[Solved] Strange entries in apache access_log

Hi all,
I recently setup up a small apache server. Listing is disabled, I just wanted people who I give a full file path to be able to download specific files. I'm keeping them in ~/public_html.
If I look at /var/log/httpd/access_log, I see some entries that make sense:
138.102.68.222 - - [25/Mar/2014:20:31:13 -0500] "GET /~lefty/pictures.zip HTTP/1.1" 200 201823247
138.102.68.222 - - [25/Mar/2014:20:32:51 -0500] "GET / HTTP/1.1" 403 983
141.123.267.82 - - [25/Mar/2014:20:37:03 -0500] "GET /~lefty/pictures.zip HTTP/1.1" 200 201823247
That's me testing downloading pictures.zip (success), testing just accessing the root folder (denied 403, as I had hoped), and my friend downloading pictures.zip.
Next in the log I see some entries that contain a bunch of gibberish and get rejected:
202.175.83.131 - - [25/Mar/2014:21:56:23 -0500] "HEAD / HTTP/1.0" 403 -
202.175.83.131 - - [25/Mar/2014:21:56:23 -0500] "POST /cgi-bin/php?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%30+%2D%6E HTTP/1.1" 404 976
202.175.83.131 - - [25/Mar/2014:21:56:24 -0500] "POST /cgi-bin/php5?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%30+%2D%6E HTTP/1.1" 404 976
202.175.83.131 - - [25/Mar/2014:21:56:24 -0500] "POST /cgi-bin/php-cgi?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%30+%2D%6E HTTP/1.1" 404 976
202.175.83.131 - - [25/Mar/2014:21:56:25 -0500] "POST /cgi-bin/php.cgi?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%30+%2D%6E HTTP/1.1" 404 976
202.175.83.131 - - [25/Mar/2014:21:56:26 -0500] "POST /cgi-bin/php4?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%30+%2D%6E HTTP/1.1" 404 976
200.98.175.74 - - [25/Mar/2014:23:22:22 -0500] "HEAD / HTTP/1.0" 403 -
96.38.230.190 - - [26/Mar/2014:23:45:54 -0500] "\x80w\x01\x03\x01" 400 226
96.38.230.190 - - [26/Mar/2014:23:45:54 -0500] "GET /HNAP1/ HTTP/1.1" 404 1103
Should I be concerned? Also, it looks like the long strings were requesting a specific file and got 404 errors b/c it doesn't exist. What's with the short "\x80w" string that gets error 400?
Thanks,
Lefty
Last edited by LeftyAce (2014-03-29 23:24:25)

I am shocked, shocked to think someone is trying to hack you
ewaller$@$odin ~ 1006 %whois 202.175.83.131
% [whois.apnic.net]
% Whois data copyright terms http://www.apnic.net/db/dbcopyright.html
% Information related to '202.175.0.0 - 202.175.127.255'
inetnum: 202.175.0.0 - 202.175.127.255
netname: CTM-MO
descr: CTM
country: MO
admin-c: CN166-AP
tech-c: CN166-AP
mnt-by: APNIC-HM
mnt-lower: MAINT-CTM-MO
mnt-routes: MAINT-CTM-MO
mnt-irt: IRT-CTM-MO
changed: [email protected] 20040130
remarks: combine all small allocation objects into a /17 object
remarks: this object can only modify by APNIC Hostmaster
status: ALLOCATED PORTABLE
changed: [email protected] 20060224
changed: [email protected] 20110701
source: APNIC
irt: IRT-CTM-MO
address: Rua da Lagos, Telecentro
address: P.O. Box 868
address: Taipa
address: Macau
e-mail: [email protected]
abuse-mailbox: [email protected]
admin-c: JC1146-AP
tech-c: HL13
auth: # Filtered
mnt-by: MAINT-CTM-MO
changed: [email protected] 20101201
source: APNIC
role: CTM NOC
nic-hdl: CN166-AP
address: CTM - Internet Business Unit
address: Rua da Lagos, Telecentro
address: P.O. Box 868, Taipa
address: Macau
country: MO
phone: +853 8912728
fax-no: +853 8912933
e-mail: [email protected]
admin-c: JC1146-AP
tech-c: HL13
notify: [email protected]
changed: [email protected] 20030530
mnt-by: MAINT-CTM-MO
source: APNIC
% Information related to '202.175.64.0/19AS4609'
route: 202.175.64.0/19
descr: CTM Internet Services
descr: Companhia de Telecomunicacoes de Macau S.A.R.L.
country: MO
origin: AS4609
remarks: Route Object - 202.175.64.0/19
mnt-by: MAINT-CTM-MO
changed: [email protected] 20060223
source: APNIC
% This query was served by the APNIC Whois Service version 1.69.1-APNICv1r0 (WHOIS1)
ewaller$@$odin ~ 1007 %
The other IP address was in Missouri in the USA. That one was benign, or at least unsophisticated.
The Macau attack was a bit more interesting. Have you enabled php? If not, you are okay. Expect this sort of stuff. Also, expect to be fully probed by the web crawlers (Goggle, Yahoo, Duck Duck Go, and other wannabes)
Edit: Actually, the attack from Missouri might be this
Last edited by ewaller (2014-03-27 05:17:09)

