my access.log file occasionally lists an entry such as:
24.1.248.26 - - [12/Dec/2004:13:00:20 -0600] "SEARCH /\x90\x02\xb1\x02\x
b1\x02\xb1\x02\xb1\x02\xb1\x02\.....

Where the entry continues for MANY bytes. This causes my access.log file to 
grow big rapidly

Simultaneously, my error.log gets an entry:
[Sun Dec 12 13:00:20 2004] [error] [client 24.1.248.26] request 
failed: URI too long (longer than 8190)

I don't know if this Search is to blame or not but my Apache 2.0.52 installa
tion stops working every few days. This is a very fresh log entry above and 
did not cause the server to die. Also, I just upgraded to 2.0.52 from 2.0(I 
think).

Any advice on either of these? 

Thanks

[ Post a follow-up to this message ]

I've done additional research on the SEARCH string and it seems to be fairly
 well known as the WebDAV attack. I've read that Apache's http server is not
 affected by this attack and that the major concern is the log entries. I've
 tried a couple of the suggestions seen but they didn't eliminate the log en
tries. I'm now doing manual removals.

Since the upgrade to 2.0.52, I've not experince any further server problems.
 In my prior post I was not as discriptive as I should have been. The server
 didn't actually die it just stopped "serving". Restarting the server using 
the monitor always fixed the issue. However, often, use of the "restart" but
ton would not fix the issue but a "stop" and "start" would.

"Lynn Kenney" <Lynn-nospam-kenney@comcast.net> wrote in message news:oH0vd.4
88457$wV.306009@attbi_s54...
my access.log file occasionally lists an entry such as:
24.1.248.26 - - [12/Dec/2004:13:00:20 -0600] "SEARCH /\x90\x02\xb1\x02\x
b1\x02\xb1\x02\xb1\x02\xb1\x02\.....

Where the entry continues for MANY bytes. This causes my access.log file to 
grow big rapidly

Simultaneously, my error.log gets an entry:
[Sun Dec 12 13:00:20 2004] [error] [client 24.1.248.26] request 
failed: URI too long (longer than 8190)

I don't know if this Search is to blame or not but my Apache 2.0.52 installa
tion stops working every few days. This is a very fresh log entry above and 
did not cause the server to die. Also, I just upgraded to 2.0.52 from 2.0(I 
think).

Any advice on either of these? 

Thanks

[ Post a follow-up to this message ]

I was hoping that my problems had been resolved by the update to the most cu
rrent version of Apache's http server but no luck. I rebooted yesterday to i
nstall a CDROM and it appears that the server stopped functioning correctly.
 If I attempt to access it via a web browser (Foxfire), I receive a dialog b
ox that simply says: "The connection was refused when attempting to contact 
.." The access log reflects successful GETs until 02:53:19 so the server ev
idently started OK at boot time.

There are no log entries to reflect this activity. No errors. zip.

Any ideas? Any ideas at all on how I should proceed?

The error log has these entries from the reboot:

[Mon Jan 03 21:44:53 2005] [notice] Parent: Created child process 65
2
[Mon Jan 03 21:44:53 2005] [notice] Child 652: Child process is runn
ing
[Mon Jan 03 21:44:53 2005] [notice] Child 652: Acquired the start mu
tex.
[Mon Jan 03 21:44:53 2005] [notice] Child 652: Starting 250 worker t
hreads.

I noticed in task manager that there is also an Apache process running with 
a PID of 496. This is reflected in the httpd.pid file.

remove the -nospam- from my email to reply.

Thanks
Lynn

"Lynn Kenney" <Lynn-nospam-kenney@comcast.net> wrote in message news:iPYwd.2
10036$5K2.1102@attbi_s03...
I've done additional research on the SEARCH string and it seems to be fairly
 well known as the WebDAV attack. I've read that Apache's http server is not
 affected by this attack and that the major concern is the log entries. I've
 tried a couple of the suggestions seen but they didn't eliminate the log en
tries. I'm now doing manual removals.

Since the upgrade to 2.0.52, I've not experince any further server problems.
 In my prior post I was not as discriptive as I should have been. The server
 didn't actually die it just stopped "serving". Restarting the server using 
the monitor always fixed the issue. However, often, use of the "restart" but
ton would not fix the issue but a "stop" and "start" would.

"Lynn Kenney" <Lynn-nospam-kenney@comcast.net> wrote in message news:oH0vd.4
88457$wV.306009@attbi_s54...
my access.log file occasionally lists an entry such as:
24.1.248.26 - - [12/Dec/2004:13:00:20 -0600] "SEARCH /\x90\x02\xb1\x02\x
b1\x02\xb1\x02\xb1\x02\xb1\x02\.....

Where the entry continues for MANY bytes. This causes my access.log file to 
grow big rapidly

Simultaneously, my error.log gets an entry:
[Sun Dec 12 13:00:20 2004] [error] [client 24.1.248.26] request 
failed: URI too long (longer than 8190)

I don't know if this Search is to blame or not but my Apache 2.0.52 installa
tion stops working every few days. This is a very fresh log entry above and 
did not cause the server to die. Also, I just upgraded to 2.0.52 from 2.0(I 
think).

Any advice on either of these? 

Thanks

[ Post a follow-up to this message ]