Received: (qmail 18388 invoked by uid 2012); 15 Dec 1998 15:50:41 -0000 Message-Id: <19981215155041.18387.qmail@hyperreal.org> Date: 15 Dec 1998 15:50:41 -0000 From: Darrel Earhart Reply-To: orion406@yahoo.com To: apbugs@hyperreal.org Subject: Access_log logging strange 'undefined' entries X-Send-Pr-Version: 3.2 >Number: 3537 >Category: mod_log-any >Synopsis: Access_log logging strange 'undefined' entries >Confidential: no >Severity: serious >Priority: medium >Responsible: apache >State: closed >Class: support >Submitter-Id: apache >Arrival-Date: Tue Dec 15 08:00:01 PST 1998 >Last-Modified: Tue Dec 15 08:02:26 PST 1998 >Originator: orion406@yahoo.com >Organization: >Release: 1.2.4 >Environment: Solaris 2.5.1, all current patches >Description: I've had this problem with both Apache and NCSA HTTPD1.3 web servers. The access _log logs an entry similar to this: machine.domain.whatever - - [07/Dec/1998:13:12:40 -0500] "GET /undefined HTTP/1.0" 404 - These entries are beginning to flood the access_log, going into the hundreds of thousands. What is causing this "/undefined" or "/null" entry? And what makes it strange is that the log entries happen within seconds of eachother during times when no one is on the machine. >How-To-Repeat: Don't know -- on an intranet. >Fix: I know it can't be someone going to documents that are simply not there, it wouldn't produce such an entry.And I know that the time pattern, although close, is not 100% consistent. >Audit-Trail: State-Changed-From-To: open-closed State-Changed-By: marc State-Changed-When: Tue Dec 15 08:02:26 PST 1998 State-Changed-Why: I see no reason to think this has anything to do with the web server, seeing as you are saying it is happening with multiple different web servers. It is almost certainly simply some broken client for some resaon requesting that file. That is exactly what you would get in the logs if a client was requesting a file that doesn't exist, so I don't know why you say that can't be the case. >Unformatted: [In order for any reply to be added to the PR database, ] [you need to include in the Cc line ] [and leave the subject line UNCHANGED. This is not done] [automatically because of the potential for mail loops. ] [If you do not include this Cc, your reply may be ig- ] [nored unless you are responding to an explicit request ] [from a developer. ] [Reply only with text; DO NOT SEND ATTACHMENTS! ]