Status code 200 then 403 then 200 then 403 ...

Something not showing in logs?

[guitaristinus]

How is it that Jeeves gets a 200 on one line then a 403 on the next?

65.214.36.187 - - [02/Nov/2004:07:26:52 -0500] "GET /mysite/page1.htm HTTP/1.0" 200 4188 "-" "Mozilla/2.0 (compatible; Ask Jeeves/Teoma)"
65.214.36.187 - - [02/Nov/2004:07:26:55 -0500] "GET /mysite/page2.htm HTTP/1.0" 403 216 "-" "Mozilla/2.0 (compatible; Ask Jeeves/Teoma)"

Does it have something to do with this recent addition to my .htaccess file?

RewriteCond ... [NC,OR]
RewriteCond %{HTTP_REFERER}<>%{HTTP_USER_AGENT} ^-<>¦<>-$
RewriteRule .* - [F]

Also ...

65.54.188.85 - - [02/Nov/2004:00:41:31 -0500] "GET /mysite/page5.htm HTTP/1.0" 200 3392 "-" "msnbot/0.3 (+http://search.msn.com/msnbot.htm)"

65.54.188.82 - - [02/Nov/2004:07:27:00 -0500] "GET /mysite/page3.htm HTTP/1.0" 403 217 "-" "msnbot/0.3 (+http://search.msn.com/msnbot.htm)"

65.54.188.82 - - [02/Nov/2004:07:46:00 -0500] "GET /mysite/page4.htm HTTP/1.0" 200 2550 "-" "msnbot/0.3 (+http://search.msn.com/msnbot.htm)"

[jdMorgan]

It's not likely that the rule you cite would work one time and then not work the next time, no matter what rule was there.

If you recall the previous discussion, Apache inserts a hyphen in the log file to indicate a truly-blank referrer. Some malicious user-agents use a literal hyphen as their user-agent or referrer string, but no known good 'bots do this. Your rule blocks accesses with a literal hyphen in either the user-agent or referrer field of the request; AJ and msnbot are not going to use a hyphen.

Do you have any other rules that forbid access based upon hostname, port number, remote_host, or any other parameter that is *not* shown in your log file format?

What (if anything) appears in your server error log for these rejected requests?

Jim

[guitaristinus]

Jim,

I do recall that discussion.

I've looked closer at my log and see that everything between the time of 7:26:55 and 7:28:16 got a 403. This includes links from pages within site and google and yahoo searches. Maybe I was messing with .htaccess file at time. Sure don't remember putting something in there that would deny everything and then taking it out. Not yesterday. But, maybe I did.

Thanks for the .htaccess line.

By the way, I don't deny any IP Address, port or remote host. I host at pair.com and can only see today's error log.