400 'Bad request' error codes do not get logged

Discussion in 'Bug Reports' started by brrr, Oct 30, 2007.

  1. brrr

    brrr Well-Known Member

    This may be related to the previous bug report I sent in about the erratic way that LSWS handles custom error codes.

    When I generate a 404 error in LSWS,
    GET /sadfsdfdfs.html HTTP/1.1
    Host: 123.456.789.012
    Accept: */*
    RESPONSE: **************
    HTTP/1.1 404 Not Found
    Date: Tue, 30 Oct 2007 14:13:09 GMT
    Server: LiteSpeed
    Accept-Ranges: bytes
    Connection: Keep-Alive
    Keep-Alive: timeout=5, max=100
    ETag: "35d-471fb055-168009"
    Last-Modified: Wed, 24 Oct 2007 20:51:33 GMT
    Content-Type: text/html
    Content-Length: 861
    <title>404 Error - file not found</title>
    <meta http-equiv="Content-Language" content="en-us">
    <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
    etc etc rest of my custom 404 error page
    I get an error in the access.log file like so:

    123.456.789.012 - - [30/Oct/2007:06:13:09 -0800] "GET /sadfsdfdfs.html HTTP/1.1" 404 861 "-" "-" "22.33.444.555"
    All good.

    But I notice that when I generate 400 'Bad Request' errors that LSWS handles with an internal 'built-in' error message, the error is not logged anywhere in the system in any error log or access log at all.

    Eg the error generated below
    REQUEST: **************
    POST * HTTP/1.1
    Host: 123.456.789.012
    Accept: */*
    RESPONSE: **************
    HTTP/1.1 400 Bad Request
    Date: Tue, 30 Oct 2007 14:33:16 GMT
    Server: LiteSpeed
    Connection: close
    Cache-Control: private, no-cache, max-age=0
    Pragma: no-cache
    Content-Type: text/html
    Content-Length: 363
    <head><title> 400 Bad Request
    <h1> 400 Bad Request</h1>
    It is not a valid request!<hr />
    Powered By <a href='http://www.litespeedtech.com'>LiteSpeed Web Server</a><br />
    <font face="Verdana, Arial, Helvetica" size=-1>Lite Speed Technologies is not responsible for administration and contents of this web site!</font>
    is not to be found in any log on the system.

    But if I generate for example 405 'Method Not Allowed' or 301 'Moved Permanently' errors they get logged OK alongside 404's, but 400's do not get logged. Eg if I sequentially generated a 405, 301 and then a 400 error, this is all I'd see in the access log:

    123.456.789.012 - - [30/Oct/2007:06:32:51 -0800] "POST / HTTP/1.1" 405 384 "-" "-" "22.33.444.555"
    123.456.789.012 - - [30/Oct/2007:06:44:01 -0800] "GET /protected HTTP/1.1" 301 414 "-" "-" "22.33.444.555"
    I see the following error codes reported OK in my logs - 200, 301, 304, 401, 403, 404, 405 but I haven't tested this out with all available error codes.

    Is this a bug or a feature with LSWS? :)

    Apache logs 400 codes OK, FWIW.

    Platform = LSWS 3.2.4 Standard, CentOS 4.5 on OpenVZ
  2. mistwang

    mistwang LiteSpeed Staff

    The problem with requests end up with 400 code is that LSWS does not process the request any further to determine which vhost it belongs to, so it is not likely going into the respective vhost access log, it could be logged into the server access log as unclassified requests though.

    Do you really need it being logged to some where? :)
  3. brrr

    brrr Well-Known Member

    Thanks for the reply. If any 400 errors get logged in the server log at all under LSWS, I can't find them :)

    I guess that logging of failed requests of all HTTP types is probably - in general - potentially useful to web managers. It can tell you things about your site, your client's requests, or your referrers that could be handy to know from a diagnostic perspective.

    400 errors can also alert you to some types of web attacks or probes, which may also be useful news to an administrator ...

    So my personal vote would be for LSWS to figure out a way of logging them somewhere. :)
  4. mistwang

    mistwang LiteSpeed Staff

    Some 400 error was result of invalid HTTP request, and LSWS does not even bother to finish the parsing when it happen, so it is kind of hard to have it in the access log. Maybe in the error log.
  5. brrr

    brrr Well-Known Member

    Error log would be OK.

Share This Page