Advertisement
I’ve just noticed that at 20:27 (australian eastern standard time UTC+11) each day I get the following in my logs. x.x.x.x is the server ip address. when i look in my old logs it starts on the first of nov, 2018, which may have been when I set it up<\/p>\n
Is there something that runs each day in apache at the same time?<\/p>\n
regards<\/p>\n
andrew<\/p>\n
x.x.x.x - - [17/Jan/2024:20:27:04 +1100] “\\n” 400 226
\nx.x.x.x - - [18/Jan/2024:20:27:05 +1100] “\\n” 400 226
\nx.x.x.x - - [19/Jan/2024:20:27:05 +1100] “\\n” 400 226
\nx.x.x.x - - [20/Jan/2024:20:27:05 +1100] “\\n” 400 226
\nx.x.x.x - - [21/Jan/2024:20:27:04 +1100] “\\n” 400 226
\nx.x.x.x - - [22/Jan/2024:20:27:05 +1100] “\\n” 400 226
\nx.x.x.x - - [23/Jan/2024:20:27:04 +1100] “\\n” 400 226
\nx.x.x.x - - [24/Jan/2024:20:27:05 +1100] “\\n” 400 226
\nx.x.x.x - - [25/Jan/2024:20:27:04 +1100] “\\n” 400 226<\/p>","upvoteCount":3,"answerCount":3,"datePublished":"2024-01-25T09:21:50.000Z","author":{"@type":"Person","name":"andrewperry3","url":"https://community.spiceworks.com/u/andrewperry3"},"suggestedAnswer":[{"@type":"Answer","text":"
I’ve just noticed that at 20:27 (australian eastern standard time UTC+11) each day I get the following in my logs. x.x.x.x is the server ip address. when i look in my old logs it starts on the first of nov, 2018, which may have been when I set it up<\/p>\n
Is there something that runs each day in apache at the same time?<\/p>\n
regards<\/p>\n
andrew<\/p>\n
x.x.x.x - - [17/Jan/2024:20:27:04 +1100] “\\n” 400 226
\nx.x.x.x - - [18/Jan/2024:20:27:05 +1100] “\\n” 400 226
\nx.x.x.x - - [19/Jan/2024:20:27:05 +1100] “\\n” 400 226
\nx.x.x.x - - [20/Jan/2024:20:27:05 +1100] “\\n” 400 226
\nx.x.x.x - - [21/Jan/2024:20:27:04 +1100] “\\n” 400 226
\nx.x.x.x - - [22/Jan/2024:20:27:05 +1100] “\\n” 400 226
\nx.x.x.x - - [23/Jan/2024:20:27:04 +1100] “\\n” 400 226
\nx.x.x.x - - [24/Jan/2024:20:27:05 +1100] “\\n” 400 226
\nx.x.x.x - - [25/Jan/2024:20:27:04 +1100] “\\n” 400 226<\/p>","upvoteCount":3,"datePublished":"2024-01-25T09:21:50.000Z","url":"https://community.spiceworks.com/t/apache-log-shows-n-400-226-once-a-day-every-day/965894/1","author":{"@type":"Person","name":"andrewperry3","url":"https://community.spiceworks.com/u/andrewperry3"}},{"@type":"Answer","text":"
Something client side is sending a malformed request on your server (400 is bad client request)<\/p>\n
\\n is just a newline feed.
\nIf the ip is yours it’s something to do with your configuration or a script somewhere<\/p>\n
If it’s an external ip, someone may be just submitting a new line to prod and poke your server (I’ve seen services like shodan do this in the past but I can’t attest to any specific purpose)<\/p>","upvoteCount":0,"datePublished":"2024-01-26T16:03:33.000Z","url":"https://community.spiceworks.com/t/apache-log-shows-n-400-226-once-a-day-every-day/965894/2","author":{"@type":"Person","name":"jayya","url":"https://community.spiceworks.com/u/jayya"}},{"@type":"Answer","text":"
heh found it. getssl…<\/p>","upvoteCount":0,"datePublished":"2024-01-27T08:27:45.000Z","url":"https://community.spiceworks.com/t/apache-log-shows-n-400-226-once-a-day-every-day/965894/3","author":{"@type":"Person","name":"andrewperry3","url":"https://community.spiceworks.com/u/andrewperry3"}}]}}