LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - General
User Name
Password
Linux - General This Linux forum is for general Linux questions and discussion.
If it is Linux Related and doesn't seem to fit in any other forum then this is the place.

Notices


Reply
  Search this Thread
Old 08-09-2013, 07:56 AM   #1
devUnix
Member
 
Registered: Oct 2010
Posts: 606

Rep: Reputation: 59
Checking httpd or apache logs for files upload status


I have got a ticket and the reporter wants to know if a file upload / submission on the website was successful or not after a maintenance window closed at 8 Aug 2013 16:30 EDT. They uploaded the file at 16:36.

I got these lines from the httpd's access_log file:

Code:
# grep '^168.10.0.10.' /var/log/httpd/access_log | fgrep '[08/Aug/2013:16:' | grep upload
168.10.0.10.205 - - [08/Aug/2013:16:30:05 -0400] "POST /upload.jsp HTTP/1.1" 200 15115 "-" "-"
168.10.0.10.205 - - [08/Aug/2013:16:34:02 -0400] "POST /upload.jsp HTTP/1.1" 200 8184 "-" "curl/7.15.5 (x86_64-redhat-linux-gnu) libcurl/7.15.5 OpenSSL/0.9.8b zlib/1.2.3 libidn/0.6.5"
168.10.0.10.205 - - [08/Aug/2013:16:36:32 -0400] "POST /upload.jsp HTTP/1.1" 200 853 "-" "-"
[root@www002 httpd]#
In the second line what does the log in bold mean?

Why is the same filed blank "_" in the next line? it reports the time when the file submission was done.

What do the values after the HTTP status codes mean: 200 853 as shown above?

The file error_log has not been updated since Aug 6 12:25 so I do not think I can find anything in there.

Is this phrase okay:

Code:
... HTTP/1.1" 200 15115 "-" "-"
I mean, "-" and "-" are not having any text. What information those fields could be missing?
 
Old 08-09-2013, 05:35 PM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600
Quote:
Originally Posted by devUnix View Post
I have got a ticket and the reporter wants to know if a file upload / submission on the website was successful or not after a maintenance window closed at 8 Aug 2013 16:30 EDT. They uploaded the file at 16:36.
Then check the hash of the original and the uploaded file?


Quote:
Originally Posted by devUnix View Post
In the second line what does the log in bold mean?
It's the User Agent.


Quote:
Originally Posted by devUnix View Post
Why is the same filed blank "_" in the next line? it reports the time when the file submission was done.
No idea because I don't know the configuration. Look at what log formatting identifiers the web server uses by default.


Quote:
Originally Posted by devUnix View Post
What do the values after the HTTP status codes mean: 200 853 as shown above?
First value is Return code, next is data sent back to client in bytes.


Quote:
Originally Posted by devUnix View Post
Is this phrase okay:
Code:
... HTTP/1.1" 200 15115 "-" "-"
I mean, "-" and "-" are not having any text. What information those fields could be missing?
No idea if anything is actually missing. CLF / NCSA logging format says it's the referrer and user agent fields.
 
1 members found this post helpful.
Old 08-10-2013, 12:53 AM   #3
David Trest
Member
 
Registered: Jul 2013
Distribution: CentOS/RHEL, Backtrack, many more.
Posts: 58

Rep: Reputation: Disabled
Quote:
No idea because I don't know the configuration. Look at what log formatting identifiers the web server uses by default.
To expand upon that, open your httpd.conf and look for the LogFormat directive. You can compare what's in there to online help docs for Apache to see what each value is.
 
1 members found this post helpful.
Old 08-11-2013, 11:22 PM   #4
SAbhi
Member
 
Registered: Aug 2009
Location: Bangaluru, India
Distribution: CentOS 6.5, SuSE SLED/ SLES 10.2 SP2 /11.2, Fedora 11/16
Posts: 665

Rep: Reputation: Disabled
well looking at the logs one can only say the page fetched successfully, that doesnt means the file was uploaded. (Edited: After David: to depict the correct meaning):

