On Wed, Apr 25, 2012 at 4:54 PM, Ishita Kapadiya <[email protected]> wrote:
> Hi All,
>
> I am using apache 2.2.22.
>
> We are seeing some weird behavior in Apache access logs. I have
> following line in httpd.conf -
>
> LogFormat "%h %l %i %t \"%r\" %>s %b" common
>
> now the log should look like - 64.39.111.58 - - [25/Mar/2012:11:08:48
> -0400] "GET /abc.html HTTP/1.1" 200 251 (all looks good so far)
>
> The problem - even though i can see such logs in 90% of the cases
> there are lots of entries similar to -
>
> */* - - [25/Mar/2012:11:08:48 -0400] "GET /abc.html HTTP/1.1" 200 251
> */200 - - [25/Mar/2012:11:08:48 -0400] "GET /abc.html HTTP/1.1" 200 251
>
> Note that the first field...
>
> I have set HostnameLookups Off in my config.
> Can anyone tell what could be the reason for such entries or at least
> what such entries mean?
>
> Thanks!
>
Are you sure this is the format being applied? LogFormat simply
defines a format, it doesn't necessarily need to be used.
Another possibility is that you have two CustomLog directives pointing
at the same file but with different formats.
I also don't understand why you are using %h (remote host) with host
lookups turned off. If you want the remote IP address, why not use %a
(remote IP address).
BTW, your use of %i is meaningless. %i is used to extract a header;
you never specify a header name, eg '%{FOOBAR}i'. %i by itself will
always result in a '-'.
Cheers
Tom
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
