Logwatch "2 200 responses" issue - Discuss

22 Mar 2006


      I have this issue with logwatch that seems to be growing. I've googled
this, and other people have posted questions about it here and there,
but I don't see any solutions posted.
I'm seeing logwatch reporting this issue, or something like it, in a
lot of web programming tools I and my friends use. Here's an example,
from a Drupal Chat module installed under CentOS 4.2 (in this case):
--------
--------------------- httpd Begin ------------------------
A total of 11934 unidentified 'other' records logged
   with response code(s)
  GET /chatbox/text?nickname=jtrant&limit=30&lastrefresh=1142823531
HTTP/1.1 with response code(s) 2 200 responses
  GET /chatbox/nicklist&forcerefresh=9317 HTTP/1.1 with response
code(s) 2 200 responses
--------
etc. (it continues for all 12000 entries). I've also seen it with
htdig, the open source web indexing software, mambo and joomla! (CMS's
like Drupal), and some wiki software. I don't know what it is about
perl & php-based web forms that generate that funny double 200
(success) http response code, but it seems to be getting very common.
One way to fix it may be to edit logwatch's http script. But part of
me wonders if that's the wrong approach--maybe it's Drupal's fault for
sending back a funny http response--and part of me knows that would be
a lot of effort.
Has anyone fixed this already? How?
Thanks,
Matt