Can't start Apache but no error log msg's.

I've just downloaded 2.0.5 and it seems to be running as a Windows Service
okay -- there are 2 apache.exe processes and the Monitor runs.

Trouble is http://localhost and http://127.0.0.1/ both give an HTTP 500
Internal server error.

There's nothing strange in the logs:
[Sat Jul 31 16:54:36 2004] [notice] Parent: Created child process 1816
[Sat Jul 31 16:54:36 2004] [notice] Child 1816: Child process is running
[Sat Jul 31 16:54:36 2004] [notice] Child 1816: Acquired the start
mutex.
[Sat Jul 31 16:54:37 2004] [notice] Child 1816: Starting 250 worker
threads.
[Sat Jul 31 17:07:21 2004] [error] [client 69.194.102.190] File does not
exist: C:/Program Files/Apache Group/Apache2/htdocs/scripts
-- but no recent msg's.

Can someone suggest a next step?

Thanks,
Peter.

win2K SP4

On 31 Jul 2004, "Peter Chatterton"
<ignoreThisPrefixPCHATTERTON@rogers.com> wrote in
news:2kUOc.1350261$Ar.1036668@twister01.bloor.is.n et.cable.rogers.com
> Can someone suggest a next step?

Is there anything in the System or Application logs? There are often
clues there that don't show up in the Apache logs.

http://69.194.176.43
-- shows my Apache doc page

http://66.185.84.81
-- supposedly my HTTP return addr
shows a 500.

Here are the windows logs.
I installed it at about 4:50 on 31/07.
And rebooted at 9:30

SYSTEM LOG
Type Date Time Source
Event
Information 31/07/2004 9:34:27 PM eventlog 6005
Information 31/07/2004 9:34:27 PM eventlog 6009
Information 31/07/2004 9:32:26 PM eventlog 6006
Error 31/07/2004 9:15:44 PM Dhcp 1000
Warning 31/07/2004 9:15:44 PM Dhcp 1003
Warning 31/07/2004 9:13:56 PM Dhcp 1006
Error 31/07/2004 12:12:46 AM Service Control Mgr 7031
Error 31/07/2004 12:09:16 AM Service Control Mgr 7031
Error 31/07/2004 12:06:44 AM Service Control Mgr 7031
Error 31/07/2004 12:06:19 AM Service Control Mgr 7031
Error 31/07/2004 12:04:01 AM Service Control Mgr 7031

APPL. LOG
Type Time Source
Category Event
Information 9:41:42 PM Ci CI Service
4137
Error 9:35:05 PM PerfNet None
2004
Information 9:34:54 PM Norton AntiVirus None 14
Information 9:34:44 PM WMDM PMSP Service None 105
Information 4:55:12 PM MsiInstaller None
11707
Information 6:34:17 AM SceCli None
1704
Information 12:10:30 AM Ci CI Service
4103


"Nil" <rednoise@REMOVETHIScomcast.net> wrote in message
news:Xns9537CBDA368CBnilch1@204.127.204.17...
> On 31 Jul 2004, "Peter Chatterton"
> <ignoreThisPrefixPCHATTERTON@rogers.com> wrote in
> news:2kUOc.1350261$Ar.1036668@twister01.bloor.is.n et.cable.rogers.com
> > Can someone suggest a next step?
>
> Is there anything in the System or Application logs? There are often
> clues there that don't show up in the Apache logs.

C:\Program Files\Apache Group\Apache2\bin>ping localhost
Pinging win2k [127.0.0.1] with 32 bytes of data:
Reply from 127.0.0.1: bytes=32 time<10ms TTL=128
Reply from 127.0.0.1: bytes=32 time<10ms TTL=128
Reply from 127.0.0.1: bytes=32 time<10ms TTL=128
Reply from 127.0.0.1: bytes=32 time<10ms TTL=128
Ping statistics for 127.0.0.1:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms

but
http://localhost/
in IE6 SP 1 gives
"HTTP 500 - Internal server error
Internet Explorer"

as does http://127.0.0.1/

I've run two other apaches and still can't get localhost.

Ideas anyone?

I'm using win2K SP 4 and IE 6 SP 1.

Thanks,
Peter.

I was concerned that my cable company might be blocking 80,
but running Apache enables it.

netstat -an shows:
TCP 0.0.0.0:80 0.0.0.0:0 LISTENING
only after running Apache.

Peter.

On 02 Aug 2004, "Peter Chatterton"
<ignoreThisPrefixPCHATTERTON@rogers.com> wrote in
news:jwsPc.1393148$Ar.780948@twister01.bloor.is.ne t.cable.rogers.com:

> I was concerned that my cable company might be blocking 80,
> but running Apache enables it.
>
> netstat -an shows:
> TCP 0.0.0.0:80 0.0.0.0:0 LISTENING
> only after running Apache.

I think nbstat would show this whether your ISP blocked the port or
not. The server is still listening, it's just that traffic from the
outside wouldn't reach it. Traffic from localhost should still get
there, I think.

Some thoughts - are you using a firewall? I've heard anecdotes about
Zone Alarm creating problems of this kind, even when it's configured
properly;

Try running on a different port than 80;

Check out your hosts file to make sure that localhost corresponds to
127.0.0.1;

What's the Listen line in your apache.conf? Mine is simply "Listen"
followed by the port number. I don't specify an IP address;

What's this line from your error log all about?

> [Sat Jul 31 17:07:21 2004] [error] [client 69.194.102.190] File does
> not exist: C:/Program Files/Apache Group/Apache2/htdocs/scripts

Is 69.194.102.190 your address? Why does this error happen 10 minutes
after the server starts? Are you trying to run a CGI script? Does the
specified directory exist?

Thanks for your reply, I've tried to answer below.

Peter.

----- Original Message -----
From: "Nil" <rednoise@REMOVETHIScomcast.net>
Newsgroups: comp.infosystems.www.servers.ms-windows
Sent: Monday, August 02, 2004 12:10 PM
Subject: Re: Update: Apache does enable 80


> On 02 Aug 2004, "Peter Chatterton"
> <ignoreThisPrefixPCHATTERTON@rogers.com> wrote in
> news:jwsPc.1393148$Ar.780948@twister01.bloor.is.ne t.cable.rogers.com:
>
> > I was concerned that my cable company might be blocking 80,
> > but running Apache enables it.
> >
> > netstat -an shows:
> > TCP 0.0.0.0:80 0.0.0.0:0 LISTENING
> > only after running Apache.
>
> I think nbstat would show this whether your ISP blocked the port or
> not. The server is still listening, it's just that traffic from the
> outside wouldn't reach it. Traffic from localhost should still get
> there, I think.
>
I talked to the cable company and they say they don't do blocking.
And they originally were able to detect my Apache, and didn't mind.
Now they can't see it.

> Some thoughts - are you using a firewall? I've heard anecdotes about
> Zone Alarm creating problems of this kind, even when it's configured
> properly;
>
There's no firewall.

> Try running on a different port than 80;
>
Do you mean the Listen line?
I tried 999 with the same results.

> Check out your hosts file to make sure that localhost corresponds to
> 127.0.0.1;
>
What file is that?

> What's the Listen line in your apache.conf? Mine is simply "Listen"
> followed by the port number. I don't specify an IP address;
>
It's Listen 80.

> What's this line from your error log all about?
>
> > [Sat Jul 31 17:07:21 2004] [error] [client 69.194.102.190] File does
> > not exist: C:/Program Files/Apache Group/Apache2/htdocs/scripts
>
That line, or similar, has showed up many times since.
That dir doesn't exist and I don't know about CGI.
The conf file is as it came, modified by the setup process,
but I only used the default replies.

> Is 69.194.102.190 your address? Why does this error happen 10 minutes
> after the server starts?
Are you trying to run a CGI script?
--no
Does the specified directory exist?
--no
>
http://69.194.102.190/ gives a 500
I don't know where that IP came from,
maybe this will help:

(* marks new lines with Apache)

C:\orant9i\Apache\Apache>netstat -an

Active Connections

Proto Local Address Foreign Address State
* TCP 0.0.0.0:80 0.0.0.0:0 LISTENING
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING
* TCP 0.0.0.0:443 0.0.0.0:0 LISTENING
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING
TCP 0.0.0.0:1025 0.0.0.0:0 LISTENING
TCP 0.0.0.0:1026 0.0.0.0:0 LISTENING
TCP 0.0.0.0:1741 0.0.0.0:0 LISTENING
* TCP 0.0.0.0:2930 0.0.0.0:0 LISTENING
TCP 0.0.0.0:3339 0.0.0.0:0 LISTENING
TCP 69.194.176.43:1741 66.185.95.104:119 ESTABLISHED
* TCP 127.0.0.1:8007 0.0.0.0:0 LISTENING
UDP 0.0.0.0:445 *:*
UDP 0.0.0.0:38037 *:*
UDP 69.194.176.43:500 *:*
UDP 127.0.0.1:1028 *:*
UDP 127.0.0.1:1035 *:*
UDP 127.0.0.1:1246 *:*

On Mon, 02 Aug 2004 16:10:58 GMT, Nil <rednoise@REMOVETHIScomcast.net>
wrote:
>
>What's this line from your error log all about?
>
>> [Sat Jul 31 17:07:21 2004] [error] [client 69.194.102.190] File does
>> not exist: C:/Program Files/Apache Group/Apache2/htdocs/scripts
>
>Is 69.194.102.190 your address? Why does this error happen 10 minutes
>after the server starts? Are you trying to run a CGI script? Does the
>specified directory exist?

