Interpreting error log entries


#1

I would like some help with interpreting the 4 types of entries I have found in the server error log, listed below. And I would also welcome some advice on reducing/preventing those errors. Many thanks.

  • marsbar

Error type 1 - wrong default page (The correct file is index.php):

[Sat May 15 02:20:45 2004] [error] [client 213.78.70.236] client denied by server configuration: /home/user/webdir/forums/index.html
[Sat May 15 02:20:45 2004] [error] [client 213.78.70.236] client denied by server configuration: /home/user/webdir/forums/Index.html
[Sat May 15 02:20:45 2004] [error] [client 213.78.70.236] client denied by server configuration: /home/user/webdir/forums/default.html
[Sat May 15 02:20:45 2004] [error] [client 213.78.70.236] client denied by server configuration: /home/user/webdir/forums/Default.html
[Sat May 15 02:20:45 2004] [error] [client 213.78.70.236] client denied by server configuration: /home/user/webdir/forums/page1.html


Error type 2 - CGI formmail? (I do not use formmail)

[Sat May 15 03:28:07 2004] [error] [client 63.165.125.3] File does not exist: /home/user/webdir/cgi-bin/formmail.pl
[Sat May 15 03:28:10 2004] [error] [client 63.165.125.3] File does not exist: /home/user/webdir/cgi-bin/formmail.cgi
[Sat May 15 03:28:12 2004] [error] [client 63.165.125.3] File does not exist: /home/user/webdir/cgi-bin/FormMail.pl
[Sat May 15 03:28:12 2004] [error] [client 63.165.125.3] File does not exist: /home/user/webdir/cgi-bin/FormMail.cgi
[Sat May 15 03:28:13 2004] [error] [client 63.165.125.3] File does not exist: /home/user/webdir/cgi-sys/formmail.pl
[Sat May 15 03:28:14 2004] [error] [client 63.165.125.3] File does not exist: /home/user/webdir/cgi-sys/formmail.cgi
[Sat May 15 03:28:15 2004] [error] [client 63.165.125.3] File does not exist: /home/user/webdir/cgi-sys/FormMail.pl
[Sat May 15 03:28:20 2004] [error] [client 63.165.125.3] File does not exist: /home/user/webdir/cgi-bin/Formmail.pl
[Sat May 15 03:28:22 2004] [error] [client 63.165.125.3] File does not exist: /home/user/webdir/cgi-bin/mail.pl
[Sat May 15 03:28:26 2004] [error] [client 63.165.125.3] File does not exist: /home/user/webdir/cgi-bin/FORMMAIL.PL


Error type 3 - .dll and .asp?

[Sat May 15 08:15:25 2004] [error] [client 81.220.209.219] File does not exist: /home/user/webdir/_vti_bin/owssvr.dll
[Sat May 15 08:15:25 2004] [error] [client 81.220.209.219] File does not exist: /home/user/webdir/MSOffice/cltreq.asp


Error type 4 - ???

[Sat May 15 14:15:13 2004] [error] mod_gzip: TRANSMIT_ERROR:ISMEM:104


#2

“File does not exist” are 404 errors. That is, someone thinks your web site has a certain page, and it doesn’t, the web server records an error saying it found no file to serve.

As for the formmail lines, these are bots or the like of spammers looking for vulnerable formmail scripts. They’re just trying out the most likely URLs at which one would reside. Nothing to worry about - unless your access.log shows otherwise. In your access log, you would want to look for status 200 to make sure none of these crackers “got lucky”.

The other not found errors are caused by Microsoft software that has extended functions for web stuff. Trying searching the Microsoft site about the owssvr.dll and cltreq.asp files to see what they are supposed to do.

There is nothing you can do to prevent these things from happening.

Of course you can simply put blank files in the locations for the 404s and the 404s will become 200/304s instead and no “file not find” in error.log

You can also re-classify them in access.log - for example, status 202 means “accepted but not able to process”, and I use that to classify the formmail attempts. You have to add something to .htaccess to do that.

:cool: Perl / MySQL / HTML+CSS


#3

And the obvious Google search reveals:

http://lists.over.net/pipermail/mod_gzip/2001-June/005199.html

As for the denied by server configuration, you answered your own question there - the server is saying that even if the page existed at that location, it is configured not to serve it to that client for some reason. Could be various reasons, such as the deny directive, etc.

:cool: Perl / MySQL / HTML+CSS


#4

Many, many thanks for your help, Atropos7!
Cheers -
marsbar