I'm facing quite interesting problem.
I have a server with hostname s1.company.net and there are many apache virtualhosts.
Time to time is server overloaded and if I check access log a can see thousands of accesses from server itself.
So in a logfile is something like this:

virtualhost.at s1.company.net - - [01/Aug/2013:14:13:00 +0200] "GET /page/detail/434-022-1-1 HTTP/1.1" 200 8434 "http://www.google.com" "Googlebot/2.1 (+http://www.google.com/bot.html)"

As far as I understand to logging process, that means webserver is accessed from address s1.company.net so from a server itself.
Could you please tell me is it normal or not and why?
Thanks a lot in advance.

  • 2
    Turn off HostnameLookups. That option should never be enabled. – Michael Hampton Aug 2 '13 at 13:21
  • Good point! IP address translation could be forged. – Tygr Aug 2 '13 at 13:37

Your log lines are not Apache httpd's default, so I would not make too many assumptions about the content of each field. Open Apache's configuration and find the LogFormat directive(s). See if %h appears anywhere in the format, as this is the foreign host connecting to the server. Full list of LogFormat variables here.

If it is the localhost connecting, you either have a proxy setup somewhere (check for Proxy directives in the configuration) or at least one of your sites has been compromised (thinking the former over the latter, but wouldn't make any assumptions at this point). It's also possible another service on the server is acting as a proxy.

  • No, it is not default we have custom one: LogFormat "%v %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"". I checked a config but there are no Proxy directives at all. – Tygr Aug 2 '13 at 13:49
  • Start checking other software on the server... It might help to turn HostnameLookups (httpd.conf directive) off so you can see the IP httpd thinks is accessing the server (might be a name resolution issue and not the server accessing itself). – Chris S Aug 2 '13 at 15:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.