You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Canonical Forms <ca...@gmail.com> on 2007/11/02 21:27:57 UTC
[users@httpd] host ip addr missing from access log
I am searching for an explanation as to how the access log could have
not recorded the host ip address if it is configured to record it. I
don't think that escape character sequences are playing a part here,
since viewing the log with the vi editor displays what is shown below.
Please see log snippet below. Notice that the ip address of the
previous host is recorded (as usual), but beginning with the 4th
record there is only :: where the ip should be. These log entries
recorded the beginning of a DOS attack on the server.
192.168.20.33 - - [04/Oct/2007:11:09:41 -0700] "GET / HTTP/1.1" 200
9066 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR
1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; InfoPath.2)"
192.168.20.33 - - [04/Oct/2007:11:09:41 -0700] "GET / HTTP/1.1" 200
9071 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR
1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; InfoPath.2)"
192.168.20.33 - - [04/Oct/2007:11:09:41 -0700] "GET / HTTP/1.1" 200
9070 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR
1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; InfoPath.2)"
:: - - [04/Oct/2007:11:09:42 -0700] "GET / HTTP/1.1" 200 9077 "-"
"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322;
.NET CLR 2.0.50727; .NET CLR 3.0.04506.30; InfoPath.2)"
:: - - [04/Oct/2007:11:09:42 -0700] "GET / HTTP/1.1" 200 9065 "-"
"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322;
.NET CLR 2.0.50727; .NET CLR 3.0.04506.30; InfoPath.2)"
:: - - [04/Oct/2007:11:09:43 -0700] "GET / HTTP/1.1" 200 9070 "-"
"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322;
.NET CLR 2.0.50727; .NET CLR 3.0.04506.30; InfoPath.2)"
:: - - [04/Oct/2007:11:09:43 -0700] "GET / HTTP/1.1" 200 9107 "-"
"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322;
.NET CLR 2.0.50727; .NET CLR 3.0.04506.30; InfoPath.2)"
:: - - [04/Oct/2007:11:09:43 -0700] "GET / HTTP/1.1" 200 9108 "-"
"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322;
.NET CLR 2.0.50727; .NET CLR 3.0.04506.30; InfoPath.2)"
:: - - [04/Oct/2007:11:09:43 -0700] "GET / HTTP/1.1" 200 9108 "-"
"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322;
.NET CLR 2.0.50727; .NET CLR 3.0.04506.30; InfoPath.2)"
:: - - [04/Oct/2007:11:09:44 -0700] "GET / HTTP/1.1" 200 9064 "-"
"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322;
.NET CLR 2.0.50727; .NET CLR 3.0.04506.30; InfoPath.2)"
:: - - [04/Oct/2007:11:09:44 -0700] "GET / HTTP/1.1" 200 9064 "-"
"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322;
.NET CLR 2.0.50727; .NET CLR 3.0.04506.30; InfoPath.2)"
:: - - [04/Oct/2007:11:09:44 -0700] "GET / HTTP/1.1" 200 9081 "-"
"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322;
.NET CLR 2.0.50727; .NET CLR 3.0.04506.30; InfoPath.2)"
:: - - [04/Oct/2007:11:09:44 -0700] "GET / HTTP/1.1" 200 9068 "-"
"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322;
.NET CLR 2.0.50727; .NET CLR 3.0.04506.30; InfoPath.2)"
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org