Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

for some reason I keep on getting the following log event repeatedly in my apache logs:

Jun 11 20:48:59 ruby apache_cvrugby_access_rsys: 77.78.104.50 - - [11/Jun/2013:20:48:58 -0400] "GET /server-status HTTP/1.0" 200 306923 "-" "-"

(with different times, etc, same ip though)

here is a screenshot of what I am talking about, though this has been going on all day so there is much more than what is shown: enter image description here

Should I be worried about such activity (person sending requests may be up to no good, etc), or is this normal behavior? This is the first time I've seen such a thing in my logs. Thanks for your help!

share|improve this question
add comment

1 Answer

up vote 5 down vote accepted

Do you have mod_status enabled?

If so, are remote devices allowed to access it without authentication?

If so.. yeah, that's a bad thing. Look for a SetHandler server-status line in your configuration - access to that needs to be locked down.

share|improve this answer
    
Thanks! Had checked out the settings and think I have things squared away, have this friendly sight in my error logs now too haha i.imgur.com/I5vh6dV.png, may just block his ip completely though if he keeps it up at this rate for more than a few days –  lacrosse1991 Jun 12 '13 at 16:39
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.