How to find the file from which they are trying to connect to the database?

Question

MySQL

Good afternoon, today I noticed in the server logs a lot of entries like
Access denied for user 'admin'@'localhost' (using password: YES)
As far as I understand, someone is trying to guess the password to the database. I checked all the files that have changed over the past month in the /var/www directory, I did not find anything unusual. I don't see anything in the process either. How can I find out from which file a connection attempt is made?
Debian 8.7 system, MariaDB 10.1 base

Answer 1

I did not find the answer directly to this question, but it turned out that the requests come from the phpmyadmin authorization form. Closed it with http authentication and suspicious entries in the logs stopped appearing