Hi,
I have some stange entry in my logs.

They are like
60.27.64.170 - - [04/Oct/2006:18:03:10 -0400] "GET
http://www.intel.com/ HTTP/1.1" 200 2626
218.19.121.30 - "" [12/Apr/2006:17:57:08 -0400] "GET
http://www.google.ca:80/ HTTP/1.0" 200 229

Am I a proxy ??
Why some has 2 dashes after ip adress and others has something else ?


Thanks

On Oct 4, 10:06 pm, "jarrux" <luc.martineau....@gmail.com> wrote:
> Hi,
> I have some stange entry in my logs.
>
> They are like
> 60.27.64.170 - - [04/Oct/2006:18:03:10 -0400] "GEThttp://www.intel.com/HTTP/1.1" 200 2626
> 218.19.121.30 - "" [12/Apr/2006:17:57:08 -0400] "GEThttp://www.google.ca:80/HTTP/1.0" 200 229
>
> Am I a proxy ??

Could be. See:
http://httpd.apache.org/docs/1.3/mis...html#proxyscan

> Why some has 2 dashes after ip adress and others has something else ?

The dashes indicate the requested info is not available. See:
http://httpd.apache.org/docs/2.2/logs.html#accesslog

Joshua.

"jarrux" <luc.martineau.luc@gmail.com> wrote in message
news:1160014017.259490.138400@c28g2000cwb.googlegr oups.com...
> Hi,
> I have some stange entry in my logs.
>
> They are like
> 60.27.64.170 - - [04/Oct/2006:18:03:10 -0400] "GET
> http://www.intel.com/ HTTP/1.1" 200 2626
> 218.19.121.30 - "" [12/Apr/2006:17:57:08 -0400] "GET
> http://www.google.ca:80/ HTTP/1.0" 200 229
>
> Am I a proxy ??
> Why some has 2 dashes after ip adress and others has something else ?
>
>
> Thanks

First thing is to look up the docs on how to read your logs.
first is source ip
next usually 2 of - for information not known one item is username when
you are using htaccess
next is time - obviously
next is request cab be get, put, post, connect, whatever
request to another site would be a proxy attempt - I get lots of those
request to a page on your site would be normal
anything other than get or head is abnormal
next is http version
next is the critical item - the return code
look these up 200 means your server did the requested job oops
next is the length of the page which your server returned to the source

I like to have referrer information as well, so I use the log format
'combined'

I'm not an expert, but it looks to me like you do have an open proxy. Easy
mistake to make, and simple to fix.
I had mine accidentally open when I first set it up - was getting thousands
of hits per day until I figured out where the error was.
Seems it was on by default 'out of the box' and I did not catch that.
I don't have my apache logs and configs available right now, but I can check
them if you need more detail, and specifically which configs to change.

Stuart