Similar Messages

Connect Lost and Strange Entry in Access Log

All users got FRM-92100 and at the same time, multiple strange entries in access_log like the one below.
Any ideas why a java error message is showing up as post? It looks like user's JVM is generating and sending this message, is that possible? What does this error message tell me about the status of the server?
10.148.8.48 - - [22/Jul/2003:14:45:55 -0700] "POST /forms90/<HTML><HEAD><TITLE>500 Internal Server Error</TITLE></HEAD><BODY><H1>500 Internal Server Error</H1><PRE>java.lang.UnsatisfiedLinkError: Native Library D:\ora9iapp\BIN\ifjsl90.dll already loaded in another classloader
 at java.lang.ClassLoader.loadLibrary0(ClassLoader.java:1383)
 at java.lang.ClassLoader.loadLibrary(ClassLoader.java:1314)
 at java.lang.Runtime.load0(Runtime.java:698)
 at java.lang.System.load(System.java:797)
 at oracle.forms.servlet.RunformProcess.loadLibrary(Unknown Source)
 at oracle.forms.servlet.RunformProcess.<init>(Unknown Source)
 at oracle.forms.servlet.RunformProcess.<init>(Unknown Source)
 at oracle.forms.servlet.RunformSession.<init>(Unknown Source)
 at oracle.forms.servlet.RunformSession.get(Unknown Source)
 at oracle.forms.servlet.ListenerServlet.getRunformSession(Unknown Source)
 at oracle.forms.servlet.ListenerServlet.getInfo(Unknown Source)
 at oracle.forms.servlet.ListenerServlet.doGet(Unknown Source)
 at javax.servlet.http.HttpServlet.service(HttpServlet.java:244)
 at javax.servlet.http.HttpServlet.service(HttpServlet.java:336)
 at com.evermind[Oracle9iAS (9.0.2.2) Containers for J2EE].server.http.ResourceFilterChain.doFilter(ResourceFilterChain.java:66)
 at oracle.security.jazn.oc4j.JAZNFilter.doFilter(JAZNFilter.java:283)
 at com.evermind[Oracle9iAS (9.0.2.2) Containers for J2EE].server.http.ServletRequestDispatcher.invoke(ServletRequestDispatcher.java:539)
 at com.evermind[Oracle9iAS (9.0.2.2) Containers for J2EE].server.http.ServletRequestDispatcher.forwardInternal(ServletRequestDispatcher.java:285)
 at com.evermind[Oracle9iAS (9.0.2.2) Containers for J2EE].server.http.HttpRequestHandler.processRequest(HttpRequestHandler.java:771)
 at com.evermind[Oracle9iAS (9.0.2.2) Containers for J2EE].server.http.AJPRequestHandler.run(AJPRequestHandler.java:152)
 at com.evermind[Oracle9iAS (9.0.2.2) Containers for J2EE].server.http.AJPRequestHandler.run(AJPRequestHandler.java:72)
 at EDU.oswego.cs.dl.util.concurrent.PooledExecutor$Worker.run(PooledExecutor.java:802)
 at java.lang.Thread.run(Thread.java:484)
 </PRE></BODY></HTML> HTTP/1.1" 404 339

Thomas,
the Post method shouldn't bother as it seesm that the servlet spills out all the error HTML file code. However
"java.lang.UnsatisfiedLinkError: Native Library D:\ora9iapp\BIN\ifjsl90.dll already loaded in another classloader" points to a classloader problem.
All I found is a note saying that this happens if you have a running Forms while applying a Patch set to Forms or Oracle9iAS. In specific the OPM needs to be stopped before installing the patch. Otherwise you end up with the newer dll version not being copied to the system. There's a section in the readme about stopping OPM.
Not sure if this is helping your problem, but its the same error that you are getting.
Frank

