Return-Path: 
 <users-return-221085-apmail-tomcat-users-archive=tomcat.apache.org@tomcat.apache.org>
Delivered-To: apmail-tomcat-users-archive@www.apache.org
Received: (qmail 22831 invoked from network); 19 Jan 2011 22:57:41 -0000
Received: from hermes.apache.org (HELO mail.apache.org) (140.211.11.3)
  by minotaur.apache.org with SMTP; 19 Jan 2011 22:57:41 -0000
Received: (qmail 40871 invoked by uid 500); 19 Jan 2011 22:57:38 -0000
Delivered-To: apmail-tomcat-users-archive@tomcat.apache.org
Received: (qmail 40736 invoked by uid 500); 19 Jan 2011 22:57:37 -0000
Mailing-List: contact users-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
List-Help: <mailto:users-help@tomcat.apache.org>
List-Unsubscribe: <mailto:users-unsubscribe@tomcat.apache.org>
List-Post: <mailto:users@tomcat.apache.org>
List-Id: <users.tomcat.apache.org>
Reply-To: "Tomcat Users List" <users@tomcat.apache.org>
Delivered-To: mailing list users@tomcat.apache.org
Received: (qmail 40727 invoked by uid 99); 19 Jan 2011 22:57:37 -0000
Received: from nike.apache.org (HELO nike.apache.org) (192.87.106.230)
    by apache.org (qpsmtpd/0.29) with ESMTP; Wed, 19 Jan 2011 22:57:37 +0000
X-ASF-Spam-Status: No, hits=-0.0 required=10.0
	tests=SPF_PASS
X-Spam-Check-By: apache.org
Received-SPF: pass (nike.apache.org: local policy)
Received: from [67.90.184.26] (HELO mail.pdinc.us) (67.90.184.26)
    by apache.org (qpsmtpd/0.29) with ESMTP; Wed, 19 Jan 2011 22:57:29 +0000
Received: from phoenix (73.sub-97-167-228.myvzw.com [97.167.228.73])
	(authenticated bits=0)
	by mail.pdinc.us (8.12.11.20060308/8.12.11) with ESMTP id p0JMvAel021986
	for <users@tomcat.apache.org>; Wed, 19 Jan 2011 17:57:21 -0500
From: "Jason Pyeron" <jpyeron@pdinc.us>
To: "'Tomcat Users List'" <users@tomcat.apache.org>
References: <B7554865-0B7D-40F1-8193-7C19607625B7@gmail.com>
 <DD9C3C64B29B48989CE14113AE832621@phoenix>
 <4D376AB5.20409@christopherschultz.net>
Subject: RE: Request Line Truncated and Caused 501
Date: Wed, 19 Jan 2011 17:54:45 -0500
Organization: PD Inc
Message-ID: <1E52F661C4E74442B9E99057C370AF76@phoenix>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Mailer: Microsoft Office Outlook 11
In-Reply-To: <4D376AB5.20409@christopherschultz.net>
Thread-Index: Acu4K136xmIzsWiqTkWr/plJP+cUzAAAAeIw
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5994
X-Virus-Checked: Checked by ClamAV on apache.org

> -----Original Message-----
> From: Christopher Schultz 
> Sent: Wednesday, January 19, 2011 17:50
> To: Tomcat Users List
> Subject: Re: Request Line Truncated and Caused 501
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Jason,
> 
> On 1/19/2011 3:05 PM, Jason Pyeron wrote:
> >> -----Original Message-----
> >> From: Yuesong Wang > Sent: Wednesday, January 19, 2011 14:55
> >> To: users@tomcat.apache.org
> >> Subject: Request Line Truncated and Caused 501
> >>
> >> Hi,
> >>
> >> I have tomcat 6.0.29 configured using the NIO connector running on 
> >> linux. My access log shows strange 501 errors like this:
> >>
> > 
> > Does the NIO think it is on windows?
> 
> Why would that matter?

Seen problems like this in perl, oracle, and may other things written for
windows run on non-windows.

> 
> >> 86.24.156.114 - - [19/Jan/2011:14:41:28 -0500] "eferer: 
> >> /static/r07/sh30.html " 501 1235 "-" "-"
> >> 41.203.64.251 - - [19/Jan/2011:14:39:18 -0500] "ET <actual
> >> url> HTTP/1.1" 501 1220 "<actual referrer>" "Mozilla/4.0
> >> (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; GTB6.6; 
> >> SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; 
> >> Media Center PC 6.0; CPNTDF; .NET4.0C)"
> >>
> > 
> > If chomping off the 0x0A when there is none, you could get this.
> 
> HTTP protocol says lines end with CR LF.
> 

Then is the client not sending it and the tomcat code skipping... (I did see the
no leading CRLF below)

> Perhaps the client is broken? It says MSIE, so it probably is. :)
> 
> The first line of the request shouldn't contain a leading CR 
> or LF and should start with an HTTP verb (like GET). It looks 
> like "GET" is being truncated to "ET" at some point.

Good point.

> 
> >> I
> >> thought it had to do with the maxHttpHeaderSize being too 
> small, and 
> >> tried to reproduce it but couldn't. I suspect the http 
> request itself 
> >> is malformed, but can't be sure because I can't get to the raw 
> >> request (RequestDumperValve happens after the raw request 
> is parsed I 
> >> think).
> >>
> >> Any idea what the problem may be or how to go about investigating 
> >> this?
> 
> Can you search your access log for requests that don't start 
> with valid HTTP verbs? That might help you narrow down what 
> conditions cause the requests to get mangled. Maybe there 
> really is some broken client out there.
> 
> What % of requests does this represent? What opportunities do 
> you have to reconfigure the server and continue to collect data?
> 

And can this be reproduced?


--
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
-                                                               -
- Jason Pyeron                      PD Inc. http://www.pdinc.us -
- Principal Consultant              10 West 24th Street #100    -
- +1 (443) 269-1555 x333            Baltimore, Maryland 21218   -
-                                                               -
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
This message is copyright PD Inc, subject to license 20080407P00.

 



---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org