Web Hosting Talk : Web Hosting Main Forums : Hosting Software and Control Panels : (no entry) in Urchin User Number of Sessions

[babettezz]

I have a password protected directory that shows over 2000 entries of (no entry) under the User Name category in one week.

That user is listed as (no entry).

A paranoid person might think that over 2000 sessions are coming into my protected directory with no user name. There's also 5+ gig of downloads with the (no entry) username. I thought maybe this represents my ftp activity into my protected directory but the amount of downloads and especially the number of sessions do not come close to my ftp activity.

Oh please tell me why I have 2000+ sessions of (no entry) into my protected directory??

Thanks In Advance

[activelobby4u]

Did you check the logs for the Ip to both apache and ftp sessions ?

[babettezz]

Is the log you mean? Here's Gate.com's description:
The referrer log or file stores information about visitors from other websites to your website. The information contains data about the URL's that your website visitors came from. The referrer log enables a web analytics software program called Analog to convert IP addresses to real domain names. By default, Analog will only display the IP addresses of your visitors. If you prefer to see their domain names, then please order the referrer log. Customers who order Urchin need not separately order referrer logs as it is part of the Urchin package

[babettezz]

when I click on IP Addresses under Domains and Users I get this:
1. 67.195.114.38 99 3.56% [Data Over Time: 67.195.114.38]
2. 66.249.71.108 42 1.51% [Data Over Time: 66.249.71.108]
3. 77.88.24.28 39 1.40% [Data Over Time: 77.88.24.28]
4. 76.22.66.217 35 1.26%

When I click on an IP I go to a WhoIs type of page that starts like:
[Querying whois.arin.net]
[whois.arin.net]
#
# Query terms are ambiguous. The query is assumed to be:
# "n 67.195.114.38"

Is this the log you mean?

Thanks Again

[activelobby4u]

what does 99 and 3.56% indicate ?.

I wasnt looking at these logs, but in the apache access_logs and /var/log/secure log files

[babettezz]

re: 67.195.114.38 99 3.56%

During that period 99 sessions were initiated by 67.195.114.38 99 and that is 3.56% of the total sessions. It doesn't tell me what user that is.

Do I need something like pennywize to get at the info I want?

[squirrelhost]

first IP is yahoo
2nd is google
3rd is yandex
last is on comcast's network

presumably you've a link to something they're simply trying to follow

[babettezz]

I don't have that var directory but I do have, (when I look at ftp) a directory called .log/log and in the log folder I have some text files and some files that look like 20100722.log.gz

Is this the place to look?

Thanks

[babettezz]

Hello again. Re Squirrel's response Yahoo, Google, Yandex as my top 3 IP's. Does this indicate that because they are entering without a username, like yahoo, google etc, that they are passing through my protected directory without a userid?

ie my valid users leave a username in the stats when they enter and all these other sessions leave the (no entry) stat as the user. Does this mean they've hacked their way in or that they just had a protected link bookmarked, say from yahoo, and the stats only see that they came in via a bookmark and recorded only where they came from ie yahoo and missed the fact that they had to then put in a username?

Thanks Again

[Kalriath]

It's possible - nay, probable - that you do not have username logging turned on. If you look at the first (data) line of a log file for that directory, does it have the username of the user in it?

Also, have you checked the Error Codes report to see if maybe those are all 403 forbidden requests?

[babettezz]

I don't see an error log in Urchin Stats. Here's what I see ... am I looking in the wrong place? Here's my Urchin Options:

Traffic

Sessions Graph
Pageviews Graph
Hits Graph
Bytes Graph
Summary
Load Balancing
Log Source by Hits
Log Source by Bytes

Pages & Files

Requested Pages
Downloads
Page Query Terms
Posted Forms
Status and Errors
All Files
All Files by Hits
All Files by Bytes
Directory Drilldown
Directory by Pages Drilldown
Directory by Files Drilldown
Directory by Bytes Drilldown
File Types
File Types by Hits
File Types by Bytes

Navigation

Entrance Pages
Exit Pages
Bounce Rate
Click Paths
Click To and From
Length of Pageview
Depth of Session
Length of Session

Referrals

Referrals
Referral Drilldown
Search Terms
Search Engines
Referral Errors

Domains & Users

Domains
Domain Drilldown
Countries
IP Addresses
IP Drilldown
Usernames
Usernames by Hits
Usernames by Bytes
Usernames by Sessions

Browsers & Robots

Browsers
Browsers by Sessions Drilldown
Browsers by Hits Drilldown
Browsers by Bytes Drilldown
Platforms
Platforms by Sessions Drilldown
Platforms by Hits Drilldown
Platforms by Bytes Drilldown
Combos
Combos by Sessions
Combos by Hits
Combos by Bytes
Robots
Robots by Hits Drilldown
Robots by Bytes Drilldown