Welcome to WebProNews Breaking eBusiness and Search News
Advertise | Newsletter | Sitemap | News Feeds News Feed 
 WebProNews Search Part of the iEntry network iEntry inc. 

Unexpected Entries In Apache Error_log

A.P. Lawrence
Expert Author
Published: 2006-03-14

WebProNews RSS Feed


For some time now I have noticed a large number of entries in my Apache error log.

I looked at them briefly, but didn't have enough spare time to see why I was getting so many, so I just ignored this for many months.

Well, I finally found the time to look into this and was both surprised and puzzled by what I found. Frankly, I'm still puzzled by some of it.

Some errors just can't be avoided, or at least aren't worth avoiding. People will mis-type addresses, and although you can use redirection if you get certain mistakes regularly, you can't easily account for everything that might come your way. There are Apache add-ons like mod_speling (yes, "speling") that can auto-correct some goofs, but there are limits to what it can do also.

Common breach attempts can be redirected, but I had done all of that a long time ago. My logs still had thousands of errors. Sometimes I'd notice that I had made a mistake in an internal link, but there were just too many to explain that way. It was only after taking the time to really study the logs that I realized what most of the errors were:

Some web clients apparently weren't resolving links correctly.

Let's say I want to put a link to my "info.html" page in this article. The info page is in the root of my htdocs directory, so I can refer to it in an href either as "http://aplawrence.com/info.html" or just "/info.html". If I carelessly left off the leading "/" and just did "info.html", then your browser should interpret that as "http://aplawrence.com/Web/info.html", which is not what I intended. However, with the leading "/", your browser should fetch the right page. My error logs, however, showed me that some clients were not interpreting "/info" correctly and would attempt to access "info.html" relative to the current file's directory.

[Thu Jan 05 05:15:04 2006] [error] [client 81.56.248.160] File does
not exist: /usr/local/www/vhosts/vps.pcunix.com/htdocs/foo-web/Blog


Note that you can also control the interpretation with a "base" directive, but I decided it was easier just to adjust my code to do absolute references (http://aplawrence.com/info.html). This would be annoying if I ever moved these pages to a different domain, however, so there is value to "base".

I made the changes in my header files, and thought that I'd see a decrease in the error log entries. To my surprise, the errors continue. Momentarily, I'm at a loss to explain these: unless there is a script somewhere I'm not thinking of, I don't see how or why this should be happening. Interestingly, it seems to be more frequent in directories I just created and populated recently when I decided to close "foo-web.com", "foo-mac.com" and "foo-self-employed.com" and move the content back here (to /foo-web/, foo-mac/ and foo-self-employed/). I had done that with 301 redirects at the "foo-" sites:

redirect 301 / http://aplawrence.com/foo-web/

and so on. That works, but the errors still continue.

I also see a lot of this kind of error:

[Thu Jan 05 01:51:56 2006] [error] [client 4.152.87.247] File does
not exist: /usr/local/www/vhosts/vps.pcunix.com/htdocs/Unixart/Telephone
Switch Considered Harmful_files, referer:
http://aplawrence.com/Unixart/dhtelephoneswitch.html


[Thu Jan 05 01:35:38 2006] [error] [client 200.55.154.9] File does
not exist: /usr/local/www/vhosts/vps.pcunix.com/htdocs/Unix-Linux
Skills Tests-Certification Exam Resources_archivos


Sometimes there's referrer info, sometimes not, but if I look at the referring page, the bad link doesn't seem to originate there. I suppose it might sometimes be explained by corruption - a bad read that happens now and then? I vaguely remember that I saw this originating from Yahoo or some other search results once where the href was formed from the title tag value. Entries like this in the ordinary log seem to support that:

200.40.97.134 - - [02/Jan/2006:14:28:30 +0000] "GET
/Linux/Lost%20root%20password%20(Linux)_archivos/btracker.htm
HTTP/1.0" 301 291 "http://aplawrence.com/Linux/lostlinuxpassword.html"
"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR
1.1.4322)"

