I get entries like this in my error log. They are extremely sporadic, and because the access rate is low on our server, it is easy to find the CGI script that was being accessed. In all cases, it is one which hasn't changed in months, and has seen plenty of use in the intervening period, without problems.
My assumption is that this is some temporary blockage in the file system that causes apache to think it has reached EOF before it has actually processed the entire script. What puzzles me is: What is looking for quotes in the first place? The script in question is written in Open Object Rexx. The shebang is: #!/usr/bin/rexx -- REXX is perfectly happy to execute the script (witness the prior successful usage, since it was last updated). Altogether, one of my life's great mysteries. On 18 February 2012 15:40, Phil Smith <[email protected]> wrote: > On Sat, Feb 18, 2012 at 7:10 AM, Eric Covener <[email protected]> wrote: > > On Sat, Feb 18, 2012 at 12:00 AM, Phil Smith <[email protected]> > wrote: > >> I'm running Apache/2.2.3 (CentOS) which is the latest version > >> available for CentOS5. > >> I'm noticing the following in my error logs: > >> sh: -c: line 0: unexpected EOF while looking for matching `"' > >> sh: -c: line 1: syntax error: unexpected end of file > >> > >> They usually arrive in groups of 2-10 such messages; always the exact > >> same message and always in pairs. > >> > >> I've done all the normal examination of access logs that you would > >> expect and with various markers that I've been able to send to my > >> error log, I can pinpoint the time of the errors to within a second or > >> two. But nothing of interest shows in my access logs. Only what > >> appears to be normal and harmless looking GET requests for appropriate > >> URLs to my site. There are not any POSTs near the error time which I > >> understand could send data that I could not gather from the access > >> logs. > >> > >> I've googled and have seen a very few people seeing this, but no > answers. > >> > >> Any thoughts, please? > > > > Find a shell-script CGI accessed around the same time. > > I've already looked for several hours gathering access log data around > the time of those errors. I'm writing some debug to my access logs > every second so I have a very accurate timestamp around the sh errors. > The only requests in the access logs near the time in question are > perl CGIs requested via GET so I can request them myself in the exact > same manner and they do not produce the 'sh' error. They work as > expected. I'm beginning to suspect something internal to apache or an > apache module that might be printing to STDERR and failing. > > --------------------------------------------------------------------- > The official User-To-User support forum of the Apache HTTP Server Project. > See <URL:http://httpd.apache.org/userslist.html> for more info. > To unsubscribe, e-mail: [email protected] > " from the digest: [email protected] > For additional commands, e-mail: [email protected] > > -- Steve Swift http://www.swiftys.org.uk
