Access Log Entry

Understanding Access Log activity

[cormacodonnell]

Hi,

I recently started logging access to one of my websites and have been reviewing the access logs. The following is a snippet of the requests and show a repeating pattern. Sometines this pattern is repeated for hours on end. the url it requests returns an image ( the request is actually to a servlet which pulls the image from the DB) Does anyone have any suggestions as to help identify further this request and why it is happening?

Thanks in advance

81.158.163.165 - - [14/Nov/2007:03:15:38 +0000] "GET /image?tn=Sponsors&key=ImageID&colname=Image&keyval=105 HTTP/1.1" 200 2132
81.158.163.165 - - [14/Nov/2007:03:15:41 +0000] "GET /image?tn=Sponsors&key=ImageID&colname=Image&keyval=118 HTTP/1.1" 200 1816
81.158.163.165 - - [14/Nov/2007:03:15:44 +0000] "GET /image?tn=Sponsors&key=ImageID&colname=Image&keyval=105 HTTP/1.1" 200 2132
81.158.163.165 - - [14/Nov/2007:03:15:47 +0000] "GET /image?tn=Sponsors&key=ImageID&colname=Image&keyval=118 HTTP/1.1" 200 1816
81.158.163.165 - - [14/Nov/2007:03:15:50 +0000] "GET /image?tn=Sponsors&key=ImageID&colname=Image&keyval=105 HTTP/1.1" 200 2132
81.158.163.165 - - [14/Nov/2007:03:15:53 +0000] "GET /image?tn=Sponsors&key=ImageID&colname=Image&keyval=118 HTTP/1.1" 200 1816
81.158.163.165 - - [14/Nov/2007:03:15:56 +0000] "GET /image?tn=Sponsors&key=ImageID&colname=Image&keyval=105 HTTP/1.1" 200 2132
81.158.163.165 - - [14/Nov/2007:03:15:59 +0000] "GET /image?tn=Sponsors&key=ImageID&colname=Image&keyval=118 HTTP/1.1" 200 1816
81.158.163.165 - - [14/Nov/2007:03:16:02 +0000] "GET /image?tn=Sponsors&key=ImageID&colname=Image&keyval=105 HTTP/1.1" 200 2132
81.158.163.165 - - [14/Nov/2007:03:16:05 +0000] "GET /image?tn=Sponsors&key=ImageID&colname=Image&keyval=118 HTTP/1.1" 200 1816
81.158.163.165 - - [14/Nov/2007:03:16:08 +0000] "GET /image?tn=Sponsors&key=ImageID&colname=Image&keyval=105 HTTP/1.1" 200 2132
81.158.163.165 - - [14/Nov/2007:03:16:11 +0000] "GET /image?tn=Sponsors&key=ImageID&colname=Image&keyval=118 HTTP/1.1" 200 1816

[phranque]

you are using the common log file format.
you should use either the combined format or a custom format which would give you at least referrer and user agent information and it might also be helpful to log the ip addresses.

[cormacodonnell]

Hi Phranque,

The pattern i am logging is "%t %H cookie:%{SESSIONID}c request:%{SESSIONID}r %m %U %s %q %r". The ip address is listed in the log - "81.158.163.165". i will put the combined pattern in place for a while and see what i get back. With the IP address being the same and the requests every 3 seconds, do you have any thoughts as to what it might be?

Cheers

Cormac

[phranque]

i will put the combined pattern in place

or add the following to your format:

\"%{Referer}i\" \"%{User-agent}i\

The ip address is listed in the log

yeah i'm not sure what i was thinking when i wrote that!

my first guess would be that an image scraper is mining your site.
pretty easy to fix if it's always the same ip address.

[phranque]

and welcome to WebmasterWorld [webmasterworld.com], cormac!