DA's error log, seeking explanation

[Rinseandrepeat]

Hi all,

I was just looking at my error log right now and noticed I got this line every 2-3 minutes on my DA error.log:

2010:08:25-20:37:39: Error reading from xx.xxx.xx.x:

The IP that was masked out, is not mine, nor the servers or anyone I know. What does the message "Error reading from" generally mean?

I traced the actual IP to be something 'rather obscure russian' if you know what I mean. So it got my attn. Any reason for my paranoia?

 

[B3rt]

error message in directadmin error log

In the error log of directadmin I keep getting the following repeating error:

2010:09:14-20:56:02: Error reading from 1.2.3.4:
2010:09:14-20:57:02: Error reading from 1.2.3.4:
2010:09:14-20:58:02: Error reading from 1.2.3.4:
etc
(i changed the ip address)
No other error messages are logged in the error.log

The IP address which is original listed is an known IP of us, it is a monitoring server. What I do not understand is what is the error exactly, because the server which is connecting does not give any error message at all.
The strange thing is that the IP listed is IP of the server but is not the IP the socket is created with, the socket is created from IP 1.2.3.5 but the error IP is 1.2.3.4
IP 1.2.3.5 is a virtual IP on server 1.2.3.4

Why is directadmin logging a reading error and how can I find out what is going wrong or how can I prevent writing this error in the log?
The error log file is growing quickly in size.....

 

[DirectAdmin Support]

Hello,

That means something was missing from the headers or the data being submitted, perhaps a syntax issue, or perhaps something is completely missing.
It's related to the actual http syntax, and not the actual API values.

I'd recommend running DA in debug mode to see what's being passed:
http://help.directadmin.com/item.php?id=293

John

 

[B3rt]

I did that, the debug code give no error but the error logs writes an error:

See output:

Sockets::handshake - begin
Sockets::handshake - end
/CMD_API_ADMIN_STATS
 0: Accept: */*
 1: Authorization: Basic YWRtXXXXXXXX1Nm5Sb0I=
 2: Connection: Close
 3: Host: 1.2.3.25:2222
 4: User-Agent: HTTPSocket/2.6
Command::doCommand(/CMD_API_ADMIN_STATS)
Command::doCommand(/CMD_API_ADMIN_STATS) : finished
Command::run: finished /CMD_API_ADMIN_STATS

Sockets::handshake - begin
Sockets::handshake - end
/CMD_API_LOAD_AVERAGE
 0: Accept: */*
 1: Authorization: Basic YWRtXXXXXXXX1Nm5Sb0I=
 2: Connection: Close
 3: Host: 1.2.3.25:2222
 4: User-Agent: HTTPSocket/2.6
Command::doCommand(/CMD_API_LOAD_AVERAGE)
Command::doCommand(/CMD_API_LOAD_AVERAGE) : finished
Command::run: finished /CMD_API_LOAD_AVERAGE

and simultaneously the error log writes:
2010:09:20-17:25:37: Error reading from 1.2.3.4:
(ip's are masked by me)

 

[DirectAdmin Support]

Hello,

The "Error reading from 1.2.3.4" means that DA wasn't able to parse the headers and aborted the process. Nothing would be run for that case. Once the "Command" class starts, that means it's already passed the checks so the logs being output are from a different connection.

In any case, I've just added more code to DA so there is more info in the logs as to why it's an error. There are several exit calls that return an error status, so I've added some text to each of them so we can see what exactly is missing.

You'll need to get these new binaries, so email us your OS version and I'll compile you a set.

John

 

[B3rt]

Can DA please change this in an update and remove writing a log entry completely of this connection?
Why should you log that "someone" connects to the port and does nothing?!

This way the log file can easily grow and cause diskspace problems.

The log should only write if something went wrong, not when only a connection is made and nothing is done (that was the case here), this way there is no possibility to check if the DA port is open or not.

Hope you can change this in a future update or add a config option so you can decide yourself if thsi should be logged or not.