200.40.97.134 - - [02/Jan/2006:14:28:30 +0000] "GET
/Linux/Lost%20root%20password%20(Linux)_archivos/btracker.html
HTTP/1.0" 404 3770 "http://aplawrence.com/Linux/lostlinuxpassword.html"
"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR
1.1.4322)"

148.235.180.242 - - [03/Jan/2006:16:41:44 +0000] "GET
/Unixart/Perl%20NetFTP_archivos/btracker.htm HTTP/1.1" 301 274
"http://aplawrence.com/Unixart/perlnetftp.html" "Mozilla/4.0
(compatible; MSIE 6.0; Windows NT 5.0)"


Notice the common theme of "_archivos/btracker.html". That makes me suspicioious that these actually originate as bad links elsewhere. I see "btracker" and "pliki" a lot and have no idea why.

Then there's the really off the wall stuff:

[Thu Jan 05 08:09:28 2006] [error] [client 65.245.103.190] File
does not exist: /usr/local/www/vhosts/vps.pcunix.com/htdocs/ccbill7,
referer: http://aplawrence.com/ccbill7/secure/ccbill.log

[Thu Jan 05 08:08:35 2006] [error] [client 202.129.12.14] File does not
exist: /usr/local/www/vhosts/vps.pcunix.com/htdocs/data2, referer:
http://aplawrence.com/data2/verotellog.txt


There are no such files. The referer pages flat doesn't exist, and the directories they supposedly live in don't exist either. A little web research indicates that these are hack attempts; apparently ccbill is often used by adult web sites and the log files may contain credit card or password information. The "verotellog.txt" appears to be something similar. That explains that.

So.. some progress, but still a lot of puzzles.

*Originally published at APLawrence.com

Add to | DiggThis | Yahoo! My Web

Receive Our Daily Email of Breaking eBusiness News


About the Author:
A.P. Lawrence provides SCO Unix and Linux consulting services http://www.pcunix.com

WebProNews RSS Feed

More Expert Articles Articles

Contact WebProNews
Advertisement





TOP NEWS

Targeted Information for Business
WebProNews is part of the iEntry network

Internet Business: Marketing: Small Business:
WebProNews MarketingNewz SmallBusinessNewz
WebProWorld AdvertisingDay PromoteNews
EcommNewz SalesNewz EntrepreneurNewz

Software: Search Engines: Web Design:
WebMasterFree Jayde B2B DesignNewz
NetworkingFiles SearchZA FlashNewz
SecurityConfig SearchNewz WebSiteNotes

Developer: IT Management: Security:
DevWebPro ITManagement SecurityProNews
DevNewz SysAdminNews SecurityConfig
TheDevWeb NetworkingFiles NetworkNewz

The iEntry Network consists of over 100 web publications reaching millions of Internet Professionals. Contact us to advertise.
eBUSINESS RESOURCES






 Advertise | Contact Us | Corporate | Newsletter | Sitemap | Submit an Article | News Feeds
 WebProNews is an iEntry, Inc. ® publication - $line) { echo $line ; } ?> All Rights Reserved
About WebProNews
WebProNews is the number one source for eBusiness News. Over 5 million eBusiness professionals read WebProNews and other iEntry business and tech publications.

WebProNews provides real-time coverage of internet business.

Free Email Newsletters:
WebProNews SearchNewz
WebProWorld DevWebPro
Marketing SecurityNews
Plus over 100 other newsletters!

Send me relevant info on products and services.


WebProWorld
Ten most recent posts.

NetworkingFiles
Featured Software

WebProNews in the News
View all recent mentions of WebProNews from around the world!

Recent Articles On ...
Google eBusiness
Yahoo Ask Jeeves
MSN Blogs
Search Engines Blogging
Affiliate Programs Marketing
eCommerce Advertising
eBay Sun Microsystems
AOL Adsense
Microsoft Adwords
Oracle IBM
Amazon Apple
SEM Mac
SEO iPod
Adsense XBox
PR Adobe



iEntry.com WebProWorld RSS Feed WebProWorld Contact WebProNews Print Version Email a friend Bookmark us