Hey Everyone,

I posted this in the general forum, but haven't gotten any replies, and now see that this area is probably a more appropriate one.

If anyone is familiar with running Livestats with Apache, your help would be greatly appreciated. We are running Livestats with the Apache log file templates, but we are getting false information every once and a while. On certain days, the bandwidth usage indicates either 4, 8, or 16 gigs of usage in the "Other" category.

We have compared the log file layout to the templates, and they seem to be correct. We have also parsed the apache log files using a vb program, and the actual usage is around 80 megs/day TOTAL. (basically, there is no information in the logs that would indicated a gig of usage).

Thanks in advance,
Chris

If anyone is interested, we solved the problem.

As a result of a hacker, if the line:
209.205.207.76 - - [01/Apr/2002:17:50:04 -0500] "GET /scripts/..%255c%255c../winnt/system32/cmd.exe?/c+dir" 404 - "-" "-"

shows up in the log file, Livestats will indicate a 4gig exe transfer.

If the line is changed to:

209.205.207.76 - - [01/Apr/2002:17:50:04 -0500] "GET /scripts/..%255c%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.1" 404 - "-" "-"

it works fine (note the missing client protocol in the first line).

...for future reference.

cbs