Strange Entries in System and Console Logs

I have some strange entries in my system and console logs. In the system log, I regularly see these entries:
Feb 24 21:07:29 joseph-youngs-computer /System/Library/PrivateFrameworks/Apple80211.framework/Resources/airport: Error: owner of process not logged in on console - exiting.
Feb 24 21:20:32 joseph-youngs-computer kernel[0]: (82: coreservicesd)tfp: failed on 0:
In my console log, I regularly find these entries:
2006-02-25 09:23:24 -0600
2006-02-24 21:07:30.530 loginwindow[803] FSResolveAliasWithMountFlags returned err = -43
On occasion, I find something like this in my console log:
Assert failed: /Users/dave/dev/flash/player/FlashPlayer/platform/mac/plugins/../../../core/spl ay.cpp:7105
I admit to being something of a novice with the Mac, so I am not sure what to make of these entries, though I never noticed anything like this on my eMac, or on my prior iMac. Also, on the entry above, there are no users named dave on my Mac.
Has anyone else noticed this, and can anyone shed any light on what these messages mean?

Resolved with a clean install.

Strange entries in lighttpd access log -- help!

Hi,
I run a lighttpd server at home. I just use it for working with some scripts, and sharing stuff with my friends. I have a dynamic IP address, so I use dyndns for getting a hostname.
Today I noticed some strange entries in the lighttpd access log:
64.162.221.146 lti-mail01.ltinetworks.com:25 - [14/Feb/2010:11:38:23 +0530] "POST http://lti-mail01.ltinetworks.com:25/ HTTP/1.0" 200 8 "-" "-"
64.162.221.146 - - [14/Feb/2010:11:38:25 +0530] "CONNECT http://lti-mail01.ltinetworks.com:25 HTTP/1.0" 501 357 "-" "-"
64.162.221.146 lti-mail01.ltinetworks.com:25 - [14/Feb/2010:11:45:40 +0530] "POST http://lti-mail01.ltinetworks.com:25/ HTTP/1.0" 200 8 "-" "-"
64.162.221.146 - - [14/Feb/2010:11:45:43 +0530] "CONNECT http://lti-mail01.ltinetworks.com:25 HTTP/1.0" 501 357 "-" "-"
64.162.221.146 lti-mail01.ltinetworks.com:25 - [14/Feb/2010:11:52:58 +0530] "POST http://lti-mail01.ltinetworks.com:25/ HTTP/1.0" 200 8 "-" "-"
64.162.221.146 - - [14/Feb/2010:11:53:01 +0530] "CONNECT http://lti-mail01.ltinetworks.com:25 HTTP/1.0" 501 357 "-" "-"
64.162.221.146 lti-mail01.ltinetworks.com:25 - [14/Feb/2010:12:00:12 +0530] "POST http://lti-mail01.ltinetworks.com:25/ HTTP/1.0" 200 8 "-" "-"
64.162.221.146 - - [14/Feb/2010:12:00:15 +0530] "CONNECT http://lti-mail01.ltinetworks.com:25 HTTP/1.0" 501 357 "-" "-"
64.162.221.146 lti-mail01.ltinetworks.com:25 - [14/Feb/2010:12:07:28 +0530] "POST http://lti-mail01.ltinetworks.com:25/ HTTP/1.0" 200 8 "-" "-"
64.162.221.146 - - [14/Feb/2010:12:07:30 +0530] "CONNECT http://lti-mail01.ltinetworks.com:25 HTTP/1.0" 501 357 "-" "-"
What is going on here? Some kind of spambot? Note that I don't have the sendmail service installed, and port 25 is not forwarded on my router. Is this a threat and how do I deal with this?
Thanks.

loafer wrote:I don't know a great deal about this. However, if you google for "lti-mail01.ltinetworks.com" you'll get a load of hits, which indicate there may be a problem.
Yes, I did some more searching and apparently its a known problem.
This thing is trying to send a POST action to another site. Is there any way I can restrict POST actions to my own domain?

Strange Entries in 'Pattern Analysis' results

I'm using the Pattern Discovery feature of Data Profiling and I'm getting strange characters in the results for Dominant Character Pattern and Dominant Word Pattern. For instance, two of the patterns returned are ^(9+)$ and ^(Aa((4))$ And the data that supposedly conforms to these patterns are simple integers or words.
Does any one know what could be going on here? Some kind of corruption in the result set? Or am I missing how to interpret these strange entries? Thanks.

