8 messages in ru.sysoev.nginxRe: previous questoin... maybe I'm gr...
FromSent OnAttachments
Ilan BerknerJan 15, 2009 12:05 pm 
Juan Fco. GiordanaJan 15, 2009 12:34 pm 
Ilan BerknerJan 15, 2009 12:45 pm 
Juan Fco. GiordanaJan 15, 2009 12:49 pm 
Ilan BerknerJan 15, 2009 12:59 pm 
Juan Fco. GiordanaJan 15, 2009 1:25 pm 
Dave CheneyJan 15, 2009 1:33 pm 
Gabriel RamugliaJan 15, 2009 1:52 pm 
Actions with this message:
Paste this link in email or IM:
Paste this link in email or IM:
Atom feed for this thread
Paste this URL into your reader:
Subject:Re: previous questoin... maybe I'm grabbing at straws...Actions...
From:Gabriel Ramuglia (ga@vtunnel.com)
Date:Jan 15, 2009 1:52:50 pm
List:ru.sysoev.nginx

Flash doesn't always send referring information. It's pretty hit or miss and depends on the browser being used, the alignment of the stars, etc. Bottom line, you might have referring information come from flash, but definitely DO NOT count on it.

On Thu, Jan 15, 2009 at 1:33 PM, Dave Cheney <da@cheney.net> wrote:

What does your access log say, you should be able to grep for 404's, which may give you the referrer.

You can always disable logging 404's as errors

server {

log_not_found off;

}

If you want to know more about the request, try ngrep

Cheers

On 16/01/2009, at 7:06 AM, Ilan Berkner wrote:

I previously posted a question about getting more information about an error that we're getting in our Nginx log files. The error is as follows:

2009/01/15 11:47:57 [error] 15704#0: *689561 open() "/home/spellcit/public_html/letters/.mp3" failed (2: No such file or directory), client: 204.38.160.220, server: www.spellingcity.com, request: "GET /letters/.mp3 HTTP/1.1", host: "www.spellingcity.com" What I'm trying to figure out is which php or swf script (or maybe its not a php or swf script) is actually making the call to request this non-existent file.

Out of 25,385 errors in our log, 16,952 are caused by this issue.

One of the suggestions I got was to turn on the access logs, which I did. In looking at this IP address at the access logs, this is what I get, which unfortunately is not much.

204.38.160.220 - - [15/Jan/2009:12:31:26 -0600] 404 "GET /letters/.mp3 HTTP/1.1" 169 "-" "Mozilla/5.0 (Macintosh; U; PPC; en-US; rv:1.0.2) Gecko/20030208 Netscape/7.02" "-"

I was thinking about creating a dummy ".mp3" file (or rewrite rule) to capture traffic and get try to get some more info out of the header... just a thought.

Any suggestions / thoughts would be very much appreciated.