Old topic,. but I'm having the same problem:
# httpd -v
Server version: Apache/2.0.64
Server built: Mar 24 2011 01:00:19
The server is going through what we believe is DoS attack and we wanted to explore the log files.
To my surprise, I see the logs are showing:
server.mydomain.com:/var/log/httpd/domains # less somedomain.com.log
combined
combined
combined
combined
combined
combined
combined
There are no line details.
The error logs are more detailed:
server.mydomain.com:/var/log/httpd/domains # less somedomain.com.error.log
[Mon Dec 12 00:28:41 2011] [error] [client 85.10.204.194] Premature end of script headers: index.php
[Mon Dec 12 00:28:51 2011] [error] [client 84.108.103.209] Premature end of script headers: index.php, referer:
http://www.somedomain.com/מקצוע/בעיות-מדידה-א
[Mon Dec 12 00:28:53 2011] [error] [client 66.249.71.76] Premature end of script headers: index.php
[Mon Dec 12 00:28:56 2011] [error] [client 109.64.219.121] Premature end of script headers: index.php
[Mon Dec 12 00:28:59 2011] [error] [client 84.108.103.209] Premature end of script headers: index.php, referer:
http://www.somedomain.com/ruppin?tid_1=All&studyfield=376&yearstudy=All&semester=All&profession=
[Mon Dec 12 00:29:12 2011] [error] [client 84.108.103.209] Premature end of script headers: index.php, referer:
http://www.somedomain.com/ruppin?tid_1=All&studyfield=376&yearstudy=All&semester=All&profession=
[Mon Dec 12 00:29:24 2011] [error] [client 65.52.109.199] Premature end of script headers: index.php
[Mon Dec 12 00:29:59 2011] [error] [client 109.64.219.121] Premature end of script headers: index.php
[Mon Dec 12 00:30:21 2011] [error] [client 84.108.103.209] Premature end of script headers: index.php, referer:
http://www.somedomain.com
and the same goes for the bytes:
server.mydomain.com:/var/log/httpd/domains # less somedomain.com.bytes
bytes
bytes
bytes
bytes
bytes
How do I make the log files show details?
I looked at the templates as suggested above:
/usr/local/directadmin/data/templates/custom # grep combine *
virtual_host2.conf: CustomLog /var/log/httpd/domains/|DOMAIN|.log combined
virtual_host2_secure.conf: CustomLog /var/log/httpd/domains/|DOMAIN|.log combined
virtual_host2_secure_sub.conf: CustomLog /var/log/httpd/domains/|DOMAIN|.|SUB|.log combined
virtual_host2_sub.conf: CustomLog /var/log/httpd/domains/|DOMAIN|.|SUB|.log combined
virtual_host.conf: CustomLog /var/log/httpd/domains/|DOMAIN|.log combined
virtual_host_secure.conf: CustomLog /var/log/httpd/domains/|DOMAIN|.log combined
virtual_host_secure_sub.conf: CustomLog /var/log/httpd/domains/|DOMAIN|.|SUB|.log combined
virtual_host_sub.conf: CustomLog /var/log/httpd/domains/|DOMAIN|.|SUB|.log combined
And also here:
/usr/local/directadmin/data/templates # grep combine *
httpd.conf:LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
httpd.conf:CustomLog logs/access_log combined
httpd.conf:# If the key is not combined with the certificate, use this
virtual_host2.conf: CustomLog /var/log/httpd/domains/|DOMAIN|.log combined
virtual_host2_secure.conf: CustomLog /var/log/httpd/domains/|DOMAIN|.log combined
virtual_host2_secure_sub.conf: CustomLog /var/log/httpd/domains/|DOMAIN|.|SUB|.log combined
virtual_host2_sub.conf: CustomLog /var/log/httpd/domains/|DOMAIN|.|SUB|.log combined
virtual_host.conf: CustomLog /var/log/httpd/domains/|DOMAIN|.log combined
virtual_host_secure.conf: CustomLog /var/log/httpd/domains/|DOMAIN|.log combined
virtual_host_secure_sub.conf: CustomLog /var/log/httpd/domains/|DOMAIN|.|SUB|.log combined
virtual_host_sub.conf: CustomLog /var/log/httpd/domains/|DOMAIN|.|SUB|.log combined
Any pointers?
-Sup.
