#914 HTTP 408 response is treated as 'corrupted'

7.1
open
nobody
None
1
2015-03-02
2013-10-15
Martijn
No

In some access logs, a lot of 408 status response codes are found, and AWStats handles them as 'corrupted log lines'. A typical logged 408 response looks like this:

host:80 1.2.3.4 - - [13/Oct/2013:06:29:03 +0200] "-" 408 0 "-" "-"

Note that where you would normally see "GET / HTTP/1.0" or similar, this requests is logged as "-" as no GET, POST or else was received from the client.

I think AWStats does recognise 408's where the client did get to send an actual request, but a timeout occured after that.

This has been reported several times before but those where closed because of old age (https://sourceforge.net/p/awstats/bugs/search/?q=408). A recent bugreport was submitted here: https://bugs.launchpad.net/ubuntu/+source/awstats/+bug/908901

Discussion

  • Ch'Ih-Yu
    Ch'Ih-Yu
    2014-12-08

    I can confirm that this problem is still around in version 7.3.

    Today, I got a lot of bot requests of the same type in my default_access.log which typically contains all the spam bot crap which comes in without a valid hostname so it won't go to one of the configured virtual hosts.

    Example:

    1.2.3.4 - - [08/Dec/2014:16:57:30 +0100] "-" 408 0 "-" "-"
    

    This caused a flood of emails sent every 10 minutes by the cron daemon because of AWStats exiting with an error code.

    There is no reason why those lines should be considered invalid. It's a perfectly valid log line. It just doesn't come with a HTTP request method simply because there was none.

    AWStats should be able to either parse them or skip them but it shouldn't fail because of them.

     
  • TheEscapist
    TheEscapist
    2015-03-02

    I'm experiencing the same problem today in my server. Awstats keeps failing and sending out emails because of HTTP408 errors.

    Isn't there a way to bypass this while waiting for a fix?