Apache error log has reams of "host: command not found"

On one of my ISPConfig 3.2.5 hosts running Debian GNU/Linux 10.latest, I have lines like this in apache error log:

Code:

sh: host: command not found

There is no shortatge of those lines:

Code:

root@web:/etc# grep "host: command" /var/log/apache2/error.log | wc -l
35735

I checker older error log files, they all have these lines. Oldest log lines I had was from 22rd of July.
I do not have the host command installed on this machine, and I understand I could get rid of those error messages if I installed it. But I want to find the script that constantly tries to run that command.

 

No restarts or reloads.
I tried to see what is in log before the command not found lines, but I think this can not work. There are other lines, but there are so many command not found lines that I can not say that one particular kind of log line is before them. And there are contigous chunks of command not found lines with so I think the script that causes this writes nothing to log.

 

Yes, the /var/log/apache2/error.log file.
I think it is not started from cron, since it happens more than 1 minute intervals. Checked the cron files nonetheless but did not find host commands.

 

What about the access logs? are they equally frequent?

 

Code:

root@web:/var/log/apache2# wc -l error.log
43676 error.log
root@web:/var/log/apache2# grep "host: command not" error.log | wc -l
19027
root@web:/var/log/apache2# wc -l access.log
21983 access.log
root@web:/var/log/apache2#

 

I have to say I agree, but if you really want to know for sure, you might grep "host" in the apache and www directories to see where its coming from. At least you can then be sure that its nothing to be concerned about.

 

Sorry taleman, I didnt mean the log count, i meant comparing the log time stamps to see if there is a corresponding access to the web server that triggers the command. (to eliminate it hopefully)

 

The command not found lines do no have timestamps.

 

Seems strange, on searching it seems they are related to dns lookups. Likely to be nothing to worry about in that case.

Can you gauge from other timestamps how often they are running? X per hour or minute or whatever