Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm a newbie to server admin, but I'm trying to get my head around our Apache server. I got a shock when I tried to tail the Apache error logs. Even after greping the logs so I was only seeing actual errors, I was getting about 1 error per second. The Apache Server Status page says the server is handling ~6.3 requests per second.

This seems like an insanely high rate of errors to me, but I'm unfamiliar with how most servers in the wild perform.

Am I looking at a server in desperate need of help (as I suspect)?

Or is this normal?

share|improve this question

3 Answers 3

up vote 1 down vote accepted

If you're getting errors, then you need to fix the cause. If you're getting warnings that you don't want, then you need to fix the problems (or reduce the LogLevel)

Without any more information (such as what errors you're seeing) it's impossible to give you any further assistance.

share|improve this answer
    
Many of the errors are "File does not exist", which I assume is a 404. In time, I guess, I can track all of these down and fix them. Most of the rest are (were?) application errors. I managed to fix 3 errors in some server side apps (2 were typos in my own code, and 1 was poor logic in an app from before my time at this job), and the flood of errors reduced to a trickle. (80% of the errors being caused by 20% of the code?) But I still get periodic application errors from a PHP app on the server. These include "db connection dropped", "invalid argument in for each", and "invalid resource". –  nedlud May 27 '09 at 5:55
    
sample errors look like... [Wed May 27 15:54:39 2009] [error] [client n.n.n.n] File does not exist: /usr/local/apache/htdocs/_vti_inf.html [Wed May 27 15:54:39 2009] [error] [client n.n.n.n] File does not exist: /usr/local/apache/htdocs/_vti_bin [Wed May 27 15:56:14 2009] [error] [client n.n.n.n] File does not exist: /usr/local/apache/htdocs/rch/favicon.ico [Wed May 27 15:57:25 2009] [error] [client n.n.n.n] File does not exist: /usr/local/apache/htdocs/_vti_bin [Wed May 27 15:57:25 2009] [error] [client n.n.n.n] File does not exist: /usr/local/apache/htdocs/MSOffice –  nedlud May 27 '09 at 6:06
    
Here's some better ones... [Wed May 27 16:12:46 2009] [error] [client n.n.n.n] PHP Warning: mysql_fetch_assoc(): supplied argument is not a valid MySQL result resource in /usr/local/apache/htdocs/webquiz/lib/ext/inc_db_connection.php on line 106... [Wed May 27 16:13:51 2009] [error] [client n.n.n.n] PHP Warning: Invalid argument supplied for foreach() in /usr/local/apache/htdocs/webquiz/lib/ext/inc_db_connection.php on line 139... –  nedlud May 27 '09 at 6:19
    
The _vti 404s aren't real. They're people trying to pwn your box. They start by sniffing for those frontpage extensions. As for the 'better' errors, those are actual warnings and errors in PHP that you should fix :-D –  RickMeasham May 27 '09 at 6:50
    
I wasn't sure about the _vti's. I suspected an attack, but saw some refernces to front page exensions being a possible cause. I've forwarded them to our security guy anyway. The PHP errors concern me. And the fact that my boss has told me to ignore them concerns me more. But thanks for your input. I really needed to know I wasn't on the wrong track worrying about these things. –  nedlud May 27 '09 at 10:11

The "vti*" 404 responses are related to somebody attempting to access unprotected Microsoft (IE. SharePoint) content on your apache server. This is probably because they thought you were using an IIS front-end web server instead of apache.

The "PHP Warnings" associated with "MySQL" and the "foreach()" queries, imply that somebody was attempting to perform SQL packet injections through common vulnerabilities found in PHP. These are techniques to gain information from a LAMP stack that is not up to date with security patches on either their MySQL DB, PHP or Apache version.

All in all, it looks like somebody was attempting to crack your box with some basic vulnerabilities and failed.

You may want to look into setting up some tighter security on your apache server, through mod_security, Deny/Allow directives, etc. Also, you may want to log the IP and host-name performing this vulnerability scan and setup an iptables rule to block it.

share|improve this answer

Please list the errors you are seeing. Generally, no it's not normal, ie "YOU'RE DOING IT RONG."

More than likely you have a bad conf setting.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.