2009/01/13 13:04:28 [error] 27100#0: *782718 open()
“/home/spellcit/public_html/letters/.mp3” failed (2: No such file or
directory), client: 204.38.160.220, server: www.spellingcity.com,
request:
“GET /letters/.mp3 HTTP/1.1”, host: “www.spellingcity.com”
Essentially one of 2 things is happening:
(1) One of our php or flash files is trying to access this invalid file
“/letters/.mp3” or
(2) A user is trying to access this directly (unlikely).
The problem is that the log entry does not on the surface reveal enough
information about where the request is coming from so we’re having a
tough
time identifying the source of the request. Is there a way (is it
possible)
to add more information to the log entry to better identify the source
of
the request (swf, php, html, direct, etc.).
Try changing the output format for the error log file to include the
user
agent. Or, look for requests to /letters/.mp3 in your access log, which
may
already contain the user agent. You may find that these requests are
coming
from a bot that is parsing the links in your site incorrectly. I see
this
consistently on the ten or so sites I host, although the errors I
usually
see are for the directory and filename with no file extension (such as
/forms/document when the link actually points to /forms/document.pdf).
It might also help to compare the remote IP addresses to see whether the
bad
requests always come from the same IP or IP range which might indicate
that
it is a bot.
I will go ahead and turn that on and see if I get more info.
Normally our .mp3 files are accessed via flash (swf) files, it could be
that
a swf has a problem (which is why I’m trying to get a more direct
referral
source).
In the current error log that I’m looking it, 50% of the bad requests
came
from one IP address and 50% of them came from another. It is unlikely
that
its a bot as both IP addresses are registered to educational
institutions
which are our primary users, but good point, I will keep an eye on it.
So I turned on the access log but I’m concerned that its size is getting
larger by the second (and this is off peak). By tomorrow AM, its size
may
exceed available disk space.
Is there a way to programmatically turn it on or off via the
configuration
file depending on whether or not an error was generated or a particular
type
of URL requested?
On Tue, Jan 13, 2009 at 11:19:55PM -0500, Ilan B. wrote:
So I turned on the access log but I’m concerned that its size is getting
larger by the second (and this is off peak). By tomorrow AM, its size may
exceed available disk space.
Is there a way to programmatically turn it on or off via the configuration
file depending on whether or not an error was generated or a particular type
of URL requested?