400 'Bad request' error codes do not get logged

B

brrr

Well-Known Member
#1
#1
This may be related to the previous bug report I sent in about the erratic way that LSWS handles custom error codes.

When I generate a 404 error in LSWS,
Code: 
GET /sadfsdfdfs.html HTTP/1.1
Host: 123.456.789.012
Accept: */*

RESPONSE: **************
HTTP/1.1 404 Not Found
Date: Tue, 30 Oct 2007 14:13:09 GMT
Server: LiteSpeed
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
ETag: "35d-471fb055-168009"
Last-Modified: Wed, 24 Oct 2007 20:51:33 GMT
Content-Type: text/html
Content-Length: 861

<html>
<head>
<title>404 Error - file not found</title>
<meta http-equiv="Content-Language" content="en-us">
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>

etc etc rest of my custom 404 error page
I get an error in the access.log file like so:

Code: 
123.456.789.012 - - [30/Oct/2007:06:13:09 -0800] "GET /sadfsdfdfs.html HTTP/1.1" 404 861 "-" "-" "22.33.444.555"
All good.

But I notice that when I generate 400 'Bad Request' errors that LSWS handles with an internal 'built-in' error message, the error is not logged anywhere in the system in any error log or access log at all.

Eg the error generated below
Code: 
REQUEST: **************
POST * HTTP/1.1
Host: 123.456.789.012
Accept: */*

RESPONSE: **************
HTTP/1.1 400 Bad Request
Date: Tue, 30 Oct 2007 14:33:16 GMT
Server: LiteSpeed
Connection: close
Cache-Control: private, no-cache, max-age=0
Pragma: no-cache
Content-Type: text/html
Content-Length: 363

<html>
<head><title> 400 Bad Request
</title></head>
<body>
<h1> 400 Bad Request</h1>
It is not a valid request!<hr />
Powered By <a href='http://www.litespeedtech.com'>LiteSpeed Web Server</a><br />
<font face="Verdana, Arial, Helvetica" size=-1>Lite Speed Technologies is not responsible for administration and contents of this web site!</font>
</body>
</html>
is not to be found in any log on the system.

But if I generate for example 405 'Method Not Allowed' or 301 'Moved Permanently' errors they get logged OK alongside 404's, but 400's do not get logged. Eg if I sequentially generated a 405, 301 and then a 400 error, this is all I'd see in the access log:

Code: 
123.456.789.012 - - [30/Oct/2007:06:32:51 -0800] "POST / HTTP/1.1" 405 384 "-" "-" "22.33.444.555"
123.456.789.012 - - [30/Oct/2007:06:44:01 -0800] "GET /protected HTTP/1.1" 301 414 "-" "-" "22.33.444.555"
I see the following error codes reported OK in my logs - 200, 301, 304, 401, 403, 404, 405 but I haven't tested this out with all available error codes.

Is this a bug or a feature with LSWS? :)

Apache logs 400 codes OK, FWIW.

Platform = LSWS 3.2.4 Standard, CentOS 4.5 on OpenVZ
 
M

mistwang

LiteSpeed Staff
#2
#2
The problem with requests end up with 400 code is that LSWS does not process the request any further to determine which vhost it belongs to, so it is not likely going into the respective vhost access log, it could be logged into the server access log as unclassified requests though.

Do you really need it being logged to some where? :)
 
B

brrr

Well-Known Member
#3
#3
Thanks for the reply. If any 400 errors get logged in the server log at all under LSWS, I can't find them :)

I guess that logging of failed requests of all HTTP types is probably - in general - potentially useful to web managers. It can tell you things about your site, your client's requests, or your referrers that could be handy to know from a diagnostic perspective.

400 errors can also alert you to some types of web attacks or probes, which may also be useful news to an administrator ...

So my personal vote would be for LSWS to figure out a way of logging them somewhere. :)
 
M

mistwang

LiteSpeed Staff
#4
#4
Some 400 error was result of invalid HTTP request, and LSWS does not even bother to finish the parsing when it happen, so it is kind of hard to have it in the access log. Maybe in the error log.
 
You must log in or register to reply here.
Top