The patterns discovered are regular expressions. Are you looking for common format discovery? If you want to know something is a number or a date or en email address look at the common format discovery (under the hood a common format may be a number of reg expression also). You will have to select 'Enable Common Format Discovery' and reprofile. The common format is another column in this pattern discover table.
Cheers
David

Strange entry in Cleint tag

Folks,
I have noticed a strange entry in <Client> tag and I cannot find any reference to it in the docs:
<Client urlhost="whatever.com" 2=">">
NameTrans fn="redirect" from="/" url="http://www.somewhere.com/notimportant.html"
</Client>
What does this 2=">" mean inside <Cleint> tag?
Any ideas?
Sasha aka ttalex

That weird 2=">" is the result of using the Administration Server to update an obj.conf file that contained a <Client> tag with a syntax error. When the Administration Server writes out obj.conf files, parameters without values (e.g. "enabled") get reformatted as a name="value" pair, where the name is an integer (e.g. 1="enabled"). There was probably a stray double quote and right angle bracket in your <Client> tag.
You should manually remove the 2=">".

Stream not found. Apache access_log: 404

Hi,
im trying to setup f4fmodul, but i get always "Stream not found" in OSMF-Player when i load my vod/test.f4m
I created the test.f4m , testSeg1.f4f, testSeg1.f4x with the f4fpackager on my local PC and copy all files to the vod-folder.
When i start the OSMF-Player with the test.f4m in apache access_log i see this lines:
"GET /vod/test.f4m HTTP/1.1" 200
"GET /:///vod/:///vod/testSeg1-Frag1 HTTP/1.1" 404
Is that a problem of the packager on windows or is the config of f4fmodule wrong?
LoadModule f4fhttp_module /usr/lib64/apache2/mod_f4fhttp.so
<Location /vod>
 HttpStreamingEnabled true
 HttpStreamingContentPath "/srv/...vhosts.../htdocs/vod"
</Location>
Many thanks for your help.

Hi, thanks for the quick response.
i have changed the HttpStreamingContentPath location in apache httpd.conf form
<Location /vod>
 HttpStreamingEnabled true
 HttpStreamingContentPath "/srv/www/vhosts/domain.xy/httpdocs/vod"
</Location>
to
<Location /vod>
 HttpStreamingEnabled true
 HttpStreamingContentPath "/srv/www/vhosts/domain.xy/httpdocs"
</Location>
and all files are in the vod folder. But after opening /vod/test.f4m in the OSMF player the player.swf tryed to open:
"GET /:///vod/:///vod/testSeg1-Frag1 HTTP/1.1" 404 1324 http://www.domain.de/player.swf"
Is this URL-Part "/:///vod/:///vod/testSeg1-Frag1" generated from the module or from the player.swf with the f4m-File?

Solution manager system log - strange entries

Hi Everyone,
the problem we are facing in Solution Manager system log every five minutes appears a new error message:
2 Database error -30082 at CON
0 > SQL30082N Security processing failed with reason "24"
0 > ("USERNAME AND/OR PASSWORD INVALID"). SQLSTATE=08001
First of all the landscape: ECC, BI, CRM, PI and Solman. Each system is DEV, QUA, PRD - except Solution Manager.
Result of going to see the logs within work directory:
Connect to %_DCR_XXXXX as db2dcr with DB6_DB_NAME=DCR;DB6_DB_HOST=xxxxxx;DB6_DB_SCHEMA=SAPSR3;DB6_DB_SVCENAME=5912
C *** ERROR in DB6Connect[dbdb6.c, 1727] CON = 1 (BEGIN)
C &+***      DbSlConnectDB6( SQLDriverConnect ): [IBM][CLI Driver] SQL30082N Security processing failed with reason "24" ("USE
C &+***      RNAME AND/OR PASSWORD INVALID"). SQLSTATE=08001
C &+***
C &+***
C &+***      ABAP location info 'CL_SQL_CONNECTION=============CP', 337
C &+***
C *** ERROR in DB6Connect[dbdb6.c, 1727] (END)
C *** ERROR => DbSlConnect to 'DCR' as 'db2dcr' failed
[dbdb6.c      1732]
Some of the systems are being connected successfully and the error messages in SM21 are not related to those systems. But some of the systems like DCR cannot be reached. And this fact causing the error messages.
I haven't configured Solution Manager because I have joined the project later. I would like to know what job is trying to access the satellite system and for what purpose.
On solution manager side I have checked all the scheduled background jobs - all of them have been executed successfully.
There some of them are scheduled but it is hard understand what is purpose of the job.
I have checked and corrected system landscape through SMSY and have maintained all the RFCs. They all OK now.
What else could force to make a connection to satellite system? And where is the place where it is hardcoded local(satellite) db2 connection entry?
Like I said before, some of the systems are being connected but some not. The one which has not been connected - there was recently changed SAP master password. I believe this is the key to resolve the problem. But the system itself operating 100% correctly.
Perhaps it could be CCMS that makes some extra connections to collect the data from the monitored systems. But I have checked all the RFC's in SM59 and they were OK.
Any ideas or suggestions would be appreciated.
Thanks in advance,
Kind regards,
Artjom.

Kaustubh Krishna,
thank you for respond.
It was dbacockpit. The connection was maintained with old db2sid password. And it was causing problematic log entries.
Problem was solved.
Points awarded.
Thanks,
kind regards,
Artyom

[SOLVED] can't start apache ¿because owncloud logfile doesn't exist?

I've just installed MariaDB, PHP, mysql and owncloud, but since I installed this last one I can't run httpd. This is the error:
$ systemctl status -l httpd
● httpd.service - Apache Web Server
Loaded: loaded (/usr/lib/systemd/system/httpd.service; enabled)
Active: failed (Result: exit-code) since jue 2014-05-22 10:43:38 ART; 6min ago
Process: 5166 ExecStart=/usr/bin/apachectl start (code=exited, status=1/FAILURE)
may 22 10:43:37 archserv systemd[1]: Starting Apache Web Server...
may 22 10:43:38 archserv apachectl[5166]: (2)No such file or directory: AH02291: Cannot access directory '/etc/httpd/logs/' for error log of vhost defined at /etc/httpd/conf/extra/owncloud.conf:11
may 22 10:43:38 archserv apachectl[5166]: AH00014: Configuration check failed
may 22 10:43:38 archserv systemd[1]: httpd.service: control process exited, code=exited status=1
may 22 10:43:38 archserv systemd[1]: Failed to start Apache Web Server.
may 22 10:43:38 archserv systemd[1]: Unit httpd.service entered failed state.
And
$ nano /etc/httpd/conf/extra/owncloud.conf
<IfModule mod_alias.c>
Alias /owncloud /usr/share/webapps/owncloud/
</IfModule>
<Directory /usr/share/webapps/owncloud/>
Options FollowSymlinks
Order allow,deny
AllowOverride all
allow from all
php_admin_value open_basedir "/srv/http/:/home/:/tmp/:/usr/share/pear/:/usr/share/webapps/owncloud/:/etc/webapps/owncloud"
</Directory>
<VirtualHost *:80>
ServerAdmin [email protected]
DocumentRoot /usr/share/webapps/owncloud
ServerName owncloud.foo.com
ErrorLog logs/owncloud.foo.info-error_log
CustomLog logs/owncloud.foo.info-access_log common
</VirtualHost>
It seems simple, but I can't understand it. What am I missing?
Thank you all.
Last edited by persio (2014-05-22 14:19:14)

Instead I suggest to change Log directories to /var/log/httpd/
ErrorLog /var/log/httpd/owncloud.foo.info-error_log
CustomLog /var/log/httpd/owncloud.foo.info-access_log common

Solved strange problem. Reason: a strange bug?

Hi,
recently I had a really strange problem, where I could not work with the enhanced classes from within a web application (but from the dos-prompt, see my prosting "Kodo says classes are not enhanced ..."). Everybody suggested it was a classpath problem, what I also
thought was the most sensible reason, but all I tried with the classpath didn't seem to work. What I really didn't understand was that it worked before once. I couldn't think of anything that I changed, but now I tried something unreasonable, and it seems to be the reason for
the problem. What I did was, that in the early stages of my application (when everything was still alright) I used a file package.jdo (in the classes-subdirectory) to enhance the classes. Later I changed to system.jdo in the root-dir of the package hierarchie. Now I went back
to package.jdo, and it worked. But I can't imagine how this might change the behaviour of Kodo? The content of package.jdo / system.jdo is this:
<?xml version="1.0"?>
<jdo>
 <package name="de.mediateam.quizmaster.data">
 <class name="User" />
 <class name="Category">
 <field name="children">
 <collection element-type="Category" />
 </field>
 <field name="questions">
 <collection element-type="Question" />
 </field>
 </class>
 <class name="Topic" persistence-capable-superclass="Category" />
 <class name="Test" persistence-capable-superclass="Category">
 <field name="participants">
 <collection element-type="User" />
 </field>
 </class>
 <class name="Question">
 <field name="prerequisites">
 <collection element-type="Question" />
 </field>
 </class>
 <class name="Answer" />
 </package>
</jdo>
There is no difference if you remove all classes but the User-class. The problem stays when it is system.jdo.
So is this a bug with Kodo, or did I miss something in the documentation about differences between package.jdo and system.jdo?
Cheers
Martin

