Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I noticed today that my apache log files have filled up with gigabytes of the following line:

[SOME_TIME] [error] [client SOME_CLIENT] user__not found: /SOME_URI

NOTE: the __ (double underscore) represents 2 spaces. It's like apache is trying to reference an empty string for a username or userid.

What is the cause of such an error showing up in the logs?

share|improve this question
    
Do you have a load of connections from the same IP? Perhaps a badly made DoS client, or something. First thing that sprung to my mind. –  Liam McSherry Nov 6 '12 at 22:01
    
Maybe it is some sort of weird DoS client. I'm hoping to get an understanding on "why would apache spit out such a line?" Is it a more likely a misbehaved client or is it more likely a misconfigured server? Wouldn't know until I actually understand what such a cryptic log entry comes from. –  starlocke Nov 6 '12 at 22:09

1 Answer 1

This looks like a log entry for a failed (basic?) authentication request. Many sites used to have a bug which allowed users to log in using empty username/password combination. Other protection could be bypassed by typing whitespace characters. Obviously someone thought that your site might have one of those "features".

share|improve this answer
    
Sounds plausible. I'll be digging further into this issue, trying to reproduce using 'funny clients' (hm... telnet?). Hopefully it won't end up with me into the foreign world of Apache2 source code XD –  starlocke Nov 7 '12 at 16:48

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.