Home / server / Questions / 183865
Accepted
Peter Smit
Asked: 2010-09-23 21:23:29 +0800 CST

Why do php hits appear 3 times in nginx log files

  • 772

I have a Ubuntu Lucid server with Nginx (0.7.65) and php5-fpm (package by Brian Mercer)

All my configuration is default and my site config is looking like this (domains replaced):

server {
  listen 80;
  server_name sub.example.com;
  access_log /data/log/www/sub.example.com/access.log;
  error_log /data/log/www/sub.example.com/error.log;

  location / {
    root /data/www_data/sub.example.com/public;
    index index.php;
  }

  location ~ \.php$ {
    fastcgi_param SCRIPT_FILENAME /data/www_data/sub.example.com/public$fastcgi_script_name;
    fastcgi_pass 127.0.0.1:9000;
    include /etc/nginx/fastcgi_params;
  }
}

And I have an index.php present with <?php phpinfo(); ?> in it.

Now when I load sub.example.com/ in my Chrome webbrowser I get to see the phpinfo. The strange thing is, in my access log multiple entries are written for the index.php hit. For the favico (which does not exist) only one hit. See the log below.

130.233.178.70 - - [23/Sep/2010:05:00:27 +0000] "GET / HTTP/1.1" 200 10287 "-" "Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/534.3 (KHTML, like Gecko) Chrome/6.0.472.62 Safari/534.3"
130.233.178.70 - - [23/Sep/2010:05:00:27 +0000] "GET /index.php?=PHPE9568F34-D428-11d2-A769-00AA001ACF42 HTTP/1.1" 200 2536 "http://sub.example.com/" "Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/534.3 (KHTML, like Gecko) Chrome/6.0.472.62 Safari/534.3"
130.233.178.70 - - [23/Sep/2010:05:00:27 +0000] "GET /index.php?=SUHO8567F54-D428-14d2-A769-00DA302A5F18 HTTP/1.1" 200 2825 "http://sub.example.com/" "Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/534.3 (KHTML, like Gecko) Chrome/6.0.472.62 Safari/534.3"
130.233.178.70 - - [23/Sep/2010:05:00:27 +0000] "GET /index.php?=PHPE9568F35-D428-11d2-A769-00AA001ACF42 HTTP/1.1" 200 2158 "http://sub.example.com/" "Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/534.3 (KHTML, like Gecko) Chrome/6.0.472.62 Safari/534.3"
130.233.178.70 - - [23/Sep/2010:05:00:27 +0000] "GET /favicon.ico HTTP/1.1" 404 143 "-" "Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/534.3 (KHTML, like Gecko) Chrome/6.0.472.62 Safari/534.3"

What is causing this triple hit on index.php?

nginx php-fpm

2 Answers

  1. Best Answer

    Just view source of generated page. You'll see that images have adresses like 

    <img border="0" src="/index.php?=PHPE9568F34-D428-11d2-A769-00AA001ACF42" alt="PHP Logo" />

    That's because you have multiple requests in your log file

    • 1

  2. First of all you should upgrade Nginx to 0.7.67, as you can see form the Change Log 0.7.66 was a major update and staying at 0.7.65 is not recommended.

    If you take a look at the actual requests you'll notice they are different as well.

    ?=PHPE9568F34
?=SUHO8567F54
?=PHPE9568F35

    I can't tell you why they are different, but that is at least why Nginx is logging three requests. The odd thing is that the number after the status 200 is the number of bytes sent, so it's actually showing different content. Based on the requests this is at least partially related to suhosin according to the query string.

    • 0