Forum

Hiawatha version: 6.17.1
Operating System: Ubuntu 9.04 Server

The format of the log file is changed to extended.

Does "404 not found" and/or "503 Forbidden" accesses to be recorded in error.log file?

No, they are logged in the access logfile.

Hugo Leisink,

What else will be recorded in error.log file?

Samiux

Anything that might need attention: reason for a 500 error, reason for a 403 error, CGI errors, etc.

Hugo Leisink,

When I access my website and it produced "403 Forbidden" error page, however the error.log file has no entry about this access.

Any idea?

Samiux

Is the error logfile writable for Hiawatha?

Hugo Leisink,

I think the error.log is writable. I have entries in access.log but not the error.log.

Samiux

Did you get the 403 error from requesting a static file or a CGI program?

Hugo Leisink,

I denied the access a certain files at UrlToolkit. When I tested it, it produces "403 Forbidden" page. However, there is no entry in error.log.

Samiux

Of course not, because it's not an error. It's the desired result. If a website works as designed, the error logfile should remain empty.

Hugo Leisink,

What kind of log entries or errors should I be concerned or alerted?

Samiux

I don't understand your question.

Hugo Leisink,

Background
I am using logwatch which is a report generator to grab all error or important messages from all log files under /var/log. It works great for Apache and other daemons.

Although there are some error messages at /var/log/hiawatha/error.log but no report generated from logwatch even Hiawatha's log file format is set to extended. I think logwatch is not compatible with Hiawatha. Therefore, I should manual read all access.log and error.log and other log files which are generated by Hiawatha.

Question
The question is what kind of error message or special message in Hiawatha log files should I be pay more attention and alerted? It is because I want to make this task more easy by the following command :

sudo cat /var/log/hiawatha/access.log | grep SOMETHING_SPECIAL
sudo cat /var/log/hiawatha/error.log | grep SOMETHING_TO_BE_ALERTED

Samiux

You can make the access logfile the same as Apache's logfile by using "LogFormat = extended". If logwatch supports Apache, it then should support Hiawatha.

The error logfile is a different story. If everything goes well, the error logfile should remain empty. So, you could say that every entry in the error logfile should require your attention. But how quick and how much of your attention depends on the content of the error log entry and the kind of website. For example, a personal hobby website doesn't require as much attention as the website of a commercial company.

Hugo Leisink,

The hiawatha.conf is set to "LogFormat = extended" already.

The following is a portion of the entries of my error.log :

Sat 19 Sep 2009 21:04:59 +0800|220.181.61.217|/var/www/blog/register.php|bot rejected
Sat 19 Sep 2009 21:44:16 +0800|72.30.161.221|/var/www/blog/robots.txt|bot rejected
Sat 19 Sep 2009 21:44:17 +0800|72.30.161.221|/var/www/blog/userinfo.php|bot rejected
Sat 19 Sep 2009 23:12:38 +0800|66.249.68.151|/var/www/blog/userinfo.php|bot rejected
Sat 19 Sep 2009 23:17:01 +0800|124.115.0.107|/var/www/blog/|bot rejected
Sat 19 Sep 2009 23:17:01 +0800|124.115.0.107|/var/www/blog/|bot rejected
Sat 19 Sep 2009 23:52:08 +0800|58.61.164.42|/var/www/blog/robots.txt|bot rejected

Yes, I block some of the bots and spiders and the error.log is full of these kind of entries. However, the logwatch generated no report on these errors.

By the way, 403 and 500 as well as other similar error messages showed in access.log but logwatch also generated no report on them.

Any idea?

Samiux

I admit that the rejected-bots messages are not really errors, but I added them there to give you an idea of the amount of blocks. You can ignore them. I don't know why logwatch doesn't report on those errors. Try the logwatch forum (if there is one).

About the 403 and 500 in the access logfile, that sounds like a logwatch issue. You should ask the logwatch people about it.

Hugo Leisink,

Thank you for your reply.

I will seek assistance from logwatch crews.

Samiux