3

We have a custom log line format for Apache logs which are analyzed.

CustomLog "|/usr/sbin/rotatelogs -l /mnt/var/log/apache2/access-%Y%m%d%H%M%S.log 900" "%a %{%s}t \"%r\""

However, some log lines are mysteriously shortened with "..." for some reason, but how can this be? The shortest length line discovered where this occurs is 317 chars while the longest line is way over 2000 chars.

"GET /exposure?sg=&ap=0x0&fv=WIN%2010,0,22,87&si=IH95VDUAVLJ0&pt=Lage%20hjemmelaget%20sengegavl%20-%20Forum%20-%20Diskusjon.no&iv=0&sd=1024x600&ct=680&tz=-120&eu=http%3A//www.diskusjon.no/index.php%3Fshowtopic%3D1011139&l...AS3&an=NO%20-%20180x500%20Pretail%20CPC&wd=1024x483&rf=http%3A//www.google.no/search%3Fhl%3Dno%26source%3Dhp%26q%3Dsengegavl+lage%26meta%3D%26aq%3D2%26aqi%3Dg10%26aql%3D%26oq%3Dsengega%26gs_rfai%3D&ui=3INYF5QAZL10&ws=0x417&ad=180x500&sa= HTTP/1.1"

2 Answers 2

1

See any of these questions.

GET URI's in general shouldn't be longer than 255 character, if you need to send more info than that, use POST. Using longer URIs causes all kinds of havoc, including ellipses in the logs, proxy problems, and in extreme cases 414 errors.

2
  • It is probably not his website which is generating those URLs. I have often hackers who try to get into my website with such long URLs. It would be extremely helpful if I could see the full URL in order to see what kind of bug they try to find. Jun 7, 2010 at 16:57
  • Regardless of who is generating the request, he asked how a log entry could be generated with a "...", and I answered.
    – Chris S
    Jun 7, 2010 at 18:25
0

How do you know Apache is truncating the URLs? Are you seeing these in the middle of a user session? The simpler answer might be that someone e-mails a too-long URL to somebody else, and it gets rendered with an ellipsis, and the user cuts-and-pastes the URL with the ellipsis . . .

But yes, I'm with Chris on this one: the real problem is that your URLs are too long, and something--probably not Apache--is truncating them. The correct solution would be to manage your software to support shorter URLs that wouldn't beg for weird truncation issues.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .