Go Back   HowtoForge Forums | HowtoForge - Linux Howtos and Tutorials > Linux Forums > Server Operation

Do you like HowtoForge? Please consider supporting us by becoming a subscriber.
Reply
 
Thread Tools Display Modes
  #1  
Old 26th March 2006, 15:48
edge edge is offline
Moderator
 
Join Date: Dec 2005
Location: The Netherlands
Posts: 2,042
Thanks: 269
Thanked 154 Times in 133 Posts
Default Fixing /var/log/httpd/error_log errors

I'm trying to fix some errors that I see in the /var/log/httpd/error_log file.

Some are easy fixes, and some are not (for me)

I have the following logs in the file (ip is mask):

Code:
cat: /proc/user_beancounters: No such file or directory
[Sun Mar 26 10:33:16 2006] [error] [client 81.169.xx.xx] client sent HTTP/1.1 request without hostname (see RFC2616 section 14.23): /w00tw00t.at.ISC.SANS.D$
[Sun Mar 26 14:42:42 2006] [error] [client 196.200.xx.xx] request failed: error reading the headers
Googling for both user_beancounter (whatever it is) and w00tw00t do not give me usable info on how to fix it, and what it is from!
(the w00tw00t does look suspicious)

Anyone here who might know, what it's for, and how to stop this filling my error_log file?

Last edited by edge; 26th March 2006 at 15:51.
Reply With Quote
Sponsored Links
  #2  
Old 26th March 2006, 22:01
falko falko is offline
Super Moderator
 
Join Date: Apr 2005
Location: Lüneburg, Germany
Posts: 41,701
Thanks: 1,900
Thanked 2,747 Times in 2,578 Posts
Default

w00tw00t looks like some kind of virus/trojan that tries to connect to your server, but doesn't send proper headers. So it's not a problem of your server.

I've never heard of /proc/user_beancounters...
__________________
Falko
--
Download the ISPConfig 3 Manual! | Check out the ISPConfig 3 Billing Module!

FB: http://www.facebook.com/howtoforge

nginx-Webhosting: Timme Hosting | Follow me on:
Reply With Quote
  #3  
Old 27th March 2006, 02:35
edge edge is offline
Moderator
 
Join Date: Dec 2005
Location: The Netherlands
Posts: 2,042
Thanks: 269
Thanked 154 Times in 133 Posts
Default

Quote:
Originally Posted by falko
w00tw00t looks like some kind of virus/trojan that tries to connect to your server, but doesn't send proper headers. So it's not a problem of your server.

I've never heard of /proc/user_beancounters...
Thanks for the answer falko.

I have no clue what is causing this cat: /proc/user_beancounters: No such file or directory log.

Does cat: mean someting? This so I can start looking from there..
Reply With Quote
  #4  
Old 27th March 2006, 15:29
falko falko is offline
Super Moderator
 
Join Date: Apr 2005
Location: Lüneburg, Germany
Posts: 41,701
Thanks: 1,900
Thanked 2,747 Times in 2,578 Posts
Default

Are you maybe using an OpenVZ virtual machine? http://www.howtoforge.com/forums/sho...r_beancounters
__________________
Falko
--
Download the ISPConfig 3 Manual! | Check out the ISPConfig 3 Billing Module!

FB: http://www.facebook.com/howtoforge

nginx-Webhosting: Timme Hosting | Follow me on:
Reply With Quote
  #5  
Old 27th March 2006, 19:37
edge edge is offline
Moderator
 
Join Date: Dec 2005
Location: The Netherlands
Posts: 2,042
Thanks: 269
Thanked 154 Times in 133 Posts
Default

Quote:
Originally Posted by falko
Are you maybe using an OpenVZ virtual machine? http://www.howtoforge.com/forums/sho...r_beancounters
No I'm not.. :-(

I'm now doing a grep user_beancounters (in a screen session).. lets wait and see

Last edited by edge; 27th March 2006 at 19:40.
Reply With Quote
  #6  
Old 28th March 2006, 12:04
falko falko is offline
Super Moderator
 
Join Date: Apr 2005
Location: Lüneburg, Germany
Posts: 41,701
Thanks: 1,900
Thanked 2,747 Times in 2,578 Posts
Default

But is it maybe a virtual server that you bought from an ISP? Maybe one powered by Virtuozzo?
__________________
Falko
--
Download the ISPConfig 3 Manual! | Check out the ISPConfig 3 Billing Module!

FB: http://www.facebook.com/howtoforge

nginx-Webhosting: Timme Hosting | Follow me on:
Reply With Quote
  #7  
Old 28th March 2006, 12:55
edge edge is offline
Moderator
 
Join Date: Dec 2005
Location: The Netherlands
Posts: 2,042
Thanks: 269
Thanked 154 Times in 133 Posts
Default

Quote:
Originally Posted by falko
But is it maybe a virtual server that you bought from an ISP? Maybe one powered by Virtuozzo?
It's my own server with Fedora RC4, Coldfusion, MRTG and ISPconfig on it..

Anyway.. grep user_beancounters has now been running for some hrs, but no result till now.

