Re: unexpected EOF while looking for matching

[Steve Swift <Swifty@xxxxxxxxxxxxxx>]

I get entries like this in my error log. They are extremely sporadic, and because the access rate is low on our server, it is easy to find the CGI script that was being accessed. In all cases, it is one which hasn't changed in months, and has seen plenty of use in the intervening period, without problems.

My assumption is that this is some temporary blockage in the file system that causes apache to think it has reached EOF before it has actually processed the entire script.

What puzzles me is: What is looking for quotes in the first place? The script in question is written in Open Object Rexx. 

The shebang is: #!/usr/bin/rexx --

REXX is perfectly happy to execute the script (witness the prior successful usage, since it was last updated).

Altogether, one of my life's great mysteries. 

On 18 February 2012 15:40, Phil Smith <philboonz@xxxxxxxxx> wrote:

On Sat, Feb 18, 2012 at 7:10 AM, Eric Covener <covener@xxxxxxxxx> wrote:
> On Sat, Feb 18, 2012 at 12:00 AM, Phil Smith <philboonz@xxxxxxxxx> wrote:
>> I'm running Apache/2.2.3 (CentOS) which is the latest version
>> available for CentOS5.
>> I'm noticing the following in my error logs:
>> sh: -c: line 0: unexpected EOF while looking for matching `"'
>> sh: -c: line 1: syntax error: unexpected end of file
>>
>> They usually arrive in groups of 2-10 such messages; always the exact
>> same message and always in pairs.
>>
>> I've done all the normal examination of access logs that you would
>> expect and with various markers that I've been able to send to my
>> error log, I can pinpoint the time of the errors to within a second or
>> two. But nothing of interest shows in my access logs. Only what
>> appears to be normal and harmless looking GET requests for appropriate
>> URLs to my site. There are not any POSTs near the error time which I
>> understand could send data that I could not gather from the access
>> logs.
>>
>> I've googled and have seen a very few people seeing this, but no answers.
>>
>> Any thoughts, please?
>
> Find a shell-script CGI accessed around the same time.

I've already looked for several hours gathering access log data around
the time of those errors. I'm writing some debug to my access logs
every second so I have a very accurate timestamp around the sh errors.
The only requests in the access logs near the time in question are
perl CGIs requested via GET so I can request them myself in the exact
same manner and they do not produce the 'sh' error. They work as
expected. I'm beginning to suspect something internal to apache or an
apache module that might be printing to STDERR and failing.

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx
  "   from the digest: users-digest-unsubscribe@xxxxxxxxxxxxxxxx
For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx

--
Steve Swift
http://www.swiftys.org.uk