Apache dies and error

my access.log file occasionally lists an entry such as:
24.1.248.26 - - [12/Dec/2004:13:00:20 -0600] "SEARCH /\x90\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\. ....

Where the entry continues for MANY bytes. This causes my access.log file to grow big rapidly

Simultaneously, my error.log gets an entry:
[Sun Dec 12 13:00:20 2004] [error] [client 24.1.248.26] request failed: URI too long (longer than 8190)

I don't know if this Search is to blame or not but my Apache 2.0.52 installation stops working every few days. This is a very fresh log entry above and did not cause the server to die. Also, I just upgraded to 2.0.52 from 2.0(I think).

Any advice on either of these?

Thanks

I've done additional research on the SEARCH string and it seems to be fairly well known as the WebDAV attack. I've read that Apache's http server is not affected by this attack and that the major concern is the log entries. I've tried a couple of the suggestions seen but they didn't eliminate the log entries. I'm now doing manual removals.

Since the upgrade to 2.0.52, I've not experince any further server problems. In my prior post I was not as discriptive as I should have been. The server didn't actually die it just stopped "serving". Restarting the server using the monitor always fixed the issue. However, often, use of the "restart" button would not fix the issue but a "stop" and "start" would.

"Lynn Kenney" <Lynn-nospam-kenney@comcast.net> wrote in message news:oH0vd.488457$wV.306009@attbi_s54...
my access.log file occasionally lists an entry such as:
24.1.248.26 - - [12/Dec/2004:13:00:20 -0600] "SEARCH /\x90\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\. ....

Where the entry continues for MANY bytes. This causes my access.log file to grow big rapidly

Simultaneously, my error.log gets an entry:
[Sun Dec 12 13:00:20 2004] [error] [client 24.1.248.26] request failed: URI too long (longer than 8190)

I don't know if this Search is to blame or not but my Apache 2.0.52 installation stops working every few days. This is a very fresh log entry above and did not cause the server to die. Also, I just upgraded to 2.0.52 from 2.0(I think).

Any advice on either of these?

Thanks

I was hoping that my problems had been resolved by the update to the most current version of Apache's http server but no luck. I rebooted yesterday to install a CDROM and it appears that the server stopped functioning correctly. If I attempt to access it via a web browser (Foxfire), I receive a dialog box that simply says: "The connection was refused when attempting to contact ..." The access log reflects successful GETs until 02:53:19 so the server evidently started OK at boot time.

There are no log entries to reflect this activity. No errors. zip.

Any ideas? Any ideas at all on how I should proceed?

The error log has these entries from the reboot:

[Mon Jan 03 21:44:53 2005] [notice] Parent: Created child process 652
[Mon Jan 03 21:44:53 2005] [notice] Child 652: Child process is running
[Mon Jan 03 21:44:53 2005] [notice] Child 652: Acquired the start mutex.
[Mon Jan 03 21:44:53 2005] [notice] Child 652: Starting 250 worker threads.

I noticed in task manager that there is also an Apache process running with a PID of 496. This is reflected in the httpd.pid file.

remove the -nospam- from my email to reply.

Thanks
Lynn

"Lynn Kenney" <Lynn-nospam-kenney@comcast.net> wrote in message news:iPYwd.210036$5K2.1102@attbi_s03...
I've done additional research on the SEARCH string and it seems to be fairly well known as the WebDAV attack. I've read that Apache's http server is not affected by this attack and that the major concern is the log entries. I've tried a couple of the suggestions seen but they didn't eliminate the log entries. I'm now doing manual removals.

Since the upgrade to 2.0.52, I've not experince any further server problems. In my prior post I was not as discriptive as I should have been. The server didn't actually die it just stopped "serving". Restarting the server using the monitor always fixed the issue. However, often, use of the "restart" button would not fix the issue but a "stop" and "start" would.

"Lynn Kenney" <Lynn-nospam-kenney@comcast.net> wrote in message news:oH0vd.488457$wV.306009@attbi_s54...
my access.log file occasionally lists an entry such as:
24.1.248.26 - - [12/Dec/2004:13:00:20 -0600] "SEARCH /\x90\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\. ....

Where the entry continues for MANY bytes. This causes my access.log file to grow big rapidly

Simultaneously, my error.log gets an entry:
[Sun Dec 12 13:00:20 2004] [error] [client 24.1.248.26] request failed: URI too long (longer than 8190)

I don't know if this Search is to blame or not but my Apache 2.0.52 installation stops working every few days. This is a very fresh log entry above and did not cause the server to die. Also, I just upgraded to 2.0.52 from 2.0(I think).

Any advice on either of these?

Thanks

Still have this problem. Restarted today, twice. no luck. Stopped and started and it returned to operation.

It typically runs for 2 to 10 days before needing stopped and started. Sometimes restarts work.

Browser error is "Connection Refused". No server error.log or access.log entries.

I have not had one single reply to this issue and I have posted at least 4 times over a period of months. Surely someone can point me in the right direction.

Thanks

"Lynn Kenney" <Lynn-nospam-kenney@comcast.net> wrote in message news:oH0vd.488457$wV.306009@attbi_s54...
my access.log file occasionally lists an entry such as:
24.1.248.26 - - [12/Dec/2004:13:00:20 -0600] "SEARCH /\x90\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\. ....

Where the entry continues for MANY bytes. This causes my access.log file to grow big rapidly

Simultaneously, my error.log gets an entry:
[Sun Dec 12 13:00:20 2004] [error] [client 24.1.248.26] request failed: URI too long (longer than 8190)

I don't know if this Search is to blame or not but my Apache 2.0.52 installation stops working every few days. This is a very fresh log entry above and did not cause the server to die. Also, I just upgraded to 2.0.52 from 2.0(I think).

Any advice on either of these?

Thanks