Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

My Nginx access.log is FULL with lines about /wpad.dat (on a completely empty site with only "index.php") :

  • 190.199.220.124 - - [13/Aug/2013:22:37:04 +0000] "GET /wpad.dat HTTP/1.1" 200 731 "-" "Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.95 Safari/537.36"

and on another empty site:

  • 190.199.220.124 - - [14/Aug/2013:00:22:42 +0000] "GET /wpad.dat HTTP/1.1" 404 168 "-" "WinHttp-Autoproxy-Service/5.1"
  • 190.199.220.124 - - [14/Aug/2013:00:22:46 +0000] "GET /wpad.dat HTTP/1.1" 404 168 "-" "Kaspersky Proxy-Server detection agent"

Can I prevent the above / does it point to some misconfiguration? It seems only 2 of my sites hosted on this amazon image show these entries in the log files.

share|improve this question
1  
A similar question was asked on Server Fault: serverfault.com/questions/510396/being-flooded-by-wpad-dat Are you interested in removing the cause of the requests? (Possibly a wildcard domain record pointing to your server?) Or just hiding the log entries? –  Simon Aug 14 '13 at 5:11
    
thanks for the reference! I solved it by just blocking the specific IP address. –  edelwater Aug 14 '13 at 11:46
add comment

1 Answer

up vote 2 down vote accepted

Your first log snippet suggests that the file may actually exist, since nginx response is 200, with 731 bytes of payload data, so, don't be too fast to have it blocked.

However, if you want to have such requests omitted from logs, you can use the following in all servers affected:

location = /wpad.dat {
    access_log  off;
    log_not_found   off;
}

Or, better yet, if you know for sure that you don't have such file, and want to return 404 right away, still omitting all such requests from the logs, use:

location = /wpad.dat {
    access_log  off;
    return  404;
}
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.