It seems to be initiated at admin operations, such as catalog save/edit. As seen in the logs. The client IP for the POST is the server's internal IP.

302 2014-08-30T06:43:40+00:00 POST /index.php/admin/catalog_product/save/id/8830/key/ee3cb37b55e431ada508af992e88abbb/ HTTP/1.1 
403 2014-08-30T06:43:40+00:00 POST /app/etc/local.xml HTTP/1.1 
200 2014-08-30T06:48:39+00:00 GET /index.php/admin/catalog_product/edit/id/8830/key/e5c6b7e5d662d8b4c39be5b31b761f28/ HTTP/1.1 
403 2014-08-30T06:48:39+00:00 POST /app/etc/local.xml HTTP/1.1 

1 Answer 1


Ah, found the answer in the release notes:

Added verification of access level for app/etc/local.xml. * Now if server configuration has issue and this file accessible from browser admin user gets notification in backend.

  • Yep, sanity checking to make sure app/etc/local.xml is inaccessible to external sources. Aug 30, 2014 at 17:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.