Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

this is what my web access.log looks like (well a short snippet) - - [20/Jul/2011:11:56:18 +0100] "GET HTTP/1.0" 200 31161 - - [20/Jul/2011:11:56:17 +0100] "GET HTTP/1.1" 200 110698 - - [20/Jul/2011:11:56:20 +0100] "GET HTTP/1.1" 200 2842 - - [20/Jul/2011:11:56:59 +0100] "GET[0]&nid=5&pid=17587&sid=28749&spid=0&ns=0&nw=1&zone=0&url= HTTP/1.0" 200 762 - - [20/Jul/2011:11:59:45 +0100] "GET HTTP/1.0" 200 4580 - - [20/Jul/2011:11:59:45 +0100] "GET HTTP/1.0" 200 723 - - [20/Jul/2011:11:59:45 +0100] "GET HTTP/1.0" 200 4574 - - [20/Jul/2011:11:59:45 +0100] "GET HTTP/1.0" 200 1489 - - [20/Jul/2011:11:59:45 +0100] "GET HTTP/1.0" 302 280

My whole access.log is filled with lines like the above. Some including ebay links, some to car deals, some to porn. I really am lost in all of this, perhaps someone could offer some advice?

Since our logs started to look like this the server has really slowed down when it comes to serving pages, most of the time requests time out.

I'm guessing these things are related?

Many thanks,


share|improve this question

When you see a request which is for a remote URL you're seeing somebody either scanning for a proxy - testing to see if they can route traffic via your machine - or using one that is unlocked.

It looks like, from the status codes of 200 + 302, your machine is configured with Apache's mod_proxy, which means people are bouncing traffic around.

If you're not deliberately using mod_proxy you should disable it. If you are using it for some purpose you should tighten up security.

share|improve this answer
Thank you for your quick reply Steve! When I disable mod_proxy I can no longer view my websites. Why would this be? I don't believe I should have a use for a proxy, so is there a way around it? I suppose this is the problem with Apple's "Hey just pick up a server today and anyone can run it"... Thanks again! – Elliott Malone Jul 20 '11 at 12:04
I can't tell how you're using mod_proxy, but I do know it has a lot of security options. You should probably re-enable it only after reading: – Steve Kemp Jul 20 '11 at 13:16

In addition to Steves answer you could check Is my server being used as a proxy or is a DOS underway? Lots of traffic in my apache log - as pointed out there your IP might have previously used by a botnet.

share|improve this answer
Thanks I'm taking a look now! – Elliott Malone Jul 20 '11 at 12:05
Strangely enough this did start happening when we changed our IP address... That's a tad worrying. – Elliott Malone Jul 20 '11 at 12:07
Probably not as much as if your system itself had been hacked. Maybe requesting a "clean" IP address from your provider will solve the issue. – Filburt Jul 21 '11 at 8:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.