Database port scanning or health checks?

1

I got an alert that render was filling up my log provider. When I looked, I saw a constant stream of messages like this, repeating every ~10 seconds:

17:53:57  [64e4f635.278d84-1] user=[unknown],db=[unknown],app=[unknown],client=::1,LOG:  connection received: host=::1 port=44770
17:53:58  [64e4f635.278d84-2] user=postgres,db=postgres,app=[unknown],client=::1,LOG:  connection authenticated: identity="postgres" method=md5 (/pgdata/dpg-cis0jftph6et1scogogg-a/pg_hba.conf:90)
17:53:58  [64e4f635.278d84-3] user=postgres,db=postgres,app=[unknown],client=::1,LOG:  connection authorized: user=postgres database=postgres application_name=psql SSL enabled (protocol=TLSv1.2, cipher=ECDHE-RSA-AES256-GCM-SHA384, bits=256)
17:53:58  [64e4f635.278d84-4] user=postgres,db=postgres,app=psql,client=::1,LOG:  disconnection: session time: 0:00:00.097 user=postgres database=postgres host=::1 port=44770

I thought this might be a health check, but the ports are mostly unique. Over a ~6 hour window, I saw ~2K unique ports, which is really weird for a health check.

I also found this thread, which indicated they were seeing health checks, but the logs are little different.

Can anyone confirm these are just health checks, despite the varying ports?

TIA!

2

Hey,

The logs you posted definitely seem like health checks to me, I’m not seeing anything out of the ordinary.

Please reach out via our “Contact Support” form in the dashboard if you want the support team to dig more into it.

Jérémy.
Render Support, UTC+3

3

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.