Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Going through my assess-logs today, I found so many entries trying to access pages. (that were not present). Like

  • robots.txt (I know what this is used for)
  • apply
  • favicon.ico(I know what this is used for)
  • etc

So, obviously a 404 was returned but there was other 3 digit code(?) along with 404.

ip-address - - [date & time] "GET /some/file_OR_folder HTTP/1.1" 404 312
ip-address - - [date & time] "GET /some/file_OR_folder HTTP/1.1" 404 285
ip-address - - [date & time] "GET /some/file_OR_folder HTTP/1.1" 404 286
ip-address - - [date & time] "GET /some/file_OR_folder HTTP/1.1" 404 287
ip-address - - [date & time] "GET /some/file_OR_folder HTTP/1.1" 404 288
ip-address - - [date & time] "GET /some/file_OR_folder HTTP/1.1" 404 289
ip-address - - [date & time] "GET /some/file_OR_folder HTTP/1.1" 404 290
ip-address - - [date & time] "GET /some/file_OR_folder HTTP/1.1" 404 295
ip-address - - [date & time] "GET /some/file_OR_folder HTTP/1.1" 404 296
ip-address - - [date & time] "GET /some/file_OR_folder HTTP/1.1" 404 297
ip-address - - [date & time] "GET /some/file_OR_folder HTTP/1.1" 404 298
ip-address - - [date & time] "GET /some/file_OR_folder HTTP/1.1" 404 301

A search gave me this: Samples of attacks detected by ossec - OSSEC Wiki: Which says it was a web scan detected by ossec (looking for Wordpress, xmlrpc and awstats) .

What the second status codes(286, 289) for in the above log?

share|improve this question

1 Answer 1

up vote 5 down vote accepted

They aren't status codes, they're the response length in bytes.

share|improve this answer
    
Thanks. If every request(from same ip) I saw was a 404 , then the same error page should be delivered back why is the change in the length? –  ThinkingMonkey Jan 25 '12 at 20:06
1  
@ThinkingMonkey Headers –  Chris S Jan 25 '12 at 20:07
    
@ChrisS hmmm... gotta go through http headers a bit. Thanks. –  ThinkingMonkey Jan 25 '12 at 20:09
5  
@ChrisS that is the length of the reply without the header. The length of the requested filename makes the difference. –  ott-- Jan 25 '12 at 20:14

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.