tronq wrote:

> I dont know whats going on. My access_log apache is growing very fast,
> (average 1mb/1h) Whats more, GET HOST AND HEAD lines arent relate with my
> hostname. My hostname isnt show nowhere below. Im attaching few lines from
> error, agent, access and referer_log.

<snip>
>
http://e8.member.yahoo.com/config/lo...sswd=green&n=1
> HTTP/1.0" 502 561 172.138.56.49 - - [21/Apr/2004:02:09:41 +0200] "GET
<snip>
> 194.213.63.30 - - [21/Apr/2004:02:09:42 +0200] "CONNECT login.icq.com:443
> HTTP/1.0" 200 - 220.175.56.117 - - [21/Apr/2004:02:09:42 +0200] "GET
> http://www.1221.tk HTTP/1.0" 200 489 213.162.120.121 - -
> [21/Apr/2004:02:09:43 +0200] "HEAD
> http://www.cierasagexxx.com/members/index.htm HTTP/1.0" 401 0
<snip>
> [Wed Apr 21 01:58:10 2004] [error] [client 24.5.144.165] Invalid
> [Content-Length Wed Apr 21 01:58:37 2004] [error] [client 141.158.36.226]
> [(111)Connection refused: proxy connect to 216.136.131.123 port 80 failed
> [Wed Apr 21 01:59:59 2004] [error] [client 24.223.166.56] (111)Connection


Hmm, I could be wrong but it looks to me as though someone is trying to use
your Apache server as a proxy. Some of the sites being requested look
rather dodgy (there's a fair few porn sites there, attempts to log in to
Yahoo, attempted ICQ connections etc).

I think you need to check out whether Apache is set to act as a proxy (look
for mod_proxy and the ProxyRequests directive).

Cheers

Dave P


--
David Precious
http://www.preshweb.co.uk/

> I think you need to check out whether Apache is set to act as a proxy (look

> for mod_proxy and the ProxyRequests directive).

bingo!

thank u