Re: SSL access_log Flooded with "GET /" from 127.0.0.1 localhost

imacat <imacat@xxxxxxxxxxxxxxxxxx> · Tue, 20 Mar 2007 02:00:11 +0800

On Mon, 19 Mar 2007 13:14:08 -0400
"Joshua Slive" <joshua@xxxxxxxx> wrote:
> On 3/19/07, imacat <imacat@xxxxxxxxxxxxxxxxxx> wrote:
> >     Could someone tell me what these internal requests from?  Where can
> > I shut them down?
> If you used extended-combined log format, you'd see from the
> User-Agent field that these requests are "Internal dummy conenctions"
> used by apache to manage its own processes.  They can (and should) be
> safely ignored.

    Oh, I see.  Thank you for your hint.

    I'm in fact logging the User-Agent.  I simplified the logging format
for convienence of discussion.  The real line I got is:

127.0.0.1 - - [20/Mar/2007:01:34:57 +0800] "GET /" 400 665 "-" "-"

    You probally mean something like this:

127.0.0.1 - - [05/Feb/2007:16:05:27 +0800] "GET / HTTP/1.0" 200 263 "-"
"Apache/2.2.3 (Unix) DAV/2 PHP/5.1.6 (internal dummy connection)"

    But it seems that ever since this discussing thread:

[PATCH] Take 2, ssl_engine_io.c BIO and brigades refactored
http://www.arcknowledge.com/gmane.comp.apache.devel/2002-10/msg00773.html

    The Apache developers seems to have changed from HTTP/1.0 to
HTTP/0.9 simple request, which has no User-Agent header at all.  That's
why I can't identify it.

    Thank you for this hint.  I'll look into this "internal dummy
connection".  I have just made a simple web search.  There seem to be
lots of discussion on this.

    I hope this could be added to the Apache FAQ or the source code
comment.  It really kills me looking for this answer.

--
Best regards,
imacat ^_*' <imacat@xxxxxxxxxxxxxxxxxx>
PGP Key: http://www.imacat.idv.tw/me/pgpkey.txt

<<Woman's Voice>> News: http://www.wov.idv.tw/
Tavern IMACAT's: http://www.imacat.idv.tw/
TLUG List Manager: http://lists.linux.org.tw/cgi-bin/mailman/listinfo/tlug