From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from lists.gentoo.org ([140.105.134.102] helo=robin.gentoo.org) by finch.gentoo.org with esmtp (Exim 4.60) (envelope-from ) id 1Iak4e-00081h-1R for garchives@archives.gentoo.org; Thu, 27 Sep 2007 03:30:00 +0000 Received: from robin.gentoo.org (localhost [127.0.0.1]) by robin.gentoo.org (8.14.1/8.14.0) with SMTP id l8R3KA4u027093; Thu, 27 Sep 2007 03:20:10 GMT Received: from mail.ilievnet.com ([84.21.204.200]) by robin.gentoo.org (8.14.1/8.14.0) with ESMTP id l8R3F5m1022341 for ; Thu, 27 Sep 2007 03:15:05 GMT Received: from localhost (localhost [127.0.0.1]) by mail.ilievnet.com (Postfix) with ESMTP id 96BE284BC1 for ; Thu, 27 Sep 2007 06:15:04 +0300 (EEST) X-Virus-Scanned: amavisd-new 2.4.1 (20060508) at ilievnet.com Received: from mail.ilievnet.com ([127.0.0.1]) by localhost (mail.ilievnet.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nyvfkKzAY6nZ for ; Thu, 27 Sep 2007 06:14:57 +0300 (EEST) Received: from ilievnet.com (x.ilievnet.com [10.0.1.11]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) (Authenticated sender: danny@ilievnet.com) by mail.ilievnet.com (Postfix) with ESMTP id BE89E84BC0 for ; Thu, 27 Sep 2007 06:14:57 +0300 (EEST) Date: Thu, 27 Sep 2007 06:14:55 +0300 From: Daniel Iliev To: gentoo-user@lists.gentoo.org Subject: Re: [gentoo-user] {OT} Strange apache2 access_log entries Message-ID: <20070927061455.5cc1aad5@ilievnet.com> In-Reply-To: <49bf44f10709261851s15b35799vb007ce039e3bf095@mail.gmail.com> References: <49bf44f10709261330m23c74923l8165853e9785e811@mail.gmail.com> <1190846931.30856.26.camel@localhost> <49bf44f10709261851s15b35799vb007ce039e3bf095@mail.gmail.com> X-Mailer: Claws Mail 3.0.0 (GTK+ 2.10.14; x86_64-pc-linux-gnu) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-user@gentoo.org Reply-to: gentoo-user@lists.gentoo.org Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-Archives-Salt: 25532a10-d6c6-4ad4-90d2-9af2bf3ddd98 X-Archives-Hash: b6cd54ab39b14bee3803670cb5cfbba7 On Wed, 26 Sep 2007 18:51:31 -0700 Grant wrote: > > > Does anyone else get entries like this in their apache2 > > > access_log: > > > > > > 127.0.0.1 - - [26/Sep/2007:03:10:08 -0700] "GET /" 400 470 > > > > > > I get a whole slew of them every day. They always show up in > > > batches and each entry in a batch is logged at almost the same > > > second. > > > > > > > Connection to/from localhost. Do you have some process running on > > the same server that's doing monitoring? The 400 reply is even more > > interesting. I think the request should be "GET / HTTP/1.1" or > > similar which is probably why it is returning a 400. > > I'm not doing any sort of monitoring like that. What is that "470"? > I noticed the log entries always include that, at least for the last > 10 days. > > - Grant To be sure, you have to check the fields defined in your log format variable in the configuration. The date and source IP address fields are obvious. The dashes mean "field is empty". My guess is that one of those is for http_user. 470 most probably is the http error code (means bad request) and the last field with value "470" would be "bytes sent". Again: I'm just guessing. If it was up to me, I'd check the config files out and do some googling to get the meaning of those fields and their values. -- Best regards, Daniel -- gentoo-user@gentoo.org mailing list