Error log messages

[IanD]

Hi,

I've been curious about for a while and I'm sure it's something very simple.

I get a lot of the following lines in my error log:

2011-07-15 15:01:53.700 [NOTICE] [***.***.***.***:57146-0#APVH_domain.com] Content len: 11, Request line: 'POST /l.php HTTP/1.1'

The l.php is not relevant because it happens for all sorts of my scripts.

I do a search on the IP address in the log file and this is the only line that mentions it. I've also search in /var/log/messages and /var/log/lfd.log and brings up nothing.

I thought maybe they were requests from an IP that LiteSpeed has temporarily banned but that’s not the case.

So I'm wondering, what are these notices? Are they failed requests? What does the user see?

Many thanks,

Ian

[webizen]

which lsws version in question? also check few entries before and after to see anything correlated.

[IanD]

This is with version: 4.1.2 but it's happened with every version since I can remember.

There is nothing either side of the line except other similar lines with different IP addresses.

Would it be scripts that have timed out or something?

[webizen]

if it is timeout or error, you should see that in error.log

what about access log? anything for that IP?

[IanD]

This is my error.log that I'm referring to.

In my access log there about 160 lines for the IP address.

I get the impression it has triggered something, but I don't know what or how to find out what.

I see lines like:

2011-07-15 23:35:23.549 [NOTICE] [***.***.***.***:62191-0#APVH_domain.com] oops! 503 Service Unavailable
2011-07-15 23:35:23.549 [NOTICE] [***.***.***.***:62191-0#APVH_domain.com] Content len: 299, Request line: 'POST /somethinh HTTP/1.1'

So this is obviously a 503 error but the log lines I'm referring to do not have any explanation before them. Just the:

[***.***.***.***:62191-0#APVH_domain.com] Content len: 299, Re etc

[mistwang]

It is the dump of request info when something happened. That message itself does no harm, the root cause of that message may need some attention.

[IanD]

I see. But what happened? That's what I'm wondering and need to find out!

It's not 503 because they are listed on a seperate line.

I presume that when this info is dumped, the actual request isn't processed?

[IanD]

Ah found the problem..

I enabled INFO level on my log file and the actual error is reported as INFO.

2011-07-17 18:06:33.700 [INFO] [***.***.***.***:16960-0#APVH_domain.com] Connection idle time: 31 while in state: 2 watching for event: 25,close!

2011-07-17 18:06:33.700 [NOTICE] [***.***.***.***:16960-0#APVH_domain.com] Content len: 11, Request line: 'POST /l.php HTTP/1.1'

I've got a couple of settings for 30 seconds,

Initial Request Timeout (secs) Under External App

and

Connection Timeout (secs) under Tuning

Which one would it be? Does that mean this process is taking longer than 30 seconds to complete and therefore being marked as 'bad'?

Many thanks,

Ian

[webizen]

Originally Posted by IanD

...
I've got a couple of settings for 30 seconds,

Initial Request Timeout (secs) Under External App

and

Connection Timeout (secs) under Tuning

Which one would it be? Does that mean this process is taking longer than 30 seconds to complete and therefore being marked as 'bad'?

Many thanks,

Ian

should be "Initial Request Timeout (secs) Under External App".

yes, it is because the processing time is longer than 30 seconds.