Corrupt logfile lines using Analog

Posted By: kilo ()
Posted On: 2004-Oct-13 14:01

Hi I was just wondering what it exactly means when Analog finds corrupted Lines while analyzing a log file? How do the lines get corrupted? is there a way to fix them? and is it normal when 300 lines are shown as being corrupted out of 1,402,545 file requests counted in the log?

and why is that only a few lines are corrupted and not all?
Arent each configured the same way?




Posted By: OAC (Staff)
Posted On: 2004-Oct-14 07:17

Could these be virus hacking attempts? Are you able to get access to the raw log file and locate such corrupted Lines?

From time to time there is heavy activity recorded in apache log files which are automated hacking attmpts on servers using Microsoft IIS. Obviously, they get nowhere on apache servers but junk enetries get recorded in the logs. Perhaps such junk entries are what Analog is finding and denoting as corrupted Lines?


Posted By: unreviewed ()
Posted On: 2004-Oct-14 07:25

OAC is right. Certain hacking attempts can cause this. His advice to look in your logs will confirm this, and you'll clearly see the recorded result. However, your log file reader, in this case, Analog, will get confused at the non-standard server request recorded by your web page server.


Posted By: kilo ()
Posted On: 2004-Oct-14 13:49

I did a Error file output when I ran Analog on one of my log files and there seems to be two types of corrupted lines that keep showing on the Error file...

198.65.155.205 - - [02/Oct/2004:08:47:47 -0400] "GET /products/ " 400 147 <- - -

and

www.site.com - - [08/Oct/2004:23:51:43 -0400] "GET /users/getinfo.cgi?PASSWORD=pass&E_MAIL=email%40somewhere.com" 200 0 <- - -

any ideas as to why these lines are corrupted?