Quote:
168.10.0.10.205 - - [08/Aug/2013:16:30:05 -0400] "POST /upload.jsp HTTP/1.1" 200 15115 "-" "-"
168.10.0.10.205 - - [08/Aug/2013:16:34:02 -0400] "POST /upload.jsp HTTP/1.1" 200 8184 "-" "curl/7.15.5 (x86_64-redhat-linux-gnu) libcurl/7.15.5 OpenSSL/0.9.8b zlib/1.2.3 libidn/0.6.5"
168.10.0.10.205 - - [08/Aug/2013:16:36:32 -0400] "POST /upload.jsp HTTP/1.1" 200 853 "-" "-"
see below is the description:

Code:
            16:36:32  :        when they uploaded the data      
            /upload.js:        the accessed page
            HTTP/1.1  :        the header posted using the protocol HTTP to get the response
                 200  :        "OK" response received which means the page was fetched successfully.
                8184  :        Size of the whatever is posted back.
                "-"   :        ('-' means the requested info ins not available) the first one looking for the site from where the clients reports are referring. the second one is looking for the information that client browser report about itself.
to check whether the file was uploaded correctly refer to what UnSpawn said.

Last edited by SAbhi; 08-11-2013 at 11:44 PM.
 
1 members found this post helpful.
Old 08-11-2013, 11:24 PM   #5
David Trest
Member
 
Registered: Jul 2013
Distribution: CentOS/RHEL, Backtrack, many more.
Posts: 58

Rep: Reputation: Disabled
Wrong, it just means a post attempt was made. Not that the data was sent in its entirety and successfully.
 
1 members found this post helpful.
Old 08-11-2013, 11:27 PM   #6
SAbhi
Member
 
Registered: Aug 2009
Location: Bangaluru, India
Distribution: CentOS 6.5, SuSE SLED/ SLES 10.2 SP2 /11.2, Fedora 11/16
Posts: 665

Rep: Reputation: Disabled
Not wrong but i just corrected it.
 
Old 08-11-2013, 11:33 PM   #7
David Trest
Member
 
Registered: Jul 2013
Distribution: CentOS/RHEL, Backtrack, many more.
Posts: 58

Rep: Reputation: Disabled
It is still wrong.

If the file had uploaded completely and successfully, then it is a successful transaction in the broad sense.

If the file had only partially uploaded, then it is only a successful transaction as far as Apache is concerned. It does not mean that it truly is a successful transaction since the intended operation was not completed.

If you put your key into the ignition on your car and turn it, do you consider your car started? Probably not, you wouldn't consider it started until the engine turned over and was idling. Same thing here, just because Apache reports a successful status doesn't mean the operation was actually successful.
 
1 members found this post helpful.
Old 08-11-2013, 11:39 PM   #8
SAbhi
Member
 
Registered: Aug 2009
Location: Bangaluru, India
Distribution: CentOS 6.5, SuSE SLED/ SLES 10.2 SP2 /11.2, Fedora 11/16
Posts: 665

Rep: Reputation: Disabled
i think you are getting me wrong.

what does a 200 status code means : it says the page you were trying to access was successfully fetched, all i meant by the first line is this only.
while you are referring to file uploaded everytime. Please see the last line i suggested to check for the successful upload.
Quote:
Apache reports a successful status doesn't mean the operation was actually successful.
I did'nt said the operation as successful, i only referred to the page being accessed successfully, Note that doesnt means the file was uploaded.
 
1 members found this post helpful.
Old 08-13-2013, 01:03 AM   #9
devUnix
Member
 
Registered: Oct 2010
Posts: 606

Original Poster
Rep: Reputation: 59
Thanks to all of you! Thanks SABHI for the detailed explanation of the log.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] HTTP Status 404 When try to connect tomcat from apache httpd sharonsreedh Linux - Newbie 2 06-20-2012 09:24 AM
apache logs files can't be opened? benrose111488 Linux - Software 14 06-26-2007 12:54 PM
service httpd status, results in httpd dead but subsys locked squadja Red Hat 2 09-11-2004 10:31 PM
Apache piped logs - split-logfile - zero size files alex_fittyfives Linux - Enterprise 0 08-26-2004 07:04 AM
how to upload files to apache folder? alexii86 Linux - Newbie 4 10-06-2003 02:05 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - General

All times are GMT -5. The time now is 01:06 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration