my portal started to shutting down (1 time a day) and it happening over a week now and i do not know were could issue be. ..
MySQL is shutting down on about the same time and is not starting after that. I see on mysql error logs multiple connection denied to multiple users from multiple IP's:
2020-02-03T17:37:30.226268Z 5556 [Warning] IP address '118.193.28.58' could not be resolved: Name or service not known
2020-02-03T17:37:30.489071Z 5556 [Note] Access denied for user 'root'@'118.193.28.58' (using password: NO)
2020-02-03T17:37:31.255169Z 5557 [Note] Access denied for user 'root'@'118.193.28.58' (using password: YES)
2020-02-03T17:37:32.011111Z 5558 [Note] Access denied for user 'root'@'118.193.28.58' (using password: YES)
2020-02-03T17:37:32.766829Z 5559 [Note] Access denied for user 'root'@'118.193.28.58' (using password: YES)
2020-02-03T17:37:33.523834Z 5560 [Note] Access denied for user 'root'@'118.193.28.58' (using password: YES)
2020-02-03T17:37:34.308241Z 5561 [Note] Access denied for user 'root'@'118.193.28.58' (using password: YES)
2020-02-03T17:37:35.130693Z 5562 [Note] Access denied for user 'mysql'@'118.193.28.58' (using password: YES)
2020-02-03T17:37:35.959631Z 5563 [Note] Access denied for user 'mysqld'@'118.193.28.58' (using password: YES)
2020-02-03T17:37:36.819837Z 5564 [Note] Access denied for user 'mysqld'@'118.193.28.58' (using password: YES)
First i get multiple access denied:
2020-02-05T04:27:31.476393Z 8281 [Note] Access denied for user 'root'@'88.214.26.19' (using password: YES)
2020-02-05T04:32:07.783157Z 8294 [Note] Access denied for user 'root'@'88.214.26.20' (using password: YES)
2020-02-05T04:36:43.324917Z 8305 [Note] Access denied for user 'root'@'88.214.26.39' (using password: YES)
2020-02-05T04:41:18.711229Z 8314 [Note] Access denied for user 'root'@'88.214.26.40' (using password: YES)
2020-02-05T04:45:51.599383Z 8325 [Note] Access denied for user 'root'@'88.214.26.17' (using password: YES)
2020-02-05T04:50:27.407846Z 8334 [Note] Access denied for user 'root'@'88.214.26.18' (using password: YES)
And it looks like MySQL is shutting down after that:
2020-02-05T04:51:09.548048Z 0 [Note] Giving 2 client threads a chance to die gracefully
2020-02-05T04:51:09.548078Z 0 [Note] Shutting down slave threads
2020-02-05T04:51:11.548170Z 0 [Note] Forcefully disconnecting 2 remaining clients
2020-02-05T04:51:11.548216Z 0 [Warning] /usr/sbin/mysqld: Forcing close of thread 8003 user: ''
2020-02-05T04:51:11.548252Z 0 [Warning] /usr/sbin/mysqld: Forcing close of thread 8345 user: ''
2020-02-05T04:51:11.548274Z 0 [Note] Event Scheduler: Purging the queue. 0 events
2020-02-05T04:51:11.548355Z 8345 [Note] Bad handshake
2020-02-05T04:51:11.548393Z 8003 [Note] Bad handshake
2020-02-05T04:51:11.548685Z 0 [Note] Binlog end
2020-02-05T04:51:11.552386Z 0 [Note] Shutting down plugin 'validate_password'
2020-02-05T04:51:11.552407Z 0 [Note] Shutting down plugin 'auth_socket'
2020-02-05T04:51:11.552410Z 0 [Note] Shutting down plugin 'ngram'