I had system.jdo in the class-hierarchies root directory, but for web-apps this dir (web-context/WEB-INF/classes) doesn't need to be in the classpath. I just tried to copy system.jdo to the same dir as system.prefs and this works.
It might however be helpful in such situations to get a bit more precise error message (not: "The system could not initialize; the following registered persistent types have not been enhanced: [...]").
But thanks for your help. Mysterie solved now.
Martin
On Mon, 10 Sep 2001 17:19:50 -0500, "Abe White" <[email protected]> wrote:
Perhaps system.jdo is not being found by Kodo? system.jdo should be located
in the same place as system.prefs -- at the top level of the CLASSPATH.
package.jdo files, on the other hand, should be placed in the same package
as the classes they contain metadata for. That is the only difference
between the two.
-- Abe White
Kodo Product Team

Weird error_log entries and apache crashing

Hi, I've got a 3.0.9.8.1 install on NT4 SP6 against a 8.1.7.1.1 EE db.
After a couple of hours use I received a 503 time out error whilst creating a QBE Report. Bouncing Apache and db brought it back up and running and the report seemed ok.
Taking a look in the error_log file I noticed these entries. Can anyone shed any life on what is happening here?
Sorry for the long error log entry....
ORA-06512: at "PORTAL30.WWSBR_IMT_SERVICES", line 364
ORA-06512: a..
[Mon Aug 06 17:00:07 2001] [warn] mod_plsql: Stale Connection due to Oracle error 20100
[Mon Aug 06 17:00:07 2001] [error] mod_plsql: /pls/portal30/PORTAL30.wwsbr_imt_services.GenericView ORA-20100
ORA-20100:
ORA-06512: at "PORTAL30.WWSBR_STDERR", line 437
ORA-06512: at "PORTAL30.WWV_SEARCHDB", line 31
ORA-00903: invalid table name
ORA-06512: at "PORTAL30.WWSBR_IMT_SERVICES", line 145
ORA-20100:
ORA-20100:
ORA-06512: at "PORTAL30.WWSBR_STDERR", line 437
ORA-06512: at "PORTAL30.WWV_SEARCHDB", line 31
ORA-20000: interMedia Text error:
DRG-50857: oracle error in dretbase
ORA-00600: internal error code, arguments: [], [], []..
[Mon Aug 06 17:00:35 2001] [warn] mod_plsql: /pls/portal30/PORTAL30.wwsbr_ui_bulkaction.search_wrapper had to be described for execution. Refer to the PL/SQL GateWay documentation on how to avoid this
[Mon Aug 06 17:01:30 2001] [warn] mod_plsql: /pls/portal30/PORTAL30.wwexp_api_engine.action had to be described for execution. Refer to the PL/SQL GateWay documentation on how to avoid this
[Mon Aug 06 17:01:56 2001] [warn] mod_plsql: /pls/portal30/PORTAL30.wwexp_render.show_tree had to be described for execution. Refer to the PL/SQL GateWay documentation on how to avoid this
[Mon Aug 06 17:11:07 2001] [warn] mod_plsql: /pls/portal30/PORTAL30.wwexp_api_engine.action had to be described for execution. Refer to the PL/SQL GateWay documentation on how to avoid this
[Mon Aug 06 17:11:38 2001] [warn] mod_plsql: /pls/portal30/PORTAL30.wwapp_app_explorer.access_form had to be described for execution. Refer to the PL/SQL GateWay documentation on how to avoid this
[Mon Aug 06 17:11:40 2001] [warn] mod_plsql: /pls/portal30/PORTAL30.wwapp_app_explorer.access_form had to be described for execution. Refer to the PL/SQL GateWay documentation on how to avoid this
[Mon Aug 06 17:11:52 2001] [warn] mod_plsql: /pls/portal30/PORTAL30.wwexp_api_engine.action had to be described for execution. Refer to the PL/SQL GateWay documentation on how to avoid this
[Mon Aug 06 17:12:52 2001] [warn] mod_plsql: /pls/portal30/PORTAL30.wwv_builder.accept had to be described for execution. Refer to the PL/SQL GateWay documentation on how to avoid this
[Mon Aug 06 17:13:56 2001] [warn] mod_plsql: /pls/portal30/PORTAL30.wwv_builder.accept had to be described for execution. Refer to the PL/SQL GateWay documentation on how to avoid this
[Mon Aug 06 17:14:04 2001] [warn] mod_plsql: /pls/portal30/PORTAL30.wwv_builder.accept had to be described for execution. Refer to the PL/SQL GateWay documentation on how to avoid this
[Mon Aug 06 17:14:37 2001] [warn] mod_plsql: Stale Connection due to Oracle error 12571
[Mon Aug 06 17:14:37 2001] [error] mod_plsql: /pls/portal30/PORTAL30.wwv_component_control.run_as_portlet ORA-12571
ORA-12571: TNS:packet writer failure
[Mon Aug 06 17:14:37 2001] [warn] mod_plsql: Stale Connection due to Oracle error 3114
[Mon Aug 06 17:14:41 2001] [warn] mod_plsql: Stale Connection due to Oracle error 12571
[Mon Aug 06 17:14:41 2001] [error] mod_plsql: /pls/portal30/PORTAL30.wwv_component_control.run_as_portlet ORA-12571
ORA-12571: TNS:packet writer failure
[Mon Aug 06 17:14:41 2001] [warn] mod_plsql: Stale Connection due to Oracle error 3114
[Mon Aug 06 17:14:44 2001] [warn] mod_plsql: Stale Connection due to Oracle error 12571
[Mon Aug 06 17:14:44 2001] [error] mod_plsql: /pls/portal30/PORTAL30.wwv_component_control.run_as_portlet ORA-12571
ORA-12571: TNS:packet writer failure
[Mon Aug 06 17:14:44 2001] [warn] mod_plsql: Stale Connection due to Oracle error 3114
[Mon Aug 06 17:14:51 2001] [warn] mod_plsql: Stale Connection due to Oracle error 12571
[Mon Aug 06 17:14:51 2001] [error] mod_plsql: /pls/portal30/SCOTT.QBE_EMPS.show ORA-12571
ORA-12571: TNS:packet writer failure
[Mon Aug 06 17:14:51 2001] [warn] mod_plsql: Stale Connection due to Oracle error 3114
[Mon Aug 06 17:15:11 2001] [warn] mod_plsql: Stale Connection due to Oracle error 3114
[Mon Aug 06 17:15:11 2001] [error] mod_plsql: /pls/portal30/PORTAL30.wwv_builder.edit HTTP-503 ORA-12571 Client Logon Failed with error : 12571 Reset Session Call also failed with error : 3114 
[Mon Aug 06 17:16:04 2001] [warn] mod_plsql: Stale Connection due to Oracle error 12571
[Mon Aug 06 17:16:04 2001] [error] mod_plsql: /pls/portal30/portal30.home HTTP-503 ORA-12571 Call to WPG_SESSION API Failed. 
null

A couple of extra things to add. During the 3.0.9.8.1 patch I replaced the wwpage.jar file but wasn't too sure of the exact format to use for minInstall and minTimeout parameters in the zone.properties file. Can someone indicate how this should be.
Also after the 9iAS base install, prior to running the OPCA I ran in the following script as SYS. vpdctx.sql

Thousands of entries in Apache access logs for a single IP

We are seeing thousands of connections in our Apache access logs coming from the same IP address connecting to the
same pages with in a short period of time (~5-20 minutes). We see this in Firefox 27, 28, 29, and 30. Below is an example of the entries, and how they loop continuously. I have not been able to reproduce the problem manually, but this happens several times a week, and I see evidence in our logs, and by monitoring the session count in our database, which increase when this happens.
Why is this happening? Is this a bug? I see a bug report filed at https://bugzilla.mozilla.org/show_bug.cgi?id=976878, but I do not see any replies.
xxx.xxx.xxx.xxx - - [18/Jun/2014:16:03:50 -0400] "GET /webapps/login?new_loc=%2Fwebapps%2Fportal%2Fframeset.jsp HTTP/1.1" 302 - "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:30.0) Gecko/20100101 Firefox/30.0" "-"
xxx.xxx.xxx.xxx - - [18/Jun/2014:16:03:50 -0400] "GET /webapps/login/?new_loc=%2Fwebapps%2Fportal%2Fframeset.jsp HTTP/1.1" 200 1000 "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:30.0) Gecko/20100101 Firefox/30.0" "-"
xxx.xxx.xxx.xxx - - [18/Jun/2014:16:03:50 -0400] "GET /webapps/portal/frameset.jsp HTTP/1.1" 200 1160 "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:30.0) Gecko/20100101 Firefox/30.0" "-"
xxx.xxx.xxx.xxx - - [18/Jun/2014:16:03:50 -0400] "GET /webapps/login?new_loc=%2Fwebapps%2Fportal%2Fframeset.jsp HTTP/1.1" 302 - "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:30.0) Gecko/20100101 Firefox/30.0" "-"
xxx.xxx.xxx.xxx - - [18/Jun/2014:16:03:50 -0400] "GET /webapps/login/?new_loc=%2Fwebapps%2Fportal%2Fframeset.jsp HTTP/1.1" 200 1000 "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:30.0) Gecko/20100101 Firefox/30.0" "-"
xxx.xxx.xxx.xxx - - [18/Jun/2014:16:03:50 -0400] "GET /webapps/portal/frameset.jsp HTTP/1.1" 200 1160 "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:30.0) Gecko/20100101 Firefox/30.0" "-"

Sorry, beyond the scope of this Firefox user support forum.
You could try posting to the Web Development / Standards Evangelism forum at MozillaZine. The helpers over there are more knowledgeable about web site issues with Firefox.
http://forums.mozillazine.org/viewforum.php?f=25
You'll need to register and login to be able to post in that forum.
Or you could add information to that Bug report or create a new Bug report.
Or the appropriate Google Group, linked in the right column of this page after you scroll-down a bit - http://www.mozilla.org/about/forums/

SOLVED:Strange behaviour:request shows results in Answers not in dashboard

Hi all,
I've come across somethings very strange, which I know has to do with the lowest level of detail of my organisation hierarchy (and the keys used at that level), but I cant understand why its doing the following:
I have a table in a dashboard that can receive 'is prompted' filter values from a prompt on the same dashboard. When i created this request in answers, for test reasons i gave it values for a "centre" (lowest level of the organization hierarchy), and it displays resultos for my metrics.
Now I place this request on a dashboard. I have removed my manual test filters, and left the four organization columns of the request as "is prompted", the lowest of these being the centre value. Now in the dashboard, i decide to enter a value directly for the centre dropdown (same value as i previously tested) in my prompt...i get no results found!!!
The lowest level of this prompt has a key made of two atributes (center and center code), this allows me to "drill down" from the centre to the centre code, although centre code is at the same level. If i remove the drilldown capability, the problem is solved...im not quite sure why.
Message was edited by:
zjac

The problem was with the actual data. WHen analyzing the query that was being done, i realised that one of the keys (the centre name) was using a text field that has spaces after the name of the centre (god knows why), so using a trim resolved the issue.
I guess the other configuration was using the centre id which was not encountering the above problem.

I-doc processing gives strange entries

Hi,
we are currently postinf fidccp02 documents into the receiving system,
the only curious thing is that when we gather all the information at sending side
eg 1 bkpf segment
5 bseg segments
1 bset segment
the system creates on top of the bset segment another tax record when we consult
the transaction fb03.
Can we avoid that, eventually by adjusting the i-doc content?
Is there any direction in which we can find the source of the problem?
grtz,
Koen

Kaustubh Krishna,
thank you for respond.
It was dbacockpit. The connection was maintained with old db2sid password. And it was causing problematic log entries.
Problem was solved.
Points awarded.
Thanks,
kind regards,
Artyom

Strange entry in the /etc/hosts file

Hi,
While doing some testings with my network this afternoon, I noticed that there's this strange line in my /etc/hosts file:
::1 localhost
Anybody has any idea what the "::1" is for? The only thing related to network that I had recently installed is VPN Tracker. Could it be VPN Tracker that added that line to the hosts file?
Thanks in advance for your help!
Frank
PowerBook G4 Mac OS X (10.4.8)

It's supposed to be there, here's a fresh install's complete hosts file...
# Host Database
# localhost is used to configure the loopback interface
# when the system is booting. Do not change this entry.
127.0.0.1 localhost
255.255.255.255 broadcasthost
::1 localhost "
Not sure what it means... may be a 16 bit number though! :-D

[Solved] Strange entries in apache access_log

Similar Messages

Maybe you are looking for