2

I'm having a problem with a server that keeps falling over. Looking through the Apache error logs it appears to come from a rogue PHP script. I'm trying to track this down using Apache's error_log and access_log but the server log format isn't giving me the detail I need.

I suspect the log format isn't sufficient, but I've reviewed the Apache documentation and I've included the switches that I think I need to see.

Here's my LogFormat configuration in the httpd.conf file:

`LogFormat "%h %l %u %t \"%r\" %>s %b %U %q %T \"%{Referer}i\" \"%{User-Agent}i\"" extended

CustomLog logs/access_log extended`

Using the %U %q %T switches I expected to see the requested URL, query string, and the time it took to serve the request, but I'm not seeing any of this information when I tail the log.

Here's an example:

127.0.0.1 - - [01/Jun/2010:14:12:04 +0100] "OPTIONS * HTTP/1.0" 200 - * 0 "-" "Apache/2.2.15 (Unix) mod_ssl/2.2.15 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 (internal dummy connection)" 127.0.0.1 - - [01/Jun/2010:14:12:05 +0100] "OPTIONS * HTTP/1.0" 200 - * 0 "-" "Apache/2.2.15 (Unix) mod_ssl/2.2.15 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 (internal dummy connection)" 127.0.0.1 - - [01/Jun/2010:14:12:06 +0100] "OPTIONS * HTTP/1.0" 200 - * 0 "-" "Apache/2.2.15 (Unix) mod_ssl/2.2.15 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 (internal dummy connection)" 127.0.0.1 - - [01/Jun/2010:14:12:07 +0100] "OPTIONS * HTTP/1.0" 200 - * 0 "-" "Apache/2.2.15 (Unix) mod_ssl/2.2.15 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 (internal dummy connection)" 127.0.0.1 - - [01/Jun/2010:14:12:08 +0100] "OPTIONS * HTTP/1.0" 200 - * 0 "-" "Apache/2.2.15 (Unix) mod_ssl/2.2.15 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 (internal dummy connection)" 127.0.0.1 - - [01/Jun/2010:14:12:09 +0100] "OPTIONS * HTTP/1.0" 200 - * 0 "-" "Apache/2.2.15 (Unix) mod_ssl/2.2.15 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 (internal dummy connection)"

Have a made a mistake in configuring the LogFormat or is it something else?

Also, each request appears to come from the localhost. How come it's not giving me the remote user's IP address?

Thanks, Iarfhlaith

1

2 Answers 2

4

It's because it really is coming from the localhost -- it's Apache talking to itself.

See http://wiki.apache.org/httpd/InternalDummyConnection

5
  • It does seem strange that he is getting that request every second. Is that normal? Jun 1, 2010 at 15:10
  • Hey Joe, Thanks for responding. My main issue is not being able to see the requested URL in the server logs. If you or anyone else can see why my LogFormat isn't allowing this, I'd really appreciate it if you could show me what to change. Regards, Iarfhlaith
    – user44639
    Jun 1, 2010 at 15:44
  • 1
    You are seeing the requested URL, in this case it's "*". That's a legitimate request-uri for the OPTIONS method, w3.org/Protocols/rfc2616/rfc2616-sec9.html Jun 1, 2010 at 16:41
  • Derek : as it's only a few lines, it might be bursty, which is reasonable. On one of my servers, I've had over 50k such lines in the last 4.5 days (about 7.5/min, never in the same second). (and Iarfhlaith: Ernest is right, it's logging correctly)
    – Joe H.
    Jun 1, 2010 at 18:46
  • Thanks guys, I've got this sorted on my side. I think I was just reading the logs incorrectly. Appreciate the responses.
    – user44639
    Jun 2, 2010 at 10:21
0

Who might request OPTIONS ? Normal web users requests ONLY GET and POST. Connection checkers/Downtime Checker programs/bots request ONLY HEAD.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .