Apache Error Log mod_security: Access denied with code 400

Question

Hi
I am seeing the Access denied with code 400 errors in the apache log's after applying CPU Patch updates below into a Dev/TEST environment
RDBMS Patches: 9032412 & 9352191 & post steps below:
@?/rdbms/admin/dbmsaqds.plb
@?/rdbms/admin/prvtaqds.plb
@?/rdbms/admin/prvtaqiu.plb
Java Fix > [ID 1082747.1]
E-Business Suite Patches & post steps below:
9323613 & 9506302
Compiled Forms PLL files using adadmin to solve the known problem below
ORA-04062: signature of package "APPS.FND_HELP" has been changed
ORA-04062: KEY-HELP trigger raised unhandled exception ORA-04062.
the error can be replicated by following the steps below:
Log in to Oracle Apps E-Business Suite (11.5.10.2) select Report Management Information Responsibility and then transaction reports. (Opens Oracle Discoverer 4i Viewer) > select either Period to date or Year to date and then select any department & and any period (date) and then apply parameters:
Error message in browser
This error (HTTP 400 Bad Request) means that Internet Explorer was able to connect to the web server, but the webpage could not be found because of a problem with the address.
For more information about HTTP errors, see Help.
Apache log shows:
error_log shows the following:
[Fri Jul  8 10:52:08 2011] [error] [client 10.180.225.5] mod_security: Access denied with code 400. Pattern match "!^([-_@|#!=A-Za-z0-9/ :.$/(/)]){0,255}([-_@|#!=A-Za-z0-9/ :.$]){0,255}$" at ARGS_NAMES. [hostname "loadbalancer.webdomain"] [uri "/discoverer4i/viewer"] [unique_id ThbTSAq0BRQAABrfK7M]
access_log shows the following:
IP ADDRESS - - [08/Jul/2011:10:51:39 +0100] "GET /disco4iv/html/images/shadow_bottom02_leading_ltr.gif HTTP/1.1" 200 861 0
IP ADDRESS - - [08/Jul/2011:10:51:39 +0100] "GET /disco4iv/html/images/seperator.gif HTTP/1.1" 200 42 0
IP ADDRESS - - [08/Jul/2011:10:51:39 +0100] "GET /disco4iv/html/images/arch_blue_bottom_ltr.gif HTTP/1.1" 200 984 0
10.180.225.5 - - [08/Jul/2011:10:51:39 +0100] "GET /disco4iv/html/images/white.gif HTTP/1.1" 200 37 0
IP ADDRESS - - [08/Jul/2011:10:51:39 +0100] "GET /disco4iv/html/images/bar_blue_leading_edge_middle_ltr.gif HTTP/1.1" 200 111 0
IP ADDRESS - - [08/Jul/2011:10:51:39 +0100] "GET /disco4iv/html/images/bar_blue_trailing_edge_middle_ltr.gif HTTP/1.1" 200 129 0
IP ADDRESS - - [08/Jul/2011:10:51:39 +0100] "GET /disco4iv/html/images/shadow_bottom_leading_edge_ltr.gif HTTP/1.1" 200 862 0
IP ADDRESS - - [08/Jul/2011:10:51:39 +0100] "GET /disco4iv/html/images/btopshadow.gif HTTP/1.1" 200 44 0
IP ADDRESS- - [08/Jul/2011:10:51:39 +0100] "GET /disco4iv/html/images/bshadow.gif HTTP/1.1" 200 59 0
IP ADDRESS - - [08/Jul/2011:10:52:08 +0100] "POST /discoverer4i/viewer HTTP/1.1" 400 227 0
I have tried to follow a number of metalink notes but unable to resolve this issue, metalink notes looked at are:
976473.1
389558.1
1313128.1 Patch 10324904 applied
394587.1
389558.1 Patch 5107107 applied
1143882.1
376992.1 Patch 3950067 applied
Any ideas or suggestions most welcome
Thank you
Regards
Arfan
Edited by: user1717313 on 08-Jul-2011 04:59

Answer 1

Hi JD
I have tried the steps i.e stop apps tier, run adconfig on apps tiers and then started services on apps tiers and can replicate the error
thanks
Arfan
Hi Helios
I checked note 1080465.1 Patch 9506302 has been applied & Recompile all Forms PLL files using adadmin.
I ran the sql feom the note, output below
SQL> select text from dba_source where name='FND_HELP' and line <3;
TEXT
package Fnd_Help AUTHID CURRENT_USER as
/* $Header: AFMLHLPS.pls 115.22 2009/10/12 12:56:58 nchiring ship $ */
package body FND_HELP as
/* $Header: AFMLHLPB.pls 115.115 2010/03/19 06:45:24 nchiring ship $ */
Thanks
Arfan
Edited by: user1717313 on 08-Jul-2011 05:04