Weird web server access log entries

Don’t have the answer to this yet, but it sure makes me really really curious as to the cause.

In my web server access logs, I get plenty of entries that look like this:
69.64.58.126 - - [02/Oct/2009:14:20:55 +0800] "-" 400 0 "-" "-"

That means that these IP addresses have been connecting to my server via a particular domain, without sending any request whatsoever or so it seems. And I get a LOT of accesses from Singnet IP addresses (220.255.0.0/16 range) daily.

Have contacted them on this, but no answers as yet. And the only answer from a forum was that it’s probably load balancer generated traffic (doesn’t explain why I get many many requests from an entire Class C worth of IP addresses).

Not sure whether it was this thing that caused my 1Portfolio account to overuse server resources, since Apache is known to fork a new process for every new incoming connection, as opposed to web servers like Nginx. (And I’m still pissed at how they did NOT contact me whatsoever when they had to terminate my account immediately due to the resource overuse)

If anyone has answers/possibilities I’d sure like to hear and discuss on them!

Advertisements

3 thoughts on “Weird web server access log entries”

  1. Hi — I came here from your StackOverflow question on this topic. I too have an Nginx reverse proxy with access logs showing lots of records like this. Mine are not against any particular domain — in fact the logs suggest these failed connections only happen when no domain is specified. My own workstation seems to have generated many of them. They don’t seem to be causing any problem for me, but I sure am curious to know what’s going on. Did you ever find out?

    1. Hi Wilo, yes I did find out (after reading around quite a bit) what was causing such access log entries.

      Such access log entries mostly appear due to browsers trying to speed up web browsing by initiating/maintaining a connection to the web server in question for a certain time period even when there is no clicking going on. It would occur roughly around the time frame where there was browser activity to the/your site.

      This was such an old post! Could you link to my SO question post here? I’m curious 🙂

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s