2020-02-05T04:51:11.552413Z 0 [Note] Shutting down plugin 'partition'
2020-02-05T04:51:11.552417Z 0 [Note] Shutting down plugin 'BLACKHOLE'
2020-02-05T04:51:11.552420Z 0 [Note] Shutting down plugin 'ARCHIVE'
2020-02-05T04:51:11.552423Z 0 [Note] Shutting down plugin 'PERFORMANCE_SCHEMA'
2020-02-05T04:51:11.552501Z 0 [Note] Shutting down plugin 'MRG_MYISAM'
2020-02-05T04:51:11.552509Z 0 [Note] Shutting down plugin 'MyISAM'
2020-02-05T04:51:11.552514Z 0 [Note] Shutting down plugin 'INNODB_SYS_VIRTUAL'
2020-02-05T04:51:11.552518Z 0 [Note] Shutting down plugin 'INNODB_SYS_DATAFILES'
2020-02-05T04:51:11.552538Z 0 [Note] Shutting down plugin 'INNODB_SYS_TABLESPACES'
2020-02-05T04:51:11.552540Z 0 [Note] Shutting down plugin 'INNODB_SYS_FOREIGN_COLS'
2020-02-05T04:51:11.552543Z 0 [Note] Shutting down plugin 'INNODB_SYS_FOREIGN'
2020-02-05T04:51:11.552565Z 0 [Note] Shutting down plugin 'INNODB_SYS_FIELDS'
2020-02-05T04:51:11.552568Z 0 [Note] Shutting down plugin 'INNODB_SYS_COLUMNS'
2020-02-05T04:51:11.552571Z 0 [Note] Shutting down plugin 'INNODB_SYS_INDEXES'
2020-02-05T04:51:11.552574Z 0 [Note] Shutting down plugin 'INNODB_SYS_TABLESTATS'
2020-02-05T04:51:11.552577Z 0 [Note] Shutting down plugin 'INNODB_SYS_TABLES'
2020-02-05T04:51:11.552673Z 0 [Note] Shutting down plugin 'INNODB_FT_INDEX_TABLE'
2020-02-05T04:51:11.552678Z 0 [Note] Shutting down plugin 'INNODB_FT_INDEX_CACHE'
2020-02-05T04:51:11.552733Z 0 [Note] Shutting down plugin 'INNODB_FT_CONFIG'
2020-02-05T04:51:11.552736Z 0 [Note] Shutting down plugin 'INNODB_FT_BEING_DELETED'
2020-02-05T04:51:11.552739Z 0 [Note] Shutting down plugin 'INNODB_FT_DELETED'
2020-02-05T04:51:11.552743Z 0 [Note] Shutting down plugin 'INNODB_FT_DEFAULT_STOPWORD'
2020-02-05T04:51:11.552746Z 0 [Note] Shutting down plugin 'INNODB_METRICS'
2020-02-05T04:51:11.552749Z 0 [Note] Shutting down plugin 'INNODB_TEMP_TABLE_INFO'
2020-02-05T04:51:11.552752Z 0 [Note] Shutting down plugin 'INNODB_BUFFER_POOL_STATS'
2020-02-05T04:51:11.552755Z 0 [Note] Shutting down plugin 'INNODB_BUFFER_PAGE_LRU'
2020-02-05T04:51:11.552758Z 0 [Note] Shutting down plugin 'INNODB_BUFFER_PAGE'
2020-02-05T04:51:11.552761Z 0 [Note] Shutting down plugin 'INNODB_CMP_PER_INDEX_RESET'
2020-02-05T04:51:11.552764Z 0 [Note] Shutting down plugin 'INNODB_CMP_PER_INDEX'
2020-02-05T04:51:11.552768Z 0 [Note] Shutting down plugin 'INNODB_CMPMEM_RESET'
2020-02-05T04:51:11.552771Z 0 [Note] Shutting down plugin 'INNODB_CMPMEM'
2020-02-05T04:51:11.552774Z 0 [Note] Shutting down plugin 'INNODB_CMP_RESET'
2020-02-05T04:51:11.552777Z 0 [Note] Shutting down plugin 'INNODB_CMP'
2020-02-05T04:51:11.552792Z 0 [Note] Shutting down plugin 'INNODB_LOCK_WAITS'
2020-02-05T04:51:11.552795Z 0 [Note] Shutting down plugin 'INNODB_LOCKS'
2020-02-05T04:51:11.552917Z 0 [Note] Shutting down plugin 'INNODB_TRX'
2020-02-05T04:51:11.552924Z 0 [Note] Shutting down plugin 'InnoDB'
2020-02-05T04:51:11.552994Z 0 [Note] InnoDB: FTS optimize thread exiting.
2020-02-05T04:51:11.553205Z 0 [Note] InnoDB: Starting shutdown...
2020-02-05T04:51:11.653467Z 0 [Note] InnoDB: Dumping buffer pool(s) to /var/lib/mysql/ib_buffer_pool
2020-02-05T04:51:11.654368Z 0 [Note] InnoDB: Buffer pool(s) dump completed at 200205 6:51:11
2020-02-05T04:51:12.889032Z 0 [Note] InnoDB: Shutdown completed; log sequence number 5451240039
2020-02-05T04:51:12.898916Z 0 [Note] InnoDB: Removed temporary tablespace data file: "ibtmp1"
2020-02-05T04:51:12.898935Z 0 [Note] Shutting down plugin 'MEMORY'
2020-02-05T04:51:12.898942Z 0 [Note] Shutting down plugin 'CSV'
2020-02-05T04:51:12.898946Z 0 [Note] Shutting down plugin 'sha256_password'
2020-02-05T04:51:12.898950Z 0 [Note] Shutting down plugin 'mysql_native_password'
2020-02-05T04:51:12.899190Z 0 [Note] Shutting down plugin 'binlog'
2020-02-05T04:51:12.900006Z 0 [Note] /usr/sbin/mysqld: Shutdown complete
2020-02-05T04:51:13.397754Z 0 [Warning] TIMESTAMP with implicit DEFAULT value is deprecated. Please use --explicit_defaults_for_timestamp server option (see documentation for more details).
2020-02-05T04:51:13.399389Z 0 [Note] mysqld (mysqld 5.7.29-0ubuntu0.18.04.1) starting as process 60962 ...
2020-02-05T04:51:13.404126Z 0 [Note] InnoDB: PUNCH HOLE support available
2020-02-05T04:51:13.404150Z 0 [Note] InnoDB: Mutexes and rw_locks use GCC atomic builtins
2020-02-05T04:51:13.404154Z 0 [Note] InnoDB: Uses event mutexes
2020-02-05T04:51:13.404159Z 0 [Note] InnoDB: GCC builtin __atomic_thread_fence() is used for memory barrier
2020-02-05T04:51:13.404163Z 0 [Note] InnoDB: Compressed tables use zlib 1.2.11
2020-02-05T04:51:13.404167Z 0 [Note] InnoDB: Using Linux native AIO
2020-02-05T04:51:13.405064Z 0 [Note] InnoDB: Number of pools: 1
2020-02-05T04:51:13.405218Z 0 [Note] InnoDB: Using CPU crc32 instructions
2020-02-05T04:51:13.408138Z 0 [Note] InnoDB: Initializing buffer pool, total size = 128M, instances = 1, chunk size = 128M
2020-02-05T04:51:13.418099Z 0 [Note] InnoDB: Completed initialization of buffer pool
2020-02-05T04:51:13.420971Z 0 [Note] InnoDB: If the mysqld execution user is authorized, page cleaner thread priority can be changed. See the man page of setpriority().
2020-02-05T04:51:13.432975Z 0 [Note] InnoDB: Highest supported file format is Barracuda.
2020-02-05T04:51:13.609510Z 0 [Note] InnoDB: Creating shared tablespace for temporary tables
2020-02-05T04:51:13.609610Z 0 [Note] InnoDB: Setting file './ibtmp1' size to 12 MB. Physically writing the file full; Please wait ...
2020-02-05T04:51:14.458761Z 0 [Note] InnoDB: File './ibtmp1' size is now 12 MB.
2020-02-05T04:51:14.460267Z 0 [Note] InnoDB: 96 redo rollback segment(s) found. 96 redo rollback segment(s) are active.
2020-02-05T04:51:14.460278Z 0 [Note] InnoDB: 32 non-redo rollback segment(s) are active.
2020-02-05T04:51:14.461182Z 0 [Note] InnoDB: Waiting for purge to start
2020-02-05T04:51:14.511398Z 0 [Note] InnoDB: 5.7.29 started; log sequence number 5451240039
2020-02-05T04:51:14.512389Z 0 [Note] InnoDB: Loading buffer pool(s) from /var/lib/mysql/ib_buffer_pool
2020-02-05T04:51:14.512403Z 0 [Note] Plugin 'FEDERATED' is disabled.
2020-02-05T04:51:14.519095Z 0 [Note] Found ca.pem, server-cert.pem and server-key.pem in data directory. Trying to enable SSL support using them.
2020-02-05T04:51:14.519109Z 0 [Note] Skipping generation of SSL certificates as certificate files are present in data directory.
2020-02-05T04:51:14.519970Z 0 [Warning] CA certificate ca.pem is self signed.
2020-02-05T04:51:14.520010Z 0 [Note] Skipping generation of RSA key pair as key files are present in data directory.
2020-02-05T04:51:14.534481Z 0 [Warning] Insecure configuration for --pid-file: Location '/tmp' in the path is accessible to all OS users. Consider choosing a different directory.
2020-02-05T04:51:14.539722Z 0 [Note] InnoDB: Buffer pool(s) load completed at 200205 6:51:14
2020-02-05T04:51:14.544074Z 0 [Note] mysqld: ready for connections.
Version: '5.7.29-0ubuntu0.18.04.1' socket: '/tmp/tmp.GFPeHcflSb/mysqld.sock' port: 0 (Ubuntu)
2020-02-05T04:51:14.560728Z 0 [Note] Giving 0 client threads a chance to die gracefully
2020-02-05T04:51:14.560745Z 0 [Note] Shutting down slave threads
2020-02-05T04:51:14.560752Z 0 [Note] Forcefully disconnecting 0 remaining clients
2020-02-05T04:51:14.560838Z 0 [Note] Binlog end
2020-02-05T04:51:14.561157Z 0 [Note] Shutting down plugin 'ngram'
2020-02-05T04:51:14.561166Z 0 [Note] Shutting down plugin 'partition'
2020-02-05T04:51:14.561169Z 0 [Note] Shutting down plugin 'BLACKHOLE'
2020-02-05T04:51:14.561173Z 0 [Note] Shutting down plugin 'ARCHIVE'
2020-02-05T04:51:14.561176Z 0 [Note] Shutting down plugin 'PERFORMANCE_SCHEMA'
2020-02-05T04:51:14.561193Z 0 [Note] Shutting down plugin 'MRG_MYISAM'
2020-02-05T04:51:14.561196Z 0 [Note] Shutting down plugin 'MyISAM'
2020-02-05T04:51:14.561201Z 0 [Note] Shutting down plugin 'INNODB_SYS_VIRTUAL'
2020-02-05T04:51:14.561204Z 0 [Note] Shutting down plugin 'INNODB_SYS_DATAFILES'
2020-02-05T04:51:14.561207Z 0 [Note] Shutting down plugin 'INNODB_SYS_TABLESPACES'
2020-02-05T04:51:14.561209Z 0 [Note] Shutting down plugin 'INNODB_SYS_FOREIGN_COLS'
2020-02-05T04:51:14.561212Z 0 [Note] Shutting down plugin 'INNODB_SYS_FOREIGN'
2020-02-05T04:51:14.561215Z 0 [Note] Shutting down plugin 'INNODB_SYS_FIELDS'
2020-02-05T04:51:14.561217Z 0 [Note] Shutting down plugin 'INNODB_SYS_COLUMNS'
2020-02-05T04:51:14.561220Z 0 [Note] Shutting down plugin 'INNODB_SYS_INDEXES'
2020-02-05T04:51:14.561223Z 0 [Note] Shutting down plugin 'INNODB_SYS_TABLESTATS'
2020-02-05T04:51:14.561225Z 0 [Note] Shutting down plugin 'INNODB_SYS_TABLES'
2020-02-05T04:51:14.561228Z 0 [Note] Shutting down plugin 'INNODB_FT_INDEX_TABLE'
2020-02-05T04:51:14.561231Z 0 [Note] Shutting down plugin 'INNODB_FT_INDEX_CACHE'
2020-02-05T04:51:14.561233Z 0 [Note] Shutting down plugin 'INNODB_FT_CONFIG'
2020-02-05T04:51:14.561236Z 0 [Note] Shutting down plugin 'INNODB_FT_BEING_DELETED'
2020-02-05T04:51:14.561238Z 0 [Note] Shutting down plugin 'INNODB_FT_DELETED'
2020-02-05T04:51:14.561241Z 0 [Note] Shutting down plugin 'INNODB_FT_DEFAULT_STOPWORD'
2020-02-05T04:51:14.561244Z 0 [Note] Shutting down plugin 'INNODB_METRICS'
2020-02-05T04:51:14.561247Z 0 [Note] Shutting down plugin 'INNODB_TEMP_TABLE_INFO'
2020-02-05T04:51:14.561249Z 0 [Note] Shutting down plugin 'INNODB_BUFFER_POOL_STATS'
2020-02-05T04:51:14.561252Z 0 [Note] Shutting down plugin 'INNODB_BUFFER_PAGE_LRU'
2020-02-05T04:51:14.561254Z 0 [Note] Shutting down plugin 'INNODB_BUFFER_PAGE'
2020-02-05T04:51:14.561257Z 0 [Note] Shutting down plugin 'INNODB_CMP_PER_INDEX_RESET'
2020-02-05T04:51:14.561260Z 0 [Note] Shutting down plugin 'INNODB_CMP_PER_INDEX'
2020-02-05T04:51:14.561262Z 0 [Note] Shutting down plugin 'INNODB_CMPMEM_RESET'
2020-02-05T04:51:14.561265Z 0 [Note] Shutting down plugin 'INNODB_CMPMEM'
2020-02-05T04:51:14.561268Z 0 [Note] Shutting down plugin 'INNODB_CMP_RESET'
2020-02-05T04:51:14.561270Z 0 [Note] Shutting down plugin 'INNODB_CMP'
2020-02-05T04:51:14.561273Z 0 [Note] Shutting down plugin 'INNODB_LOCK_WAITS'
2020-02-05T04:51:14.561276Z 0 [Note] Shutting down plugin 'INNODB_LOCKS'
2020-02-05T04:51:14.561278Z 0 [Note] Shutting down plugin 'INNODB_TRX'
2020-02-05T04:51:14.561281Z 0 [Note] Shutting down plugin 'InnoDB'
2020-02-05T04:51:14.561310Z 0 [Note] InnoDB: FTS optimize thread exiting.
2020-02-05T04:51:14.561407Z 0 [Note] InnoDB: Starting shutdown...
2020-02-05T04:51:14.661755Z 0 [Note] InnoDB: Dumping buffer pool(s) to /var/lib/mysql/ib_buffer_pool
2020-02-05T04:51:14.662100Z 0 [Note] InnoDB: Buffer pool(s) dump completed at 200205 6:51:14
2020-02-05T04:51:16.178302Z 0 [Note] InnoDB: Shutdown completed; log sequence number 5451240058
2020-02-05T04:51:16.179749Z 0 [Note] InnoDB: Removed temporary tablespace data file: "ibtmp1"
2020-02-05T04:51:16.179762Z 0 [Note] Shutting down plugin 'MEMORY'
2020-02-05T04:51:16.179775Z 0 [Note] Shutting down plugin 'CSV'
2020-02-05T04:51:16.179780Z 0 [Note] Shutting down plugin 'sha256_password'
2020-02-05T04:51:16.179783Z 0 [Note] Shutting down plugin 'mysql_native_password'
2020-02-05T04:51:16.179947Z 0 [Note] Shutting down plugin 'binlog'
2020-02-05T04:51:16.180256Z 0 [Note] mysqld: Shutdown complete
2020-02-05T05:36:08.117851Z 0 [Warning] TIMESTAMP with implicit DEFAULT value is deprecated. Please use --explicit_defaults_for_timestamp server option (see documentation for more details).
