Unexpected entries in Apache error_log

For some time now I have noticed a large number of entries in my Apache error log. I looked at them briefly, but didn't have enough spare time to see why I was getting so many, so I just ignored this for many months.

Well, I finally found the time to look into this and was both surprised and puzzled by what I found. Frankly, I'm still puzzled by some of it.

Some errors just can't be avoided, or at least aren't worth avoiding. People will mis-type addresses, and although you can use redirection if you get certain mistakes regularly, you can't easily account for everything that might come your way. There are Apache add-ons like mod_speling (yes, "speling") that can auto-correct some goofs, but there are limits to what it can do also.

Common breach attempts can be redirected, but I had done all of that a long time ago. My logs still had thousands of errors. Sometimes I'd notice that I had made a mistake in an internal link, but there were just too many to explain that way. It was only after taking the time to really study the logs that I realized what most of the errors were:

Some web clients apparently weren't resolving links correctly.

Let's say I want to put a link to my "info.html" page in this article. The info page is in the root of my htdocs directory, so I can refer to it in an href either as "http://aplawrence.com/info.html" or just "/info.html". If I carelessly left off the leading "/" and just did "info.html", then your browser should interpret that as "http://aplawrence.com/Web/info.html", which is not what I intended. However, with the leading "/", your browser should fetch the right page. My error logs, however, showed me that some clients were not interpreting "/info" correctly and would attempt to access "info.html" relative to the current file's directory.

[Thu Jan 05 05:15:04 2006] [error] [client 81.56.248.160] File does
not exist: /usr/local/www/vhosts/vps.pcunix.com/htdocs/foo-web/Blog
 

Note that you can also control the interpretation with a "base" directive, but I decided it was easier just to adjust my code to do absolute references (http://aplawrence.com/info.html). This would be annoying if I ever moved these pages to a different domain, however, so there is value to "base".

I made the changes in my header files, and thought that I'd see a decrease in the error log entries. To my surprise, the errors continue. Momentarily, I'm at a loss to explain these: unless there is a script somewhere I'm not thinking of, I don't see how or why this should be happening. Interestingly, it seems to be more frequent in directories I just created and populated recently when I decided to close "foo-web.com", "foo-mac.com" and "foo-self-employed.com" and move the content back here (to /foo-web/, foo-mac/ and foo-self-employed/). I had done that with 301 redirects at the "foo-" sites:

redirect 301 / http://aplawrence.com/foo-web/
 

and so on. That works, but the errors still continue.

I also see a lot of this kind of error:

[Thu Jan 05 01:51:56 2006] [error] [client 4.152.87.247] File does
not exist: /usr/local/www/vhosts/vps.pcunix.com/htdocs/Unixart/Telephone
Switch Considered Harmful_files, referer:
http://aplawrence.com/Unixart/dhtelephoneswitch.html 

[Thu Jan 05 01:35:38 2006] [error] [client 200.55.154.9] File does
not exist: /usr/local/www/vhosts/vps.pcunix.com/htdocs/Unix-Linux
Skills Tests-Certification Exam Resources_archivos
 

Sometimes there's referrer info, sometimes not, but if I look at the referring page, the bad link doesn't seem to originate there. I suppose it might sometimes be explained by corruption - a bad read that happens now and then? I vaguely remember that I saw this originating from Yahoo or some other search results once where the href was formed from the title tag value. Entries like this in the ordinary log seem to support that:

200.40.97.134 - - [02/Jan/2006:14:28:30 +0000] "GET
/Linux/Lost%20root%20password%20(Linux)_archivos/btracker.htm
HTTP/1.0" 301 291 "http://aplawrence.com/Linux/lostlinuxpassword.html"
"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR
1.1.4322)" 

200.40.97.134 - - [02/Jan/2006:14:28:30 +0000] "GET
/Linux/Lost%20root%20password%20(Linux)_archivos/btracker.html
HTTP/1.0" 404 3770 "http://aplawrence.com/Linux/lostlinuxpassword.html"
"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR
1.1.4322)" 

148.235.180.242 - - [03/Jan/2006:16:41:44 +0000] "GET
/Unixart/Perl%20NetFTP_archivos/btracker.htm HTTP/1.1" 301 274
"http://aplawrence.com/Unixart/perlnetftp.html" "Mozilla/4.0
(compatible; MSIE 6.0; Windows NT 5.0)"
 

Notice the common theme of "_archivos/btracker.html". That makes me suspicioious that these actually originate as bad links elsewhere. I see "btracker" and "pliki" a lot and have no idea why.

Then there's the really off the wall stuff:

[Thu Jan 05 08:09:28 2006] [error] [client 65.245.103.190] File
does not exist: /usr/local/www/vhosts/vps.pcunix.com/htdocs/ccbill7,
referer: http://aplawrence.com/ccbill7/secure/ccbill.log 

[Thu Jan 05 08:08:35 2006] [error] [client 202.129.12.14] File does not
exist: /usr/local/www/vhosts/vps.pcunix.com/htdocs/data2, referer:
http://aplawrence.com/data2/verotellog.txt
 

There are no such files. The referer pages flat doesn't exist, and the directories they supposedly live in don't exist either. A little web research indicates that these are hack attempts; apparently ccbill is often used by adult web sites and the log files may contain credit card or password information. The "verotellog.txt" appears to be something similar. That explains that.

So.. some progress, but still a lot of puzzles.

Comments?

More Articles by Anthony Lawrence - Find me on Google+

Jump to Comments

Many of the products and books I review are things I purchased for my own use. Some were given to me specifically for the purpose of reviewing them. I resell or can earn commissions from the sale of some of these items. Links within these pages may be affiliate links that pay me for referring you to them. That's mostly insignificant amounts of money; whenever it is not I have made my relationship plain. I also may own stock in companies mentioned here. If you have any question, please do feel free to contact me.

Specific links that take you to pages that allow you to purchase the item I reviewed are very likely to pay me a commission. Many of the books I review were given to me by the publishers specifically for the purpose of writing a review. These gifts and referral fees do not affect my opinions; I often give bad reviews anyway.

We use Google third-party advertising companies to serve ads when you visit our website. These companies may use information (not including your name, address, email address, or telephone number) about your visits to this and other websites in order to provide advertisements about goods and services of interest to you. If you would like more information about this practice and to know your choices about not having this information used by these companies, click here.