Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have a custom log line format for Apache logs which are analyzed.

CustomLog "|/usr/sbin/rotatelogs -l /mnt/var/log/apache2/access-%Y%m%d%H%M%S.log 900" "%a %{%s}t \"%r\""

However, some log lines are mysteriously shortened with "..." for some reason, but how can this be? The shortest length line discovered where this occurs is 317 chars while the longest line is way over 2000 chars.

"GET /exposure?sg=&ap=0x0&fv=WIN%2010,0,22,87&si=IH95VDUAVLJ0&pt=Lage%20hjemmelaget%20sengegavl%20-%20Forum%20-%20Diskusjon.no&iv=0&sd=1024x600&ct=680&tz=-120&eu=http%3A//www.diskusjon.no/index.php%3Fshowtopic%3D1011139&l...AS3&an=NO%20-%20180x500%20Pretail%20CPC&wd=1024x483&rf=http%3A//www.google.no/search%3Fhl%3Dno%26source%3Dhp%26q%3Dsengegavl+lage%26meta%3D%26aq%3D2%26aqi%3Dg10%26aql%3D%26oq%3Dsengega%26gs_rfai%3D&ui=3INYF5QAZL10&ws=0x417&ad=180x500&sa= HTTP/1.1"

share|improve this question
add comment

2 Answers

See any of these questions.

GET URI's in general shouldn't be longer than 255 character, if you need to send more info than that, use POST. Using longer URIs causes all kinds of havoc, including ellipses in the logs, proxy problems, and in extreme cases 414 errors.

share|improve this answer
    
It is probably not his website which is generating those URLs. I have often hackers who try to get into my website with such long URLs. It would be extremely helpful if I could see the full URL in order to see what kind of bug they try to find. –  Raffael Luthiger Jun 7 '10 at 16:57
    
Regardless of who is generating the request, he asked how a log entry could be generated with a "...", and I answered. –  Chris S Jun 7 '10 at 18:25
add comment

How do you know Apache is truncating the URLs? Are you seeing these in the middle of a user session? The simpler answer might be that someone e-mails a too-long URL to somebody else, and it gets rendered with an ellipsis, and the user cuts-and-pastes the URL with the ellipsis . . .

But yes, I'm with Chris on this one: the real problem is that your URLs are too long, and something--probably not Apache--is truncating them. The correct solution would be to manage your software to support shorter URLs that wouldn't beg for weird truncation issues.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.