2020-02-05T05:36:08.120175Z 0 [Note] /usr/sbin/mysqld (mysqld 5.7.29-0ubuntu0.18.04.1) starting as process 65398 ...
2020-02-05T05:36:08.125444Z 0 [Note] InnoDB: PUNCH HOLE support available
2020-02-05T05:36:08.125485Z 0 [Note] InnoDB: Mutexes and rw_locks use GCC atomic builtins
2020-02-05T05:36:08.125490Z 0 [Note] InnoDB: Uses event mutexes
2020-02-05T05:36:08.125514Z 0 [Note] InnoDB: GCC builtin __atomic_thread_fence() is used for memory barrier
2020-02-05T05:36:08.125518Z 0 [Note] InnoDB: Compressed tables use zlib 1.2.11
2020-02-05T05:36:08.125522Z 0 [Note] InnoDB: Using Linux native AIO
2020-02-05T05:36:08.125929Z 0 [Note] InnoDB: Number of pools: 1
2020-02-05T05:36:08.126199Z 0 [Note] InnoDB: Using CPU crc32 instructions
2020-02-05T05:36:08.130411Z 0 [Note] InnoDB: Initializing buffer pool, total size = 128M, instances = 1, chunk size = 128M
2020-02-05T05:36:08.140643Z 0 [Note] InnoDB: Completed initialization of buffer pool
2020-02-05T05:36:08.144417Z 0 [Note] InnoDB: If the mysqld execution user is authorized, page cleaner thread priority can be changed. See the man page of setpriority().
2020-02-05T05:36:08.156510Z 0 [Note] InnoDB: Highest supported file format is Barracuda.
2020-02-05T05:36:08.324289Z 0 [Note] InnoDB: Creating shared tablespace for temporary tables
2020-02-05T05:36:08.324369Z 0 [Note] InnoDB: Setting file './ibtmp1' size to 12 MB. Physically writing the file full; Please wait ...
2020-02-05T05:36:09.166154Z 0 [Note] InnoDB: File './ibtmp1' size is now 12 MB.
2020-02-05T05:36:09.166978Z 0 [Note] InnoDB: 96 redo rollback segment(s) found. 96 redo rollback segment(s) are active.
2020-02-05T05:36:09.166988Z 0 [Note] InnoDB: 32 non-redo rollback segment(s) are active.
2020-02-05T05:36:09.168381Z 0 [Note] InnoDB: 5.7.29 started; log sequence number 5451240058
2020-02-05T05:36:09.169574Z 0 [Note] InnoDB: Loading buffer pool(s) from /var/lib/mysql/ib_buffer_pool
2020-02-05T05:36:09.169915Z 0 [Note] Plugin 'FEDERATED' is disabled.
2020-02-05T05:36:09.178288Z 0 [Note] Found ca.pem, server-cert.pem and server-key.pem in data directory. Trying to enable SSL support using them.
2020-02-05T05:36:09.178363Z 0 [Note] Skipping generation of SSL certificates as certificate files are present in data directory.
2020-02-05T05:36:09.178805Z 0 [Note] InnoDB: Buffer pool(s) load completed at 200205 7:36:09
2020-02-05T05:36:09.178943Z 0 [Warning] CA certificate ca.pem is self signed.
2020-02-05T05:36:09.178973Z 0 [Note] Skipping generation of RSA key pair as key files are present in data directory.
2020-02-05T05:36:09.179105Z 0 [Note] Server hostname (bind-address): '*'; port: 3306
2020-02-05T05:36:09.179262Z 0 [Note] IPv6 is available.
2020-02-05T05:36:09.179272Z 0 [Note] - '::' resolves to '::';
2020-02-05T05:36:09.179301Z 0 [Note] Server socket created on IP: '::'.
