I've noticed a lot of weird logs in /var/log on my server.

For example:

cd /var/log/DIST00000001ARGC00000005ARGV00000002ccARGV00000002-cARGV00000006nmap.cARGV00000002-oARGV00000006nmap.oDOTI00000000
sudo cat user.log 
Jun 30 16:48:08 DIST00000001ARGC00000005ARGV00000002ccARGV00000002-cARGV00000006nmap.cARGV00000002-oARGV00000006nmap.oDOTI00000000

Another example:

cd /var/log/Nmap
sudo cat user.log 
Jun 30 16:48:28 Nmap

Note Nmap is not installed on my server.

Another example:

cd get_info
sudo cat user.log
Jun 30 16:48:25 get_info

I'm worried this may be a sign my server has been compromised, but perhaps it's something else?

The server is Ubuntu 20.04.2 LTS (GNU/Linux 5.4.0-77-generic x86_64) with unattended-upgrades turned on for security updates.


Not necessarily a 100% 'answer' but getting to the next step -- maybe strings sent by an nmap service probe?


  • Thanks @paal527569 I think you're right. Seems odd the probes are getting their own log files though. I guess there must be something installed on the server which is logging this stuff.
    – Stiofán
    Jul 5 at 16:55
  • @Stiofán do you have anything listening on port 3632?
    – user253751
    Jul 7 at 9:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.