1

I noticed today that my apache log files have filled up with gigabytes of the following line:

[SOME_TIME] [error] [client SOME_CLIENT] user__not found: /SOME_URI

NOTE: the __ (double underscore) represents 2 spaces. It's like apache is trying to reference an empty string for a username or userid.

What is the cause of such an error showing up in the logs?

2
  • Do you have a load of connections from the same IP? Perhaps a badly made DoS client, or something. First thing that sprung to my mind.
    – LMS
    Nov 6, 2012 at 22:01
  • Maybe it is some sort of weird DoS client. I'm hoping to get an understanding on "why would apache spit out such a line?" Is it a more likely a misbehaved client or is it more likely a misconfigured server? Wouldn't know until I actually understand what such a cryptic log entry comes from.
    – starlocke
    Nov 6, 2012 at 22:09

1 Answer 1

1

This looks like a log entry for a failed (basic?) authentication request. Many sites used to have a bug which allowed users to log in using empty username/password combination. Other protection could be bypassed by typing whitespace characters. Obviously someone thought that your site might have one of those "features".

1
  • Sounds plausible. I'll be digging further into this issue, trying to reproduce using 'funny clients' (hm... telnet?). Hopefully it won't end up with me into the foreign world of Apache2 source code XD
    – starlocke
    Nov 7, 2012 at 16:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .