I'm looking at nslog.c and I think this is probably the bit that's responsible for my "unknown"s:

    /*
     * Append the peer address and auth user (if any).
     * Watch for users comming from proxy servers.
     */

if (conn->headers && (p = Ns_SetIGet(conn->headers, "X-Forwarded- For"))) {
        Ns_DStringAppend(&ds, p);
    } else {
        Ns_DStringAppend(&ds, Ns_ConnPeer(conn));
    }

I've even found one today that has both my problem and the one Juan reported:

66.102.186.10, unknown - - [29/Nov/2007:00:09:57 -0800] ...

What I don't know is, is there anything I can do to get a valid IP address? I don't know how Ns_ConnPeer(conn) gets set - if the X- Forwarded_For header is present but set to "unknown" (which is my guess as to what's happening), can I revert to using Ns_ConnPeer (conn) instead? Or am I just outta luck? It seems like there ought to be a valid IP address somewhere, as the request isn't supposed to be able to be delivered to the server without one.

The reason I care about this is that we've implemented IP-based site subscriptions, and the folks coming in with "unknown" aren't able to access the site. In this particular instance it's better to get the IP of the proxy server than have it unavailable entirely.

janine

On Nov 14, 2007, at 5:25 PM, Tom Jackson wrote:

This looks like a reverse lookup, but very strange.

Janine's case is also weird. The access log is a small chunk of code, so it
might be easy to figure it out.

Which versions of AOLserver are being used here?

tom jackson


On Wednesday 14 November 2007 16:18, Juan José del Río [Simple Option] wrote:
That's very weird, Janine. Maybe some other knows what's going on.

In my case, I have a weird behaviour too...

213.99.4.203, 212.170.235.17 - - [14/nov/2007:19:32:31 +0100] "GET /
HTTP/1.0" 200 3295 "" "Mozilla/5.0 (Windows; U; Windows
NT 5.0; es-ES; rv:1.8.1.9) Gecko/20071025 Firefox/2.0.0.4" 0.077743

What about this? I don't know what's going on with the *TWO* IPs

Regards,

   Juan José


-
Juan José del Río    |  Comercio online / e-commerce
+34 616 512 340      |  [EMAIL PROTECTED]


Simple Option S.L.
  Tel: +34 951 930 122
  Fax: +34 952 792 455
  http://www.simpleoption.com

On Wed, 2007-11-14 at 15:49 -0800, Janine Sisk wrote:
Does anyone know what causes the IP address to be reported as
"unknown" for a handful of acesses each day?

unknown - - [13/Nov/2007:12:32:06 -0800] "GET / HTTP/1.0" 200 17880
"" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.1.9)
Gecko/20071025 Firefox/2.0.0.9" "

janine


--
AOLserver - http://www.aolserver.com/

To Remove yourself from this list, simply send an email to
<[EMAIL PROTECTED]> with the body of "SIGNOFF AOLSERVER" in the
email message. You can leave the Subject: field of your email blank.

--
AOLserver - http://www.aolserver.com/

To Remove yourself from this list, simply send an email to
<[EMAIL PROTECTED]> with the body of "SIGNOFF AOLSERVER" in the
email message. You can leave the Subject: field of your email blank.


--
AOLserver - http://www.aolserver.com/

To Remove yourself from this list, simply send an email to <[EMAIL PROTECTED]> with the body of "SIGNOFF AOLSERVER" in the email message. You can leave the Subject: field of your email blank.



--
AOLserver - http://www.aolserver.com/

To Remove yourself from this list, simply send an email to <[EMAIL PROTECTED]> 
with the
body of "SIGNOFF AOLSERVER" in the email message. You can leave the Subject: 
field of your email blank.

Reply via email to