strange line in apache log

[mpolito1969]

Dear all,

I've the Apache log full of lines such as

    [Tue Sep 09 13:10:02 2008] [error] [client 150.70.84.41] File does not exist: /home/user1/public_html/forum/viewtopic.php?f=9&t=1457

As you can see, the page exist:

GenteOnLine - GOL • Leggi argomento - quanto costera' una babysitter?

Does anybody know the meaning of those lines?

Ciao,
Max

[mpolito1969]

It always happens with the same IP: 150.70.84.41.

Ciao,
Max

[davidanand]

hey,

check this file exists on server and the file permissions are set properly

is that an cpanel server ?

[mpolito1969]

hey,

check this file exists on server and the file permissions are set properly

is that an cpanel server ?

1) the file exist as it is accesses thousands of times a day and I get the message only ten times a day (approx) and 99% from the same IP. You can check it by yourself clicking on the link I posted;

2) Yes, I use cpanel.

Ciao,
Max

[Roxoff]

So

http://forum.genteonline.org/home/user1/public_html/forum/viewtopic.php?f=9&t=1457

is the same as

http://forum.genteonline.org/viewtopic.php?f=9&t=1457

Are you sure?

I think you have a user that has a bad bookmark, and you're chasing shadows here. You have their IP address, work out which user it is and send them a message.

[mpolito1969]

So

http://forum.genteonline.org/home/user1/public_html/forum/viewtopic.php?f=9&t=1457

is the same as

http://forum.genteonline.org/viewtopic.php?f=9&t=1457

Are you sure?

There is a chroot (I guess) as /home/user1/ is my home directory, public_html is the directory containing the first level domain files (the one you access through

http://www.genteonline.org

, and directory in public_html are home directory of subdomains. File for subdomani 'forum.genteonline.org' are in '/public_html/forum' from my point of view, in directory '/home/user1/public_html/forum' from the server point of view.

I think you have a user that has a bad bookmark, and you're chasing shadows here. You have their IP address, work out which user it is and send them a message.

The first thing I did was looking, using phpBB3 'user search', for a user with that IP but I can't find anyone. Anyway, the file exists, I can see it both accessing to the server through FTP and using the URL I wrote.

Ciao,
Max

[mpolito1969]

Actually there is not only one file with that problem but some of them:

[Fri Sep 12 10:18:38 2008] [error] [client 150.70.84.41] File does not exist: /home/user1/public_html/forum/viewforum.php?f=9&sid=76909439733de6ef7a64a1de45c65882
[Fri Sep 12 10:19:21 2008] [error] [client 150.70.84.41] File does not exist: /home/user1/public_html/forum/style.php?sid=76909439733de6ef7a64a1de45c65882&id=1&lang=en
[Fri Sep 12 10:19:26 2008] [error] [client 150.70.84.41] File does not exist: /home/user1/public_html/forum/viewtopic.php?f=9&t=1546
[Fri Sep 12 10:21:57 2008] [error] [client 150.70.84.41] File does not exist: /home/user1/public_html/forum/viewtopic.php?f=9&t=1546&st=0&sk=t&sd=a&start=15
[Fri Sep 12 10:25:29 2008] [error] [client 150.70.84.41] File does not exist: /home/user1/public_html/forum/viewtopic.php?f=9&t=1546&st=0&sk=t&sd=a&start=30
[Fri Sep 12 10:26:45 2008] [error] [client 150.70.84.41] File does not exist: /home/user1/public_html/forum/viewtopic.php?f=9&t=1546&st=0&sk=t&sd=a&start=45
[Fri Sep 12 10:28:31 2008] [error] [client 150.70.84.41] File does not exist: /home/user1/public_html/forum/viewtopic.php?f=9&t=1546&st=0&sk=t&sd=a&start=60
[Fri Sep 12 10:29:51 2008] [error] [client 150.70.84.41] File does not exist: /home/user1/public_html/forum/viewtopic.php?f=9&t=1546&st=0&sk=t&sd=a&start=75

Ciao,
Max

[Roxoff]

Yes, the address

http://forum.genteonline.org/viewtopic.php?f=9&t=1457

works from outside, i.e. it maps to the right chroot'd server inside /home/user1/public_html but the public_html one doesn't...

I still think that maybe you have _one_ user with an old link that they need to update. Maybe it's not even a user, but some automated search bot or summat. That IP address is based in Japan, btw. I'm short of ideas now; if it were me I'd consider blocking that IP address off to see who shouts.

[mpolito1969]

I'm short of ideas now; if it were me I'd consider blocking that IP address off to see who shouts.

You are right. This won't shed light on what is happening on the server side (the report of an non-existent file that exists) but might help me to get rid of those lines.

Ciao,
Max