cron:session): session opened for user root by (uid=0) Dec 7 07:09:01 ip-172-31-29-215 CRON[378489]: pam_unix(cron:session): session closed for user root Dec 7 07:10:49 ip-172-31-29-215 sshd[378545]: error: kex_exchange_identification: client sent invalid protocol identifier "GET / HTTP/1.1" Dec 7 07:10:49 ip-172-31-29-215 sshd[378546]: error: kex_exchange_identification: client sent invalid protocol identifier "GET /favicon.ico HTTP/1.1" Dec 7 07:17:01 ip-172-31-29-215 CRON[378548]: pam_unix(cron:session): session opened for user root by (uid=0) Dec 7 07:17:02 ip-172-31-29-215 CRON[378548]: pam_unix(cron:session): session closed for user root Dec 7 07:20:02 ip-172-31-29-215 CRON[378554]: pam_unix(cron:session): session opened for user smmsp by (uid=0) Dec 7 07:20:02 ip-172-31-29-215 CRON[378554]: pam_unix(cron:session): session closed for user smmsp Dec 7 07:39:01 ip-172-31-29-215 CRON[378797]: pam_unix(cron:session): session opened for user root by (uid=0) Dec 7 07:39:01 ip-172-31-29-215 CRON[378797]: pam_unix(cron:session): session closed for user root Dec 7 07:40:01 ip-172-31-29-215 CRON[378882]: pam_unix(cron:session): session opened for user smmsp by (uid=0) Dec 7 07:40:01 ip-172-31-29-215 CRON[378882]: pam_unix(cron:session): session closed for user smmsp Dec 7 08:00:01 ip-172-31-29-215 CRON[378912]: pam_unix(cron:session): session opened for user smmsp by (uid=0) Dec 7 08:00:01 ip-172-31-29-215 CRON[378912]: pam_unix(cron:session): session closed for user smmsp Dec 7 08:09:01 ip-172-31-29-215 CRON[378937]: pam_unix(cron:session): session opened for user root by (uid=0) Dec 7 08:09:01 ip-172-31-29-21/usr/share/dict/words /usr/share/dict/words.pre-dictionaries-common dictionaries-common /usr/share/man/man1/sh.1.gz /usr/share/man/man1/sh.distrib.1.gz dash /usr/share/vim/vim81/doc/help.txt /usr/share/vim/vim81/doc/help.txt.vim-tiny vim-runtime /bin/sh /bin/sh.distrib dash /usr/share/vim/vim81/doc/tags /usr/share/vim/vim81/doc/tags.vim-tiny vim-runtime