PHP trouble
Looking into Operator.log, I noticed a number of messages like:
%%%%%%%%%%% OPCOM 16-APR-2007 01:15:59.12 %%%%%%%%%%%
Message from user HTTP$SERVER on DIANA
Process HTTPd:80 reports
%HTTPD-W-NOTICED, CGI:1969, not a strict CGI response
Looking into the webserver log, it’s quite obvious. Since 13-Apr02007, it happens again and again, sevarl times in a row:
%HTTPD-W-NOTICED, 13-APR-2007 03:06:37, CGI:1969, not a strict CGI response
-NOTICED-I-SERVICE, http://www.grootersnet.nl:80
-NOTICED-I-CLIENT, 87.118.112.246
-NOTICED-I-URI, GET (22 bytes) /sysblog/index.php?p=4
-NOTICED-I-SCRIPT, /sysblog/index.php sysblog:[000000]index.php (cgi_exe:phpwasd.exe) SYSBLOG:[000000]index.php
-NOTICED-I-CGI, xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx (62 bytes) %DEBUGBOOT-W-CHN, assign channel system service request failed
-NOTICED-I-RXTX, err:0/0 raw:319/0 net:319/0
and mostly from this address – and one or two others. Not just on the weblog, the very same occurred on the forum index page.
In the access log, it shows up as well – inside a whole bunch of accesses to the blog:
87.118.112.246 - - [13/Apr/2007:03:06:30 +0100] "GET /sysblog/index.php?m=200701 HTTP/1.0" 200 16701
87.118.112.246 - - [13/Apr/2007:03:06:37 +0100] "GET /sysblog/index.php?p=4 HTTP/1.0" 502 881
87.118.112.246 - - [13/Apr/2007:03:06:39 +0100] "GET /sysblog/index.php?m=20070104 HTTP/1.0" 200 11351
Accoring to the access log, the whole blog has been extracted:
87.118.112.246 - - [13/Apr/2007:03:03:25 +0100] "GET / HTTP/1.0" 200 3475
87.118.112.246 - - [13/Apr/2007:03:03:28 +0100] "GET /forums/index.php HTTP/1.0" 200 22584
...
87.118.112.246 - - [13/Apr/2007:03:46:06 +0100] "GET /sysblog/index.php?page_id=2 HTTP/1.0" 200 9767
87.118.112.246 - - [13/Apr/2007:03:46:11 +0100] "GET /sysblog HTTP/1.0" 404 868
and as far I could quickly scan the logfile, it’s every entry, but each is valid.
On 14-Apr-2007, there was another wave of access – from the same address:
87.118.112.246 - - [14/Apr/2007:21:35:46 +0100] "GET / HTTP/1.0" 200 3475
87.118.112.246 - - [14/Apr/2007:21:35:48 +0100] "GET /forums/index.php HTTP/1.0" 200 22584
87.118.112.246 - - [14/Apr/2007:21:35:53 +0100] "GET /sysblog/index.php HTTP/1.0" 200 14884
...
87.118.112.246 - - [14/Apr/2007:21:44:29 +0100] "GET /sysblog HTTP/1.0" 404 868
87.118.112.246 - - [14/Apr/2007:21:44:29 +0100] "GET /sysblog/index.php?feed=rss2&p=36 HTTP/1.0" 200 793
Just getting the feeds, perhaps?
The address doesn’t translate to a domain, it seems, but I could get at least some hint. It appears to be German:
$ dig -x 87.118.112.246
; < <>> DiG 9.3.1 < <>> -x 87.118.112.246
;; global options: printcmd
;; Got answer:
;; ->>HEADER< <- opcode: QUERY, status: NOERROR, id: 35963
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2
;; QUESTION SECTION:
;246.112.118.87.in-addr.arpa. IN PTR
;; ANSWER SECTION:
246.112.118.87.in-addr.arpa. 71593 IN PTR ns.km30229.keymachine.de.
;; AUTHORITY SECTION:
112.118.87.in-addr.arpa. 28648 IN NS ns.keyweb.de.
112.118.87.in-addr.arpa. 28648 IN NS ns2.keyweb.de.
;; ADDITIONAL SECTION:
ns.keyweb.de. 83446 IN A 62.141.60.15
ns2.keyweb.de. 83446 IN A 62.141.49.15
;; Query time: 706 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Tue Apr 17 18:28:13 2007
;; MSG SIZE rcvd: 157
At least, I have one more question to be answered at the bootcamp!
Bootcamp blog
Speaking about the OpenVMS bootcamp: such a blog is something I consider to set up. I may use Phorum, if that works with the currently installed MySQL version, which I doubt since the relase notes tell me I need at least 4.3 and I’m running 4.1 on VMS. Otherwise, I may create another PHPBB2 forum for it, either new or an expamnsion of the Dutch forums, or I could take the opportunity to get it running using WordPress 2.1.
There too little time to develop a full-featured real-VMS application to do the job ;).