Unexpected entries in Apache error_log

For some time now I have noticed a large number of entries in my Apache error log.

I looked at them briefly, but didn’t have enough spare time to see why I was getting so many, so I just ignored this for many months.

Well, I finally found the time to look into this and was both surprised and puzzled by what I found. Frankly, I’m still puzzled by some of it.

Some errors just can’t be avoided, or at least aren’t worth avoiding. People will mis-type addresses, and although you can use redirection if you get certain mistakes regularly, you can’t easily account for everything that might come your way. There are Apache add-ons like mod_speling (yes, “speling”) that can auto-correct some goofs, but there are limits to what it can do also.

Common breach attempts can be redirected, but I had done all of that a long time ago. My logs still had thousands of errors. Sometimes I’d notice that I had made a mistake in an internal link, but there were just too many to explain that way. It was only after taking the time to really study the logs that I realized what most of the errors were:

Some web clients apparently weren’t resolving links correctly.

Let’s say I want to put a link to my “info.html” page in this article. The info page is in the root of my htdocs directory, so I can refer to it in an href either as “http://aplawrence.com/info.html” or just “/info.html”. If I carelessly left off the leading “/” and just did “info.html”, then your browser should interpret that as “http://aplawrence.com/Web/info.html”, which is not what I intended. However, with the leading “/”, your browser should fetch the right page. My error logs, however, showed me that some clients were not interpreting “/info” correctly and would attempt to access “info.html” relative to the current file’s directory.

[Thu Jan 05 05:15:04 2006] [error] [client 81.56.248.160] File does
not exist: /usr/local/www/vhosts/vps.pcunix.com/htdocs/foo-web/Blog

Note that you can also control the interpretation with a “base” directive, but I decided it was easier just to adjust my code to do absolute references (http://aplawrence.com/info.html). This would be annoying if I ever moved these pages to a different domain, however, so there is value to “base”.

I made the changes in my header files, and thought that I’d see a decrease in the error log entries. To my surprise, the errors continue. Momentarily, I’m at a loss to explain these: unless there is a script somewhere I’m not thinking of, I don’t see how or why this should be happening. Interestingly, it seems to be more frequent in directories I just created and populated recently when I decided to close “foo-web.com”, “foo-mac.com” and “foo-self-employed.com” and move the content back here (to /foo-web/, foo-mac/ and foo-self-employed/). I had done that with 301 redirects at the “foo-” sites:

redirect 301 / http://aplawrence.com/foo-web/

and so on. That works, but the errors still continue.

I also see a lot of this kind of error:

[Thu Jan 05 01:51:56 2006] [error] [client 4.152.87.247] File does
not exist: /usr/local/www/vhosts/vps.pcunix.com/htdocs/Unixart/Telephone
Switch Considered Harmful_files, referer:
http://aplawrence.com/Unixart/dhtelephoneswitch.html

[Thu Jan 05 01:35:38 2006] [error] [client 200.55.154.9] File does
not exist: /usr/local/www/vhosts/vps.pcunix.com/htdocs/Unix-Linux
Skills Tests-Certification Exam Resources_archivos

Sometimes there’s referrer info, sometimes not, but if I look at the referring page, the bad link doesn’t seem to originate there. I suppose it might sometimes be explained by corruption – a bad read that happens now and then? I vaguely remember that I saw this originating from Yahoo or some other search results once where the href was formed from the title tag value. Entries like this in the ordinary log seem to support that:

200.40.97.134 - - [02/Jan/2006:14:28:30 +0000] "GET
/Linux/Lost%20root%20password%20(Linux)_archivos/btracker.htm
HTTP/1.0" 301 291 "http://aplawrence.com/Linux/lostlinuxpassword.html"
"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR
1.1.4322)"

148.235.180.242 - - [03/Jan/2006:16:41:44 +0000] "GET
/Unixart/Perl%20NetFTP_archivos/btracker.htm HTTP/1.1" 301 274
"http://aplawrence.com/Unixart/perlnetftp.html" "Mozilla/4.0
(compatible; MSIE 6.0; Windows NT 5.0)"

Notice the common theme of “_archivos/btracker.html”. That makes me suspicioious that these actually originate as bad links elsewhere. I see “btracker” and “pliki” a lot and have no idea why.

Then there’s the really off the wall stuff:

[Thu Jan 05 08:09:28 2006] [error] [client 65.245.103.190] File
does not exist: /usr/local/www/vhosts/vps.pcunix.com/htdocs/ccbill7,
referer: http://aplawrence.com/ccbill7/secure/ccbill.log

[Thu Jan 05 08:08:35 2006] [error] [client 202.129.12.14] File does not
exist: /usr/local/www/vhosts/vps.pcunix.com/htdocs/data2, referer:
http://aplawrence.com/data2/verotellog.txt

There are no such files. The referer pages flat doesn’t exist, and the directories they supposedly live in don’t exist either. A little web research indicates that these are hack attempts; apparently ccbill is often used by adult web sites and the log files may contain credit card or password information. The “verotellog.txt” appears to be something similar. That explains that.

So.. some progress, but still a lot of puzzles.

*Originally published at APLawrence.com

Add to document.write(“Del.icio.us”) | DiggThis | Yahoo! My Web

A.P. Lawrence provides SCO Unix and Linux consulting services http://www.pcunix.com