[plug] Does anyone recognise what program is generating this hit on apache?

William Kenworthy billk at iinet.net.au
Tue Nov 15 18:40:43 WST 2005


Did that - the ua string is the quoted dash at the end of the string.

Catching it in the act is not easy - its what I have been trying to do -
it isues a few querys and then stops, sometimes going for hours between
the bursts.  Thats why I was hoping someone would know what it was.
Basicly curious, plus a little concerned that I can find it.

BillK

 On Tue, 2005-11-15 at 14:51 +0800, Craig Ringer wrote:
> W.Kenworthy wrote:
> 
> >Does anyone recognise what program is generating this hit on apache?
> >
> >127.0.0.1 - - [15/Nov/2005:12:06:09 +0800]
> >"GET /poll/index.html:80?TableList=19001,19002,19003,67001,19004,31001,18001,56001,26001,26002, HTTP/1.0" 404 275 "- -> /poll/index.html:80" "-"
> >
> >Started after some updates but I cant identify where its coming from.
> >
> 
> If the hits are continuing, tweak Apache to use a combined 
> access/referer log and see what the program reports for its User-Agent. 
> That might well be informative. You might also be able to catch an open 
> connection in `netstat -tnp' .
> 
> --
> Craig Ringer
> _______________________________________________
> PLUG discussion list: plug at plug.org.au
> http://www.plug.org.au/mailman/listinfo/plug
> Committee e-mail: committee at plug.linux.org.au
-- 
William Kenworthy <billk at iinet.net.au>
Home!



More information about the plug mailing list