RE: [users@httpd] entries in access_log not chronological

2011-04-29 Thread Lentes, Bernd
Jeffrey E Burgoyne wrote: > > > > > I think i've been the victim of a DOS, realised with a SYN > Flood. I'm > > not sure, but if yes, that's the first time. > > Currently i try to understand what happened. I have an entry in > > error_log which hit me on that idea: > > "[Sat Apr 23 15:19:02 2011]

RE: [users@httpd] entries in access_log not chronological

2011-04-28 Thread Lentes, Bernd
Jeffrey E Burgoyne wrote: > > > >> > >> Actually I think the behavior is the same, but the entry > >> in the logs > >> is different. I know in 1.3 it was chronological, which > >> leads me to > >> believe it was actually the finish time not the end time. > > > > Where is the difference between the

RE: [users@httpd] entries in access_log not chronological

2011-04-27 Thread Lentes, Bernd
Jeffrey E Burgoyne wrote: > > Actually I think the behavior is the same, but the entry in > the logs is different. I know in 1.3 it was chronological, > which leads me to believe it was actually the finish time not > the end time. Where is the difference between the finish time and the end time

RE: [users@httpd] entries in access_log not chronological

2011-04-27 Thread Jeffrey E Burgoyne
Actually I think the behavior is the same, but the entry in the logs is different. I know in 1.3 it was chronological, which leads me to believe it was actually the finish time not the end time. To be honest that was a few years ago, I remember the change but not the details. And yes you are corre

RE: [users@httpd] entries in access_log not chronological

2011-04-27 Thread Lentes, Bernd
Jeffrey E Burgoyne wrote: > > The time listed is the time the request was received and the > order is based on the time it finished is the most likely > culprit. Requests taking longer will cause this. > > You can verify by adding %T parameter to your logging as that > gives you the time it took

Re: [users@httpd] entries in access_log not chronological

2011-04-27 Thread Eric Covener
On Wed, Apr 27, 2011 at 11:13 AM, Lentes, Bernd wrote: > Hi, > > we have an Apache 1.3.27. Some entries in the access_log are not > chronological, e.g.: They're logged when they're complete, but the timestamp in the logfile is when the request was recevied. When they're out of order, it just me

[users@httpd] entries in access_log not chronological

2011-04-27 Thread Lentes, Bernd
Hi, we have an Apache 1.3.27. Some entries in the access_log are not chronological, e.g.: 146.107.x.x - - [23/Apr/2011:22:01:03 +0200] "GET / HTTP/1.0" 200 1456 146.107.x.x - - [23/Apr/2011:22:01:03 +0200] "GET / HTTP/1.0" 200 1456 146.107.x.x - - [23/Apr/2011:22:01:03 +0200] "GET / HTTP/1.0" 20