Home / server / Questions / 386122
Accepted
elle
Asked: 2012-05-05 08:36:48 +0800 CST

Empty/Null Apache request entries in access log

  • 772

This entry got logged in a Apache access log:

IP ADDRESS - - [00/00/0000:00:00:00 -0000] " " 301 - "-" "-"

It was detected by LogWatch as a null HTTP Response and also got marked as a successful probe..

I am curious about how this request about made and how it is considered a successful probe. Here is what I can decipher with specific questions:

  1. Their request was " " - what does this mean?
  2. HTTP return code was 301: this website has a redirect defined in the Apache config - perhaps they were hitting the URL which triggers this redirect?
  3. They were not using a proper HTTP request
  4. They got "-" size return back - what does this mean?
logging apache-2.2 logwatch 301-redirect

1 Answers

  1. Best Answer

    It was an empty request.

    1. %r is actually the first line of their request, which means they sent an empty request. In other words, no headers, no body, nothing. It was likely a socket connection to port 80.
    2. The 301 was likely not to the website--remember, they have nothing defined in their request, including the desired file on your web site.
    3. Exactly.
    4. - means that no data was returned to the client, not to be confused with a size of zero.

    In other words, this was probably somebody opening and closing a connection against port 80, without sending or receiving any data.

    • 8