Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am migrating some applications from Apache 1.3 to 2.2.

We used to run some tests where attacker opens some HTTP connection to our server, and do nothing. Apache 1.3 would log the following 408 code, for example:

126.1.86.85 - - [01/Dec/2010:06:26:19 +0000] "-" 408 - "-" 0
126.1.86.85 - - [01/Dec/2010:06:26:19 +0000] "-" 408 - "-" 0

But with Apache 2.2, nothing is logged to the log file. I run the same test by using netcat to open the connection:

$ nc IP_victim PORT_victim
$ nc 10.42.37.3 80

I would like to have Apache 2.2 log the same 408 code to the log file, so that we would know of attempted DoS attack from the outside. Do I need any more configuration in Apache 2 to enable this?

I have tried some different configurations such as LogLevel = Debug, Timeout 30, RequestReadTimeout header=10 body=30.

Thanks.

share|improve this question
    
When you say nothing is logged to the log file, do you mean nothing timeout related, or nothing at all? –  Decado Mar 14 '11 at 8:48
    
@Decado Nothing timeout related is logged. Normal requests are logged normally. –  m3rLinEz Mar 14 '11 at 10:28

1 Answer 1

up vote 1 down vote accepted

I found this in the Apache mailing list https://issues.apache.org/bugzilla/show_bug.cgi?id=39785. Which talks about this. This looks like it was resolved in apache release 2.2.2. This is the relevent check in http://svn.apache.org/viewvc?view=revision&revision=919323. It has a comment stating "Only log a 408 if it is no keepalive timeout."

So check to see if you have a value for KeepAlive set and check to make sure you're at version 2.2.2 or higher.

share|improve this answer
    
Thanks for pointing this out. I found another thread in the list that suggests 408 will not be log when connection is open but nothing is sent. –  m3rLinEz Mar 17 '11 at 4:12
    
httpd.markmail.org/search/… –  m3rLinEz Mar 17 '11 at 4:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.