I am trying to trace down a script and have found that my problem is coming from httpd. To summarize that post, something is attempting to connect to a website and is [properly] being blocked by the server firewall. In my test script, attempting to connect to a website times out and generates a PHP warning in the page:
Warning: file_get_contents(http://foobar.com) [function.file-get-contents.html]: failed to open stream: Connection timed out in /home/foo/bar.php on line 3
This server runs with cPanel so I used the cPanel config editor to set error_log to /var/log/php-scripts.log and error_reporting to E_ALL. However, the warning from my test case is not showing up in /var/log/php-scripts.log (though the log is being populated by some PHP Startup warnings).
Can anyone point me in the right direction as to why the warning in my test script isn't being logged? I figure if I can get the timeout warning in my test script to log, then the timeout warning in the malicious script will also be logged and I can find where that script is hiding out.