2020-02-05T05:36:09.189417Z 0 [Note] Event Scheduler: Loaded 0 events
2020-02-05T05:36:09.189677Z 0 [Note] /usr/sbin/mysqld: ready for connections.
Version: '5.7.29-0ubuntu0.18.04.1' socket: '/var/run/mysqld/mysqld.sock' port: 3306 (Ubuntu)
2020-02-05T05:36:21.428034Z 2 [Warning] IP address 'MYREALIP' could not be resolved: Name or service not known
The question is is this a Brute Force Attack? If yes how can i fight it? If no whats wrong then?
P.S. auth.log also shows interesting things. .. Here are part of it
...
Feb 4 09:38:11 sshd[75190]: Failed password for invalid user octsr from 188.166.232.29 port 41336 ssh2
Feb 4 09:38:12 sshd[75190]: Received disconnect from 188.166.232.29 port 41336:11: Bye Bye [preauth]
Feb 4 09:38:12 sshd[75190]: Disconnected from invalid user octsr 188.166.232.29 port 41336 [preauth]
Feb 4 09:38:19 sshd[75212]: Accepted password for vmadmin from 195.13.162.165 port 54564 ssh2
Feb 4 09:38:19 sshd[75212]: pam_unix(sshd:session): session opened for user vmadmin by (uid=0)
Feb 4 09:38:19 systemd-logind[1180]: New session 15026 of user vmadmin.
Feb 4 09:38:23 sshd[75293]: Invalid user vivek123 from 14.207.24.36 port 40822
Feb 4 09:38:23 sshd[75293]: pam_unix(sshd:auth): check pass; user unknown
Feb 4 09:38:23 sshd[75293]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.207.24.36
Feb 4 09:38:24 sshd[75293]: Failed password for invalid user vivek123 from 14.207.24.36 port 40822 ssh2
Feb 4 09:38:25 sshd[75293]: Received disconnect from 14.207.24.36 port 40822:11: Bye Bye [preauth]
Feb 4 09:38:25 sshd[75293]: Disconnected from invalid user vivek123 14.207.24.36 port 40822 [preauth]
Feb 4 09:38:25 sshd[75301]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.204.157.197 user=root
Feb 4 09:38:25 sshd[75302]: Invalid user pen from 106.12.25.123 port 39328
Feb 4 09:38:25 sshd[75302]: pam_unix(sshd:auth): check pass; user unknown
Feb 4 09:38:25 sshd[75302]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.25.123
Feb 4 09:38:28 sshd[75301]: Failed password for root from 111.204.157.197 port 44082 ssh2
Feb 4 09:38:28 sshd[75302]: Failed password for invalid user pen from 106.12.25.123 port 39328 ssh2
Feb 4 09:38:28 sshd[75301]: Received disconnect from 111.204.157.197 port 44082:11: Bye Bye [preauth]
Feb 4 09:38:28 sshd[75301]: Disconnected from authenticating user root 111.204.157.197 port 44082 [preauth]
Feb 4 09:38:28 sshd[75302]: Received disconnect from 106.12.25.123 port 39328:11: Bye Bye [preauth]
Feb 4 09:38:28 sshd[75302]: Disconnected from invalid user pen 106.12.25.123 port 39328 [preauth]
...
I m PHP programmer with with little knowledge about server logs, config and security. Any help would be appreciated!
EDIT: I found another interesting thing on syslog
Feb 6 06:59:31 systemd[1]: Starting Daily apt upgrade and clean activities...
Feb 6 06:59:42 systemd[1]: Reloading.
Feb 6 06:59:42 systemd[1]: Stopping MySQL Community Server...
Feb 6 06:59:44 systemd[1]: Stopped MySQL Community Server.
Feb 6 06:59:44 kernel: [601324.484125] audit: type=1400 audit(1580965184.428:24): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="/usr/sbin/mysqld" pid=56672 comm="apparmor_parser"
Feb 6 06:59:50 systemd[1]: Started Daily apt upgrade and clean activities.
At this case it looks like it is not Brute Force Attack rights? If so what is happening here?
