Hello, This morning, root received an e-mail from the cron daemon as the following: -------------------------------- Subject: Cron <root> run-parts /etc/cron.daily /etc/cron.daily:00webalizer: Warning: Truncating oversized referrer field -------------------------------- I haven't changed anything to cron or to my intranet website (I'm assuming that's what the webalizer is about) in the last few days. I did do a reboot yesterday which was the first one in a few weeks. Does anybody know what this message is? Michael -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.centos.org/pipermail/centos/attachments/20070421/2438d71c/attachment-0004.html>
> > Hello, > > This morning, root received an e-mail from the cron daemon as > the following: > > -------------------------------- > Subject: Cron <root> run-parts /etc/cron.daily > > /etc/cron.daily:00webalizer: > > Warning: Truncating oversized referrer field > -------------------------------- > > I haven't changed anything to cron or to my intranet website > (I'm assuming that's what the webalizer is about) in the last > few days. > > I did do a reboot yesterday which was the first one in a few weeks. > > Does anybody know what this message is? > > Michael >This is indeed a webalizer issue and I'm wondering if this indicates a more serious problem or if this is just an error in log file format. It's getting an oversized referrer field. Looking at the output file of the webalizer, I have 4 referrers: - direct request - my intranet domain name - a php application domain name running on my intranet - (compatible It is this last line that is confusing the webalizer. It seems the webalizer thinks the text "(compatible" is a referrer. If I look into the input log file in /var/log/httpd/access-log, the text "(compatible" comes from the description of the User Agent, in this case: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1 4322; >NET CLR 2.0.502727; .NET CLR 3.0.04506.30) Is this error common? I found several discussions of this on the internet and one simply says to use the "very quiet" option. So should I not be worried or could this potentially be the sign of a more serious issue? Michael
On Apr 21, 2007, at 6:09 AM, Michael Velez wrote:> Hello, > > This morning, root received an e-mail from the cron daemon as the > following: > > -------------------------------- > Subject: Cron <root> run-parts /etc/cron.daily > > /etc/cron.daily:00webalizer: > > Warning: Truncating oversized referrer field > -------------------------------- > > I haven't changed anything to cron or to my intranet website (I'm > assuming that's what the webalizer is about) in the last few days. > > I did do a reboot yesterday which was the first one in a few weeks. > > Does anybody know what this message is? > > MichaelSome numbnuts is probing your web server. If you look through your access_logs you'll probably find a very long referrer URL. Webalizer is choking on it and truncating it, not a big deal. Tony Schreiner -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.centos.org/pipermail/centos/attachments/20070421/a6737f91/attachment-0004.html>