problem with apache logs

[alxkn]

Hello,

In some data recorded in our log files we are missing information about referer. For example
195.229.242.55 - - [14/Dec/2005:04:53:03 -0800] "GET
/

http://www/styles/styles.css

HTTP/1.1" 200 10081
"

http://www.skin.com/?REQUEST=SEM&ID=DERMALOGICA&ovmkt=5V2G4DLE5I43O9SEC8ML962GDC"

"Mozilla/4.0 (compatible; MSIE 6.0; Windows 98;
bgft)"

As you see the referer is replaced by the requested URL.

Few of requests, have the referer, however. For example,
195.229.242.55 - - [14/Dec/2005:04:53:01 -0800] "GET
/?REQUEST=SEM&ID=DERMALOGICA&ovmkt=5V2G4DLE5I43O9SEC8ML962GDC
HTTP/1.1" 200 87070 "

http://www.yourskin101.com/search.aspx?keywords=dermalogica"

"Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; bgft)"


Does anyone knows what is the problem with our apache server?

Thanks in advance.

 

[sleipnir214]

There is very likely nothing wrong with your server.

The referer is a value that must be reported by the browser, and a lot of browsers (Firefox and Opera for certain) give the user the ability to turn off referer reporting.



Want the best answers? Ask the best questions! TANSTAAFL!

 

[feherke]

Hi

Just as sleipnir214 wrote. Because seems that you expect too much from the referrer headers, I would like to point out how prevailing is to disable/fake them, by showing a "screenshot" of related settings from Links, a very simple browser.

[tt][highlight silver]| [X] No referer |
| [ ] Send requested URL as referer |
| [ ] Send real referer (normal operation, INSECURE!!!) |
| [ ] Fixed referer |
| |
| Fixed HTTP Referer |
| [/highlight][highlight black]. .[/highlight][highlight silver] |[/highlight][/tt]

So even if you receive a referrer, you can not know if it is real or fake.

Feherke.

http://rootshell.be/~feherke/

 

[alxkn]

Hello,

Thank you for your answers. I wondered if there is a way of looking to those requests that has been sent to our server?

Thanks.

 

[sleipnir214]

I don't understand your question.



Want the best answers? Ask the best questions! TANSTAAFL!

 

[alxkn]

I ment the http headers of a request that is sent to the sever when someone visits our web site.

 

[sleipnir214]

I still don't understand.

Do you want to log all the raw headers of every connection that arrives at your site?



Want the best answers? Ask the best questions! TANSTAAFL!

 

[alxkn]

Yes. At least to take a look to a few of them.

 

[feherke]

Hi

You have to mention each header to log in your log format definition as [tt]%{HeaderName}i[/tt].

If your logformat does not specified those headers until now, you can not see them for the past.

See here what you can log.

http://httpd.apache.org/docs/2.0/mod/mod_log_config.html#formats

Feherke.

http://rootshell.be/~feherke/

 

[alxkn]

our httpd.conf has the following.

LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined

CustomLog logs/access_log combined


I do not see any problem with this.