Hot answers tagged

5

This is just referer spam, from Wikipedia: Referrer spam (also known as log spam or referrer bombing) is a kind of spamdexing (spamming aimed at search engines). The technique involves making repeated web site requests using a fake referer URL to the site the spammer wishes to advertise. Sites that publish their access logs, including referer statistics, ...


4

Your first log snippet suggests that the file may actually exist, since nginx response is 200, with 731 bytes of payload data, so, don't be too fast to have it blocked. However, if you want to have such requests omitted from logs, you can use the following in all servers affected: location = /wpad.dat { access_log off; log_not_found off; } Or, ...


3

That kind of information is collected for website usability testing. There is a strong correlation between where the mouse moves and where users read (many users move the mouse near what they are reading). Knowing where the mouse goes and what users click on gives webmasters a good sense of what users find important and what most draws their attention on ...


2

Make sure that you don't have log specified - from the documentation on ModSecurity: Description: Indicates that a successful match of the rule needs to be logged. Example: SecAction phase:1,id:117,pass,initcol:ip=%{REMOTE_ADDR},log This action will log matches to the Apache error log file and the ModSecurity audit log. Instead specify ...


2

Another one that I've noticed is browserconfig.xml which is some bastardisation requested by IE. Bloody rubbish filling up the logs.


2

Try aillog-hashnize.pl from https://gist.github.com/xtetsuji/1446584 It is a perl script to parse maillog file and produce output file as CSV. Then import CSV into Excel and apply filter as you wish (@recipient.com). perl maillog-hashnize.pl -y 2016 maillog-20160124 > maillog.csv


2

Unfortunately it is not possible to disable or change the access logging configuration from within cPanel, or using .htaccess files or any other tricks - this can only be done with server administration privileges, not a single cPanel user privileges. Greater control over the logging would be a great feature to add into cPanel, though I can't personally ...


2

If you wish to disable the access logging, you will need access to httpd.conf file. This is possible only if you have root privileges. I won't be possible to edit these values with cPanel access.


2

Yes, this bot is trying to exploit JCE. It’s probably using a very powerful publicly available exploit (+ mirror) for JCE < 2.0.11. Although this is a really outdated version, many instances are still in the wild. JCE 2.0.11 was released on 2011-08-29, the exploit has been available after the release (if its author kept his word). If JCE is not installed ...


2

Apache supports rotating logfiles. Check the manual here, specifically the following example: CustomLog "|bin/rotatelogs -l /var/logs/logfile.%Y.%m.%d 86400" common


2

It is common practice to define a seperate logfile for each vhost. Without knowing your config, I assume, that the main nginx.conf has defined a default log file. It will log any request that is not matching any of the vhosts that might be configured. I assume that sites-enabled/mysite is a vhost that is using name-based virtual host (in Apache speech this ...


2

Are you displaying ads on your site from Amobee (formerly known as Kontera)? The PTR record for this IP is nat.aws.kontera.com, suggesting that it is a crawler looking for your page's content in order to determine what ads may be relevant to that URL. If you've loaded the Kontera JavaScript on login-protected pages, then you will find that they are crawled ...


2

I have hundreds of sub-domains of opera-mini.net. Too many to count! I did a quick review of about 20 of them and I see two things: 1] Rogue Spider: A spider or bot that disobeys or ignores the robots.txt file. 2] Stealth Spider: A spider or bot that tries to fly under the site owners radar when analyzing their log file. It is likely that this is a ...


2

You can use something like this 1) Set up onBeforeAction hooks to login the user automatically (which asks for credentials if user is not logged in to external service) var loginWithGoogle = function() { if (bla.isClient) { Session.set('loginError', undefined); bla.loginWithGoogle({ loginStyle : "redirect", requestPermissions :...


2

As @dan hinted, your problem is probably not related to logging, as Apache would cheerfully also log IPv6 addresses... if someone connects to it over IPv6. So you will first need to double check that your server is indeed listening on an IPv6 and is reachable from outside. For that, you may need the Listen directive. Try locally by going to http://[::1]/, ...


2

You could certainly use something like ab or siege -- but it seems like a lot of work for little benefit, at least given what you're trying to accomplish. If I were you I'd just create some random/empty files. Give them the right name and put them in the right place and logrotate should do its job normally -- it doesn't care at all about what the contents of ...


1

My 404 log... You probably mean the error log. In an apache server, errors are recorded in the error_log file. ... shows many URLs ending with /& or /m& instead of the file extension. They are getting Error 404s but what is that supposed to do? It means that either a guest or a robot is requesting a URL from your website that ends in /& or /...


1

The problem coincided with changing FTP clients (from FileZilla to "CoffeeCup Free FTP") and was possibly the result of EOL conversion during an ASCII FTP file transfer. Or even transferring in "Binary" mode from a Linux server to Windows. Typically, the FTP client will default to ASCII transfer mode for certain file types, but this is configurable within ...


1

The solution I decided to go for: Client: On redirection detection (3xx HTTP response) the client is sending a request to the server to check specifically if the user is connected or no (the redirection can be due to another reason than "unidentified" user). Server: The server answers this request that is allowed for any user (identified or not) and hence ...


1

There should be a request to _utm.gif? from the page. (See this blog post and this SO answer.) Unfortunately I can't find out if/how it's possible to know if a request has been done from a page. This code is the best I quickly found.


1

You can force to start a new session in case You need it using the sessionControl. Send a hit like : ga(‘send’, ‘pageview’, {‘sessionControl’: ‘start’}); Further info https://developers.google.com/analytics/devguides/collection/analyticsjs/field-reference#sessionControl


1

Your HTTP server should handle your access logging. I add additional logging from my application because there are fields that I want log that the HTTP server doesn't have access too: Response category (page, html fragment, image, js, css, json, etc) Page template (name of template file used to generate the page) Logged in user id (HTTP server can log ...


1

Generally with any server-side language in play, your webpages are going to be created by the server directly and won't be duplicated by the CDN. Instead, a CDN is generally most effective when used on static assets like images, audio or video files, pdfs, word docs, etc. But most of all images, including the images in any page on the server. So you won't ...


1

on a shared hosting server Unfortunately, this is not possible on a shared server, since you won't have access to the server config. To install mod_remoteip (or mod_clouldflare) and/or to change the access LogFormat you need access to the main server config and to be able to restart the Apache webserver. Although with Cloudflare CDN in front of your ...


1

We have solutions for restoring original visitor IP with CloudFlare in our knowledge base.


1

A possibility is that these hits are made through links that people have added to their blogs/sites or shared with others using email, social networks etc. It's happening to me all the time. They try to add a link to their website, but they do not make the copy paste correctly or they add extra characters or even delete some of them (accidental/mistaken ...


1

You could try opening it with LibreOffice, It asks you for the separator when you open a CSV file. For that to work you would have to rename the file as maillog.csv so that LibreOffice knows that it is a CSV file. I suspect that won't work well. Instead, I would get things in the right format with Unix command line tools first. Use grep to only show ...


1

It would be worth looking at the user-agent values for those requests causing the 404's. As previously asked/answered, browsers will normally follow the <link> location before any default request is made against the root folder of the site. The error logs you are seeing are due to your file locations being in other directories. Most browsers will find ...


1

Just found out about this: TrendMicro is recording every click Seems to be TrendMicro's form of spyware... (*protection*kuch*) and i'm going to block the IP-Range. I won't condolence bad behaviour


1

Check your servers /etc/hosts file. You probably have the entry for 'localhost' set to '::1' which is IPV6 format. Change it to '127.0.0.1' (IPV4) and this log message will go away.


Only top voted, non community-wiki answers of a minimum length are eligible