Verified the process running is using system httpd:

/usr/sbin/httpd.worker -k start -f /etc/dirsrv/admin-serv/httpd.conf

httpd.worker is provided by system httpd rpm.


On Thu, May 29, 2014 at 1:42 PM, David Boreham <david_list@boreham.org> wrote:

On 5/29/2014 11:33 AM, John Trump wrote:
With the answer Rob gave of "389-admin runs a separate instance of the system httpd" I think this should be proof enough that the hits are false positives. I can show that I have the latest update installed from Red Hat.

I wouldn't take his word for it ;)

Identify the process listening on the port using netstat -nlp then use lsof -p to verify the location of that process' binary files. Check that those files came from the system httpd package.