Suspicious stats folder found.

Richard G

Verified User
Joined
Jul 6, 2008
Messages
13,771
Location
Maastricht
Then in then in the message, it looks like this:
Code:
/home/user/domains/userdomain.nl/awstats contains hardlinks
       /home/user/domains/userdomain.nl/awstats/.data/awstats082023.userdomain.nl.txt<br>

Now I found some ancient posts with solutions like "set permissions_home" but that doesn't help.

This account was backed-up via reseller backup and restored via the same reseller account on a VPS.

I checked, but they look exactly the same, and on the old server Directadmin is not sending these warnings.

Old server:
Code:
-rwxr-xr-x 1 user user 684K 2023-02-11 00:12 awstats.pl
drwxr-xr-x 2 user user 4.0K 2023-09-01 00:14 .data
-rw-r--r-- 1 user user  164 2018-09-26 00:11 .htaccess
lrwxrwxrwx 1 root  root    31 2019-09-15 00:11 icon -> /usr/local/awstats/wwwroot/icon
lrwxrwxrwx 1 user user   40 2023-09-01 00:14 index.html -> awstats.userdomain.nl.2309.html
lrwxrwxrwx 1 root  root    39 2019-09-15 00:11 lang -> /usr/local/awstats/wwwroot/cgi-bin/lang
lrwxrwxrwx 1 root  root    38 2019-09-15 00:11 lib -> /usr/local/awstats/wwwroot/cgi-bin/lib
lrwxrwxrwx 1 root  root    42 2019-09-15 00:11 plugins -> /usr/local/awstats/wwwroot/cgi-bin/plugins

On the VPS:
Code:
-rwxr-xr-x 1 user user 684K 2023-02-11 00:12 awstats.pl
drwxr-xr-x 2 user user 4.0K 2023-08-31 00:13 .data
-rw-r--r-- 1 user user  164 2018-09-26 00:11 .htaccess
lrwxrwxrwx 1 root  root    31 2019-09-15 00:11 icon -> /usr/local/awstats/wwwroot/icon
lrwxrwxrwx 1 user user   40 2023-08-31 00:13 index.html -> awstats.userdomain.nl.2308.html
lrwxrwxrwx 1 root  root    39 2019-09-15 00:11 lang -> /usr/local/awstats/wwwroot/cgi-bin/lang
lrwxrwxrwx 1 root  root    38 2019-09-15 00:11 lib -> /usr/local/awstats/wwwroot/cgi-bin/lib
lrwxrwxrwx 1 root  root    42 2019-09-15 00:11 plugins -> /usr/local/awstats/wwwroot/cgi-bin/plugins

I don't see any difference except for 1 file.
rwxrwxrwx 1 user user 40 2023-08-31 00:13 index.html -> awstats.userdomain.nl.2308.html
which has 2309.html on the old server, and all other accounts also have this at 2309.html now.
But there are no 2309 html files yet for this account, so maybe awstats has not run yet.

For the rest it's all the same and nobody has any DA message about suspicous folder and hardlinks.
The awstats folder itself is chmod 755 and owned by the user like every other awstats folder.

Same for the .data dir where the message points to, everything the same.

How can I fix this so these mesage stop?
 
Back
Top