Gossamer Forum
Home : General : Internet Technologies :

translating server log

Quote Reply
translating server log
Hi there. Can anyone tell me what the following means when encountered in a server log file? Thanks.

Code:
"Accept: */*" 400 - "-" "-"

Fractured Atlas :: Liberate the Artist
Services: Healthcare, Fiscal Sponsorship, Marketing, Education, The Emerging Artists Fund
Quote Reply
Re: [hennagaijin] translating server log In reply to
Hello Hennagaijin,

Looks like a custom log format or are you just posting part of a line ?

"Accept: */*" 400 - "-" "-"

Accept: */* looks like the mime types the client will accept

400 - looks like 400 Bad Request due to malformed syntax, the request could not be understood by the server

"-" looks like bytes sent ?? or other log field with no entry

Is this Apache ? Netscape ? IIS ? or ?? as a web server

Is this the Access, Error, referer or other log ?

C Ya

cornball
Quote Reply
Re: [cornball] translating server log In reply to
Thanks for the reply. Its the access log on a server running Apache.

Here's the full entry (IP address obscured only):

XX.XX.XXX.XXX - - [08/Nov/2002:12:31:20 -0800] "Accept: */*" 400 - "-" "-"

Fractured Atlas :: Liberate the Artist
Services: Healthcare, Fiscal Sponsorship, Marketing, Education, The Emerging Artists Fund
Quote Reply
Re: [hennagaijin] translating server log In reply to
Looks like a custom log format.

Look in httpd.conf to see what feilds are being written to this log.

C Ya

cornball
Quote Reply
Re: [cornball] translating server log In reply to
Unfortunately I can't do that, as it's a virtual host and I don't have access.

Full disclosure: I'm 95% confident this entry is being generated in response to a search spider that I've let loose on my site. It's generating a LOT of those, as well as quite a few entries in the error log. The script in question is PHPDig, if anyone is familiar with it. Anyway, I'm just trying to figure out how it works and what exactly it's doing, since it seems to be attempting some rather unorthodox things and I'm trying to decide whether to kill it altogether.

Thanks for your help.

Fractured Atlas :: Liberate the Artist
Services: Healthcare, Fiscal Sponsorship, Marketing, Education, The Emerging Artists Fund
Quote Reply
Re: [hennagaijin] translating server log In reply to
It looks like a broken spider or application. Instead of sending:

GET /someurl HTTP/1.0

as what to request, it's messing up the request and sending the Accept line first.

Cheers,

Alex
--
Gossamer Threads Inc.
Quote Reply
Re: [Alex] translating server log In reply to
Thanks. That makes sense, but it sure is bizarre. Not only does it seem to be a fairly popular and widely used script, but the pages are definitely being indexed. What sort of impact would one expect from a spider neglecting to send the GET line first? Is this something I should be concerned about, or is it just an oddity?

Fractured Atlas :: Liberate the Artist
Services: Healthcare, Fiscal Sponsorship, Marketing, Education, The Emerging Artists Fund
Quote Reply
Re: [hennagaijin] translating server log In reply to
It would mean the spider would not be able to fetch the page, instead it would get back a 400 Bad Request error page.

Cheers,

Alex
--
Gossamer Threads Inc.
Quote Reply
Re: [hennagaijin] translating server log In reply to
Hello Hennagaijin,

If you are testing why not infect you local computer with php, Apache and mysql

and then you can controll and see all the logs, and the httpd.conf settings.

Just copy your web site for your local Apache to use.

Use your IP for Apache or 127.0.0.1 . Change Html calls to this IP in pages.

And have fun. Learning is about making mistakes and discoveries.

thanks

cornball