Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm having a problem with a server that keeps falling over. Looking through the Apache error logs it appears to come from a rogue PHP script. I'm trying to track this down using Apache's error_log and access_log but the server log format isn't giving me the detail I need.

I suspect the log format isn't sufficient, but I've reviewed the Apache documentation and I've included the switches that I think I need to see.

Here's my LogFormat configuration in the httpd.conf file:

`LogFormat "%h %l %u %t \"%r\" %>s %b %U %q %T \"%{Referer}i\" \"%{User-Agent}i\"" extended

CustomLog logs/access_log extended`

Using the %U %q %T switches I expected to see the requested URL, query string, and the time it took to serve the request, but I'm not seeing any of this information when I tail the log.

Here's an example:

127.0.0.1 - - [01/Jun/2010:14:12:04 +0100] "OPTIONS * HTTP/1.0" 200 - * 0 "-" "Apache/2.2.15 (Unix) mod_ssl/2.2.15 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 (internal dummy connection)" 127.0.0.1 - - [01/Jun/2010:14:12:05 +0100] "OPTIONS * HTTP/1.0" 200 - * 0 "-" "Apache/2.2.15 (Unix) mod_ssl/2.2.15 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 (internal dummy connection)" 127.0.0.1 - - [01/Jun/2010:14:12:06 +0100] "OPTIONS * HTTP/1.0" 200 - * 0 "-" "Apache/2.2.15 (Unix) mod_ssl/2.2.15 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 (internal dummy connection)" 127.0.0.1 - - [01/Jun/2010:14:12:07 +0100] "OPTIONS * HTTP/1.0" 200 - * 0 "-" "Apache/2.2.15 (Unix) mod_ssl/2.2.15 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 (internal dummy connection)" 127.0.0.1 - - [01/Jun/2010:14:12:08 +0100] "OPTIONS * HTTP/1.0" 200 - * 0 "-" "Apache/2.2.15 (Unix) mod_ssl/2.2.15 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 (internal dummy connection)" 127.0.0.1 - - [01/Jun/2010:14:12:09 +0100] "OPTIONS * HTTP/1.0" 200 - * 0 "-" "Apache/2.2.15 (Unix) mod_ssl/2.2.15 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 (internal dummy connection)"

Have a made a mistake in configuring the LogFormat or is it something else?

Also, each request appears to come from the localhost. How come it's not giving me the remote user's IP address?

Thanks, Iarfhlaith

share|improve this question
    
I had a similar issue once. You might find some valuable information at serverfault.com/questions/132829/… –  Stefan Lasiewski Jun 11 '10 at 20:46

2 Answers 2

up vote 4 down vote accepted

It's because it really is coming from the localhost -- it's Apache talking to itself.

See http://wiki.apache.org/httpd/InternalDummyConnection

share|improve this answer
    
It does seem strange that he is getting that request every second. Is that normal? –  Derek Organ Jun 1 '10 at 15:10
    
Hey Joe, Thanks for responding. My main issue is not being able to see the requested URL in the server logs. If you or anyone else can see why my LogFormat isn't allowing this, I'd really appreciate it if you could show me what to change. Regards, Iarfhlaith –  user44639 Jun 1 '10 at 15:44
1  
You are seeing the requested URL, in this case it's "*". That's a legitimate request-uri for the OPTIONS method, w3.org/Protocols/rfc2616/rfc2616-sec9.html –  Ernest Mueller Jun 1 '10 at 16:41
    
Derek : as it's only a few lines, it might be bursty, which is reasonable. On one of my servers, I've had over 50k such lines in the last 4.5 days (about 7.5/min, never in the same second). (and Iarfhlaith: Ernest is right, it's logging correctly) –  Joe H. Jun 1 '10 at 18:46
    
Thanks guys, I've got this sorted on my side. I think I was just reading the logs incorrectly. Appreciate the responses. –  user44639 Jun 2 '10 at 10:21

Who might request OPTIONS ? Normal web users requests ONLY GET and POST. Connection checkers/Downtime Checker programs/bots request ONLY HEAD.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.