Roy Schestowitz wrote:
> Brian Cryer wrote:
>
>> "Roy Schestowitz" <newsgroups@schestowitz.com> wrote in message
>> dcapl8$3f5$1@godfrey.mcc.ac.uk">news:dcapl8$3f5$1@godfrey.mcc.ac.uk...
>>>
>>>> It would be worth rechecking you logs to be sure about where your bad
>>>> referrals are coming from.
>>>
>>> I keep doing it. Often the IP address cannot be interpreted using
>>> reverse DNS lookup. I once spotted Lynx as the user agent, but in
>>> general investigating each individual error like this is relatively
>>> time-consuming (~2 minutes) process and you need a decent sample size to
>>> come up with conclusions.
>>>
>>> Roy
>>
>> Do your logs include the referring page? Its the referring page (if you
>> have it) rather than IP which to me would be of more interest - because
>> then you could track back to the page rather than just the ip of the
>> user.
>
> The last time I checked, there was apparently no referrer information, but
> perhaps I wasn't carefully enough to spot it.
>
> I have just tried to open the monthly log file in order to provide you
> with an answer. Little did I realise it was around 110 MB so the RAM and
> text editor could not handle it (last time I looked at such logs was last
> year when they were much, much smaller). Looking at my daily log file, I
> can't pull out enough information. This has become really frustrating...
> *sign* why did I not stick to lowercase from day one?
I have scooped up some 404's that came up throughout the night:
===
216.32.73.122 - - [28/Jul/2005:18:17:32 +0100] "GET
/weblog/archives/2005/03/31/uninvited-mail/ HTTP/1.1" 404 2436 "-"
"anuxfmsgmic esgU6nmcpxinU 6"
216.32.73.122 - - [28/Jul/2005:18:17:40 +0100] "GET
/weblog/archives/2005/03/31/ HTTP/1.1" 404 2425 "-"
"gkbagdrvrjaNNxkbpoucdg6jqrekekm"
216.32.73.122 - - [28/Jul/2005:18:18:14 +0100] "GET
/Weblog/archives/2005/03/ HTTP/1.1" 200 150984 "-" "oukvjvcpxfll
jvnvoqidx6bjh6fncfbo"
65.190.197.211 - - [28/Jul/2005:18:51:42 +0100] "GET
/usenet/2005/june_2005_2/msg00067.html HTTP/1.1" 404 2434 "" "Opera/7.23
(Windows 98; U) [en]"
65.190.197.211 - - [28/Jul/2005:18:51:42 +0100] "GET
/usenet/2005/june_2005_2/msg00072.html HTTP/1.1" 404 2494 "" "Mozilla/5.0
(Macintosh; U; PPC Mac OS X; en) AppleWebKit/124 (KHTML, like Gecko)
Safari/125"
65.190.197.211 - - [28/Jul/2005:18:51:43 +0100] "GET
/usenet/2005/june_2005_2/msg00068.html HTTP/1.1" 404 2487 "" "Mozilla/5.0
(Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20041210 Firefox/1.0"
===
There are more oddities than answers...
-What is the gibberish at end of the entries at the top? And how did the
user reach "weblog..." and not "Weblog..." (note case)
-In the latter case, even more strangely, the user requests 3 different
pages at the same time. The IP address is identical. One is Opera on
Windows 98, one is a Macintosh and one is Firefox on Window$ NT...
How can this be? These sorts of errors never stop...
Thanks for any help,
Roy
|
|
