Hello,

This morning, root received an e-mail from the cron daemon as the following:

---

Subject: Cron <root> run-parts /etc/cron.daily

/etc/cron.daily:00webalizer:

Warning: Truncating oversized referrer field

I haven't changed anything to cron or to my intranet website (I'm assuming that's what the webalizer is about) in the last few days.

I did do a reboot yesterday which was the first one in a few weeks.

Does anybody know what this message is?

Michael

This is indeed a webalizer issue and I'm wondering if this indicates a more serious problem or if this is just an error in log file format.

It's getting an oversized referrer field. Looking at the output file of the webalizer, I have 4 referrers:

- direct request - my intranet domain name - a php application domain name running on my intranet - (compatible

It is this last line that is confusing the webalizer. It seems the webalizer thinks the text "(compatible" is a referrer. If I look into the input log file in /var/log/httpd/access-log, the text "(compatible" comes from the description of the User Agent, in this case:

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1 4322; >NET CLR 2.0.502727; .NET CLR 3.0.04506.30)

Is this error common? I found several discussions of this on the internet and one simply says to use the "very quiet" option.

So should I not be worried or could this potentially be the sign of a more serious issue?

Michael