# Help for understan access.log

**URL:** <https://www.ruby-forum.com/t/help-for-understan-access-log/205553>\
**Category:** NGINX\
**Created:** [April 8, 2011, 3:54pm UTC](https://www.ruby-forum.com/t/help-for-understan-access-log/205553 "2011-04-08T15:54:16Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![dubstep](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/cdc98d/32.png) [@dubstep](https://www.ruby-forum.com/u/dubstep)\
**Post date:** [April 8, 2011, 3:54pm UTC](https://www.ruby-forum.com/t/help-for-understan-access-log/205553/1 "2011-04-08T15:54:16Z")

</div>

In my access.log I found this lines:

109.230.220.33 - - [02/Apr/2011:00:42:07 +0400] “GET  
[http://movies.yahoo.com//](http://movies.yahoo.com//) HTTP/1.0” 200 151 “-” “-”  
95.132.30.204 - - [03/Apr/2011:02:06:24 +0400] “GET  
[http://www.google.com/](http://www.google.com/) HTTP/1.0” 200 151 “-” “Mozilla/4.0 (compatible;  
MSIE 6.0; Windows NT 5.1)”  
109.230.222.236 - - [04/Apr/2011:16:56:03 +0400] “GET  
[http://XXX.XXX.XXX.XX/?login=sandart232&passwd=testing](http://XXX.XXX.XXX.XX/?login=sandart232&passwd=testing) HTTP/1.0” 200 151  
“-” “-”  
109.230.222.236 - - [07/Apr/2011:12:50:14 +0400] “HEAD / HTTP/1.0” 200 0  
“-” “-”  
109.230.222.236 - - [07/Apr/2011:12:50:14 +0400] “HEAD / HTTP/1.0” 200 0  
“-” “-”  
109.230.222.236 - - [07/Apr/2011:12:50:15 +0400] “HEAD / HTTP/1.0” 200 0  
“-” “-”  
109.230.222.236 - - [07/Apr/2011:12:50:20 +0400] “HEAD / HTTP/1.0” 200 0  
“-” “-”  
109.230.222.236 - - [07/Apr/2011:12:50:56 +0400] “GET  
[http://maps.yahoo.com/](http://maps.yahoo.com/) HTTP/1.0” 200 151 “-” “-”  
109.230.222.236 - - [07/Apr/2011:12:50:56 +0400] “GET  
[http://maps.yahoo.com/](http://maps.yahoo.com/) HTTP/1.0” 200 151 “-” “-”  
175.138.46.45 - - [08/Apr/2011:08:35:28 +0400] “GET  
[http://answers.yahoo.com/](http://answers.yahoo.com/) HTTP/1.0” 200 151 “-” “-”

What about this lines? People uses my web server like a proxy?  
The http status code is 200…

Thank you.

Posted at Nginx Forum:

> **[Help for understan access.log](https://forum.nginx.org/read.php?2,189426,189426#msg-189426)**
>
> In my access.log I found this lines: 109.230.220.33 - - \[02/Apr/2011:00:42:07 +0400\] "GET http://movies.yahoo.com// HTTP/1.0" 200 151 "-" "-" 95.132.30.204 - - \[03/Apr/2011:02:06:24 +0400\] "GET...

---

<div class="post-metadata">

**Author:** ![collaborando](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/ea666f/32.png) [@collaborando](https://www.ruby-forum.com/u/collaborando)\
**Post date:** [April 13, 2011, 4:23pm UTC](https://www.ruby-forum.com/t/help-for-understan-access-log/205553/2 "2011-04-13T16:23:46Z")

</div>

I think somebody telnet to your server and try GET documents from other  
server

Try telnet to your server:

telnet YOURSERVERHOST 80

And paste text in brackets (with empty line):  
{{{  
GET [http://maps.yahoo.com/](http://maps.yahoo.com/) HTTP/1.0  
Connection: close

}}}

and check your logs

Posted at Nginx Forum:

> **[Re: Help for understan access.log](https://forum.nginx.org/read.php?2,189426,190883#msg-190883)**
>
> In my access.log I found this lines: 109.230.220.33 - - \[02/Apr/2011:00:42:07 +0400\] "GET http://movies.yahoo.com// HTTP/1.0" 200 151 "-" "-" 95.132.30.204 - - \[03/Apr/2011:02:06:24 +0400\] "GET...

---

<div class="post-metadata">

**Author:** ![collaborando](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/ea666f/32.png) [@collaborando](https://www.ruby-forum.com/u/collaborando)\
**Post date:** [April 13, 2011, 4:52pm UTC](https://www.ruby-forum.com/t/help-for-understan-access-log/205553/3 "2011-04-13T16:52:47Z")

</div>

On Fri, Apr 08, 2011 at 09:53:47AM -0400, collaborando wrote:

> 109.230.222.236 - - [07/Apr/2011:12:50:14 +0400] “HEAD / HTTP/1.0” 200 0  
> [http://maps.yahoo.com/](http://maps.yahoo.com/) HTTP/1.0" 200 151 “-” “-”  
> 175.138.46.45 - - [08/Apr/2011:08:35:28 +0400] “GET  
> [http://answers.yahoo.com/](http://answers.yahoo.com/) HTTP/1.0” 200 151 “-” “-”
> 
> What about this lines? People uses my web server like a proxy?  
> The http status code is 200…

They try to use it as proxy, but since response length is always 151  
bytes, they get some default page.

–  
Igor S.

---

<div class="post-metadata">

**Author:** ![collaborando](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/ea666f/32.png) [@collaborando](https://www.ruby-forum.com/u/collaborando)\
**Post date:** [April 13, 2011, 6:44pm UTC](https://www.ruby-forum.com/t/help-for-understan-access-log/205553/4 "2011-04-13T18:44:01Z")

</div>

Thanks to Igor S. and ewgra.

I tried to use telnet and in fact the log is the same. Telnet responds  
with the default page of 151 bytes.

Bye.

Below the telnet attempt:

$ telnet myhost 80  
Escape character is ‘^]’.  
GET [http://maps.yahoo.com/](http://maps.yahoo.com/) HTTP/1.0  
Connection: close

HTTP/1.1 200 OK  
Server: nginx/0.8.54  
Date: Wed, 13 Apr 2011 16:38:10 GMT  
Content-Type: text/html  
Content-Length: 151  
Last-Modified: Sun, 27 Feb 2011 08:57:45 GMT  
Connection: close  
Accept-Ranges: bytes

Welcome to nginx!
# Welcome to nginx!
Connection closed by foreign host.

Posted at Nginx Forum:

> **[Re: Help for understan access.log](https://forum.nginx.org/read.php?2,189426,190944#msg-190944)**
>
> In my access.log I found this lines: 109.230.220.33 - - \[02/Apr/2011:00:42:07 +0400\] "GET http://movies.yahoo.com// HTTP/1.0" 200 151 "-" "-" 95.132.30.204 - - \[03/Apr/2011:02:06:24 +0400\] "GET...