163.172.4.153 - - [17/Oct/2017:05:51:37 +0000] "GET / HTTP/1.1" 200 57264 "https://www.mywebsite.com/" "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0" "-“
<³IäYìmsÛ¶-Çßï§ÐäU3]Rø¬N§ÓöÞm»·Ùf6ÙÍîììd(“O©$的eG}±Y}AJ¶i'pQvÒ4N“EAI I $°Lß3‰ķ†ƒÿúâNÿXÔSjfy3Ì\òÅÿûßÉ«THTH 〜2½ÊSVDk6Çùä×÷ÒN‰I ^ Ml <LHàN^¯&¯'ääIM]Óš|³ÈÓ“ªãy¾>üËËMUÄKVN©i}7ùöª®<Ùtz{ ¸œrÚÁ¤-5 !! ITH,°|é¶ú3™FË4Îú] A:¤þ×¼\ 3†Ç±œÿF7%… A'/§*Ò-bÉc¼¹Œñ0l@£\ FU(ôB8ìápp89Š= H% 9ZŒ±Š4ÂApeã9bCH2TWy±OES€6%S2 -Q:* AU7 ZZ}Ô|K¶F'XCÁ“»-2ÆçhæB0.À; I(…一个$ ~j [] S_¢SSI°A-C¢@ ½+-ØØB B«</s> </s> </s> </s> </s> </s> </s> </s> </s> </s> </s> </s> </s> </s> </s> </s> </s> </s> </s> </s> </s> </s> </s> </s> </s> </s> </s> </s> </s> </s> </s> </s> </s> </s> </s> </s> </s> </s> </s> </s> </s> </s> </s> </s> </s> </s> </s> </s> </s>
还有很多,足以跨越ServerFault上的字符限制,所以我不得不在其他地方托pipe整个blob。
该网站在Nginx 1.13.6之后运行WordPress 4.8
UPDATE
我用适当的编码打开了Sublime Text中的整个blob …
如果我没有弄错那些是ASCII控制字符,我怀疑nginx正在logging一个SSH会话?
我被黑客攻击了吗?
或者是我自己的SSHlogin以某种方式被input到日志中?
或者是我的怀疑完全脱离基地,有一个更好的解释?
我想你已经将gzip参数添加到了access_log指令中,这使得nginx在写入日志文件时对日志文件条目使用gzip压缩。 另外,在更改之后,您并未删除旧的日志文件,因此第一行是在更改之前。
这也意味着你不能使用zcat或类似的工具来检查日志文件。
我不想在日志文件中使用gzipfunction。 只需使用标准的系统日志轮转函数来轮转日志文件,并可select压缩较早的日志文件