Re: problem with extra numbers after %h hostname/ip address in access_log

[Randy Tejas <randytejas@xxxxxxxxx>]

Sorry I do not have control over software version as it is in a global solaris zone.

I have been restarting with svcadm restart svc:/network/http:apache2
or
 /usr/apache2/bin/apachectl restart

and it doesn't help.

Netstat shows the right ip addresses:

[root@cgappd81 logs]# netstat -an | grep '\.80'
      *.80                 *.*                0      0 49152      0 LISTEN
10.62.32.67.80       10.56.232.162.3233   65530      0 50400      0 ESTABLISHED
      *.80                              *.*                             0      0 49152      0 LISTEN
[root@cgappd81 logs]#

The only change I have made to the conf file is to try to troubleshoot %h and the problem is contained therein. How is that variable created? (environment variable?)

I did just find that the problem crops up when you look at the env variables using perl.

REMOTE_ADDR = 10.56.232.162232.162
SERVER_ADDR = 10.62.32.672.32.67

but not on
HTTP_HOST = 10.62.32.67
SERVER_NAME = 10.62.32.67

FWIW the first entry where the problem happens: 10.56.194.252194.252 - - [10/Jan/2011:16:57:37 -0600] "GET
> /images/search/ac_collectio

there is no such /images directory or /images/search/ac_etc. but they got the appropriate 404.

---

From: Igor GaliÄ <i.galic@xxxxxxxxxxxxxx>
To: users@xxxxxxxxxxxxxxxx
Sent: Fri, January 28, 2011 11:21:28 AM
Subject: Re: problem with extra numbers after %h hostname/ip address in access_log


----- "Randy Tejas" <randytejas@xxxxxxxxx> wrote:

> Hello,
>
> I'm seeing a problem in my logs where there are extra numbers at the
> end of an ip address:
>
> 10.56.194.252194.252
> 10.56.195.63.195.63
>
> Apache seems to be duplicating the last two octects. Anybody seen this
> before and how to fix?
>
> Server version: Apache/2.0.63
> Server built: Oct 24 2010 13:42:01

Is this an unmodified default distro?
Why are you using 2.0? Why 2.0.63 (when the latest is 2.0.64)
Why are you not using 2.2.17?

>
> LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\"\"%{User-Agent}i\"" combined

http://httpd.apache.org/docs/current/mod/mod_log_config.html#examples
and
https://svn.apache.org/repos/asf/httpd/httpd/trunk/docs/conf/httpd.conf.in

both agree with you. Furthermore I don't see in
http://httpd.apache.org/docs/current/mod/mod_log_config.html#formats or under
#modifiers a way to achieve what you see below:

>
> This is where it began (Jan 10):
> 10.79.24.178 - - [09/Dec/2010:20:40:20 -0600] "GET /everest/ HTTP/1.1"
> 200 98011
> 10.56.194.252194.252 - - [10/Jan/2011:16:57:37 -0600] "GET
> /images/search/ac_collectio
> n_12x15.png HTTP/1.1" 404 316
> 10.56.194.252194.252 - - [10/Jan/2011:16:57:37 -0600] "GET
> /images/search/ac_pub_15x15
> .png HTTP/1.1" 404 309

This happened without a restart/reconfiguration?
Does a restart help to improve the situation?
What does netstat say :)

> Thanks!


i

--
Igor GaliÄ

Tel: +43 (0) 664 886 22 883
Mail: i.galic@xxxxxxxxxxxxxx
URL: http://brainsware.org/

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx
  "  from the digest: users-digest-unsubscribe@xxxxxxxxxxxxxxxx
For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx