On Tue, 13 Mar 2001, Romeo E. Cabrera wrote:
> Hi people, i am having this problem:
>
> Examining the cache.log archive, these messages appear:
>
> [root@server squid]# tail -f cache.log
> 2001/03/13 15:50:39| urlParse: Illegal character in hostname
> 'xxx.yyy.zzz.uuu:8080xxx.yyy.zzz.uuu'
> 2001/03/13 15:50:39| urlParse: Illegal character in hostname
> 'xxx.yyy.zzz.uuu:8080xxx.yyy.zzz.uuu'
> 2001/03/13 15:50:52| urlParse: Illegal character in hostname
> 'xxx.yyy.zzz.uuu:8080xxx.yyy.zzz.uuu'
> 2001/03/13 15:50:52| urlParse: Illegal character in hostname
> 'xxx.yyy.zzz.uuu:8080xxx.yyy.zzz.uuu'
> 2001/03/13 15:51:04| urlParse: Illegal character in hostname
> 'xxx.yyy.zzz.uuu:8080xxx.yyy.zzz.uuu'
> 2001/03/13 15:51:04| urlParse: Illegal character in hostname
> 'xxx.yyy.zzz.uuu:8080xxx.yyy.zzz.uuu'
> 2001/03/13 15:51:16| urlParse: Illegal character in hostname
> 'xxx.yyy.zzz.uuu:8080xxx.yyy.zzz.uuu'
> 2001/03/13 15:51:16| urlParse: Illegal character in hostname
> 'xxx.yyy.zzz.uuu:8080xxx.yyy.zzz.uuu'
> 2001/03/13 15:51:29| urlParse: Illegal character in hostname
> 'xxx.yyy.zzz.uuu:8080xxx.yyy.zzz.uuu'
>
> the log is shown exactly as generated, excepting the ip address which i
> changed in order to protect privacy...
>
> by the way xx.yyy.zzz.uuu is ip the address of the server running squid, and
> 8080 is the port.
>
> This has happend at least the last three days... As you can see, these
> requests appear at least every ten seconds. I would like to find out which
> is the client that makes these requests, but i don't know how to obtain this
> info.
>
> I have even executed squid with
> debug_options ALL,1
>
> but i cannot find out which is the station that is hammering the server...
> or maybe it is a problem in the server?
Search for 'NONE/400' in the fourth field of access.log:
awk '$4 ~ /NONE\/400/' /usr/local/squid/logs/access.log
Received on Tue Mar 13 2001 - 16:10:32 MST
This archive was generated by hypermail pre-2.1.9 : Tue Dec 09 2003 - 16:58:38 MST