Is grep user_beancounters the correct syntax to search in any file for the text user_beancounters?
Reply With Quote
  #8  
Old 28th March 2006, 21:09
falko falko is offline
Super Moderator
 
Join Date: Apr 2005
Location: Lüneburg, Germany
Posts: 41,701
Thanks: 1,900
Thanked 2,747 Times in 2,578 Posts
Default

Instead of using grep, I'd run
Code:
updatedb
locate user_beancounters
__________________
Falko
--
Download the ISPConfig 3 Manual! | Check out the ISPConfig 3 Billing Module!

FB: http://www.facebook.com/howtoforge

nginx-Webhosting: Timme Hosting | Follow me on:
Reply With Quote
  #9  
Old 28th March 2006, 22:46
edge edge is offline
Moderator
 
Join Date: Dec 2005
Location: The Netherlands
Posts: 2,042
Thanks: 269
Thanked 154 Times in 133 Posts
Default

Quote:
Originally Posted by falko
Instead of using grep, I'd run
Code:
updatedb
locate user_beancounters
I've done that allready with no results.. So I thought, lets create the directory 'user_beancounters' in '/proc/'.. guess what.. I get this message:
Quote:
[root@host ~]# cd /proc
[root@host proc]# mkdir user_beancounters
mkdir: cannot create directory `user_beancounters': No such file or directory
This is the ls

Code:
[root@host proc]# ls
1      18446  2205  2246   2329   25908  303    4207         filesystems
10     18913  2206  2247   2338   25959  30538  4767         fs
10096  1892   2207  2248   2343   26276  30668  482          ide
10405  1900   2208  2249   23486  26362  30949  4852         interrupts
11     19151  2209  225    2353   26505  30993  486          iomem
1119   1960   2210  2250   2385   26542  30994  5            ioports
1137   1970   2211  2251   23860  2667   30996  507          irq
11556  1990   2212  2253   2393   2668   30997  539          kallsyms
11649  2      2213  2255   23954  26718  31     5518         kcore
12     20098  2214  2256   23959  26974  31001  6            keys
1285   20528  2215  2257   24036  27105  31002  6475         key-users
12881  20530  2216  2260   2412   27492  31007  6739         kmsg
12937  20765  2221  2261   24178  2766   31008  692          loadavg
13     2077   2222  2262   2421   27792  31033  7            locks
13025  20773  2223  2263   24246  2791   31035  7387         mdstat
13345  20819  2224  2264   24265  2798   31046  7391         meminfo
13495  20853  2225  2265   2436   28     31155  7968         misc
13553  20901  2226  2266   24394  2802   31450  7969         modules
13754  21036  2227  2267   2441   2803   31892  8            mounts
14     2106   2228  2268   2442   2804   31903  8094         mtrr
14290  21600  2229  2269   2443   2805   31913  8672         net
14848  21785  2230  2278   2445   2806   31921  9            partitions
14919  21836  2231  22971  2453   28479  31979  9479         pci
15     2191   2232  22972  2455   29     32     acpi         scsi
1542   2193   2233  2298   24572  29036  32001  buddyinfo    self
1544   2194   2234  23081  2459   29266  32006  bus          slabinfo
15648  2195   2235  23101  2460   29267  32009  cmdline      stat
15711  2196   2236  2311   2462   29587  32267  cpuinfo      swaps
1613   2197   2237  23162  24637  299    32435  crypto       sys
1626   2198   2238  23164  2465   3      32448  devices      sysrq-trigger
1656   2199   2239  23165  2466   30     3556   diskstats    sysvipc
1785   2200   2240  2318   2471   300    3792   dma          tty
1796   2201   2241  2319   24827  30080  391    dri          uptime
1825   2202   2242  2320   24887  301    4      driver       version
18300  2203   2244  2321   25477  302    4200   execdomains  vmstat
1833   2204   2245  2322   25562  3020   4206   fb           zoneinfo
As you can see.. NO user_beancounters ...

Whats going on???
Reply With Quote
  #10  
Old 29th March 2006, 10:36
edge edge is offline
Moderator
 
Join Date: Dec 2005
Location: The Netherlands
Posts: 2,042
Thanks: 269
Thanked 154 Times in 133 Posts
 
Default

Ok.. I found the problem that was causing the error in the log.

Some user had a .php page with a call to 'vpsstat' in it, and something with 'user_beancounters'.

I've killed the pages, and all is okay now.
Reply With Quote
Reply

Bookmarks

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
Several errors and ideas for features jmroth Feature Requests 16 6th March 2006 06:39
compile crashes with TK errors? isaac_golding Installation/Configuration 3 19th February 2006 10:48
ppp rx errors najohnston Installation/Configuration 9 10th January 2006 23:51
PHP Errors in the "WEB-FTP" module crudolphy General 9 27th December 2005 21:17
FC3 Perfect Installation Make Errors solderboy HOWTO-Related Questions 3 2nd October 2005 17:55


All times are GMT +2. The time now is 20:57.


Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2014, vBulletin Solutions, Inc.