httpd-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Rich Bowen <rbo...@rcbowen.com>
Subject Re: [users@httpd] LogFormat Combined - many logfile lines with no Referer or User-agent
Date Thu, 28 Jul 2011 13:40:40 GMT

On Jul 28, 2011, at 3:20 AM, Terry Kennedy wrote:

>  I'm using the default "LogFormat combined" directive in my httpd.conf
> file. That should generate logfile lines using this pattern:
> 
> "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\""
> 
>  There have always been occasional entries which don't contain the last
> 2 fields, for some reason.

These are optional fields which *may* be passed by a user agent. When they are passed, they
are not reliable - that is, they may be spoofed, trivially.

> 
>  However, I have observed a HUGE increase in the number of logfile lines
> missing these two fields, starting early in June, 2011.

It would be interesting to see what version of what browser released in the last 30 days.


>  Even if the Referer and User-agent data was missing for some reason, I
> would have expected httpd to log lines ending in "" "" or possibly "-" "-",
> since there are escaped literal quotes on either side of both of those 
> fields in the LogFormat config line. This makes me think that it is some-
> thing going on inside Apache (perhaps triggered by some external change).

Oh. Hmm. That's interesting. What I would look for, in that case, is more than one LogFormat
directive logging to the same location.

--
Rich Bowen
rbowen@rcbowen.com
rbowen@apache.org







---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org


Mime
View raw message