Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
Received-SPF: neutral (herse.apache.org: local policy)
Message-ID: <467059DD.60200@rowe-clan.net>
Date: Wed, 13 Jun 2007 13:55:57 -0700
From: "William A. Rowe, Jr." <wrowe@rowe-clan.net>
User-Agent: Thunderbird 1.5.0.12 (X11/20070530)
MIME-Version: 1.0
To: users@httpd.apache.org
References: <5f0f8dba0706130454q1fefc330tb88dcc83d43fd2be@mail.gmail.com>
In-Reply-To: <5f0f8dba0706130454q1fefc330tb88dcc83d43fd2be@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Subject: Re: [users@httpd] Suspicious logging in access.log

Asrai khn wrote:
> Hi from last few days i am getting the below in access.log, and also
> duno what had been changed this virtaul machine which is hosting our
> clients domains going unresponsive after running for few hours. before
> it was running cool from last 2 years.
> Version : httpd-2.2.4-2.fc6

Well, it isn't this attack...

%u0aeb

tells you it targets IIS, plus this hit the access logs.

You want to know which request kills things.  To find that out, you need
to load mod_log_forensic and capture all the requests as they arrive, and
see which ones run to completion v.s. which ones hang up the server.

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org