I think that might be some kind of worm probe. IIS's cgi-bin-alike is
called "scripts" and past versions at least came with some stock
scripts which contained valnerabilities. The fact that this happened
at such an odd time makes this more likely; it's probably someone else
on the same ISP who "contracted" the worm and whose system is probing
the subnet looking for listening web servers to try to reproduce to.

However, this does suggest that the server is working! If that client
IP address is part of the original poster's ISP's broadcast subnet,
though, it's probably "behind" any firewall blocking incoming requests
on port 80.


(I get this kind of rubbish in my Apache logs all the time. There are
even more fun entries in the access log, which shows the full URL -- a
very long URL, since it is of course trying to overrun a memory
buffer.)


All the best,
-Claire

Thanks, that's very interesting indeed.

Here's the start of the access log and there is a very long
entry later on, tho it's mostly \xc9. It's a SEARCH cmd.

Peter.

69.194.102.190 - - [31/Jul/2004:17:07:21 -0400] "GET
/scripts/root.exe?/c+dir HTTP/1.0" 404 284
69.194.102.190 - - [31/Jul/2004:17:07:22 -0400] "GET /MSADC/root.exe?/c+dir
HTTP/1.0" 404 282
69.194.102.190 - - [31/Jul/2004:17:07:23 -0400] "GET
/c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 292
69.194.102.190 - - [31/Jul/2004:17:07:23 -0400] "GET
/d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 292
69.194.102.190 - - [31/Jul/2004:17:07:24 -0400] "GET
/scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 306
69.194.102.190 - - [31/Jul/2004:17:07:24 -0400] "GET
/_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 323
69.194.102.190 - - [31/Jul/2004:17:07:25 -0400] "GET
/_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 323
69.194.102.190 - - [31/Jul/2004:17:07:26 -0400] "GET
/msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/sy
stem32/cmd.exe?/c+dir HTTP/1.0" 404 339
69.194.102.190 - - [31/Jul/2004:17:07:26 -0400] "GET
/scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 305
69.194.102.190 - - [31/Jul/2004:17:07:27 -0400] "GET
/scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 305
69.194.102.190 - - [31/Jul/2004:17:07:27 -0400] "GET
/scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 305
69.194.102.190 - - [31/Jul/2004:17:07:28 -0400] "GET
/scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 305
69.194.102.190 - - [31/Jul/2004:17:07:29 -0400] "GET
/scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 296
69.194.102.190 - - [31/Jul/2004:17:07:29 -0400] "GET
/scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 296
69.194.102.190 - - [31/Jul/2004:17:07:30 -0400] "GET
/scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 306
69.194.102.190 - - [31/Jul/2004:17:07:31 -0400] "GET
/scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 306
66.185.84.70 - - [31/Jul/2004:20:47:22 -0400] "GET / HTTP/1.1" 200 1494
66.185.84.70 - - [31/Jul/2004:20:47:22 -0400] "GET /apache_pb.gif HTTP/1.1"
200 2326
69.194.167.142 - - [31/Jul/2004:21:52:06 -0400] "GET
/scripts/root.exe?/c+dir HTTP/1.0" 404 284
69.194.167.142 - - [31/Jul/2004:21:52:09 -0400] "GET /MSADC/root.exe?/c+dir


"Claire Tucker" <fake@invalid.invalid> wrote in message
news:8fvsg0d1ur0o6a26pv8j6044m9ue537mp6@4ax.com...
> On Mon, 02 Aug 2004 16:10:58 GMT, Nil <rednoise@REMOVETHIScomcast.net>
> wrote:
> >
> >What's this line from your error log all about?
> >
> >> [Sat Jul 31 17:07:21 2004] [error] [client 69.194.102.190] File does
> >> not exist: C:/Program Files/Apache Group/Apache2/htdocs/scripts
> >
> >Is 69.194.102.190 your address? Why does this error happen 10 minutes
> >after the server starts? Are you trying to run a CGI script? Does the
> >specified directory exist?
>
> I think that might be some kind of worm probe. IIS's cgi-bin-alike is
> called "scripts" and past versions at least came with some stock
> scripts which contained valnerabilities. The fact that this happened
> at such an odd time makes this more likely; it's probably someone else
> on the same ISP who "contracted" the worm and whose system is probing
> the subnet looking for listening web servers to try to reproduce to.
>
> However, this does suggest that the server is working! If that client
> IP address is part of the original poster's ISP's broadcast subnet,
> though, it's probably "behind" any firewall blocking incoming requests
> on port 80.
>
>
> (I get this kind of rubbish in my Apache logs all the time. There are
> even more fun entries in the access log, which shows the full URL -- a
> very long URL, since it is of course trying to overrun a memory
> buffer.)
>
>
> All the best,
> -Claire