[Logwatch-Devel] http "unidentifed other" records

Jeffrey F jabetcha@cfl.rr.com
Wed, 12 Nov 2003 10:16:00 -0500


> From: Kenneth Porter <shiva@sewingwitch.com>
> 
> Ok. The odd thing is that viewcvs/index.cgi is the document, and 
> rest of the line is an argument to it. I'll have to look at that to 
> see how Apache knows where that split occurs. Does anyone have a 
> pointer to an explanation of how Apache parses that kind of URL?
> 

Unfortunately, the logic in the filter is designed to look for the end of the
line or a ? character. When calling the viewcvs.cgi script, the character
following the .cgi is a /

For the time being, if you want to disable logging of "other" items entirely,
decrease your detail level or comment out this line:

 if (!$isahack ) { $needs_exam{$field{request}} .= $field{http_rc}." "; }

> From: Kirk Bauer <kirk@kaybee.org>
>
> Well, in the http.conf you can specify your log format.  I wonder if 
> it is possible to have some auto-detect logic to catch like 99% of cases?
> 

This would definately require parsing the Apache's httpd.conf file. The output
from the "httpd -V" command will contain the default location of the
httpd.conf (SERVER_CONFIG_FILE="/etc/httpd/conf/httpd.conf"), but if the
server was started with the -f option, there is no easy way of determining
which config file is in use.

--Jeffrey