Access Log

ZyloxDragon · 10-09-2019, 03:50 PM

Hello all, I'm somewhat new to Calibre server. I have it setup currently running through noIP to make it so I can access my collection when I'm out on my work runs. I have a few questions on what some lines are indicating in my Access Log. I would assume that they are portscans, but I'm sure others here have a more in depth knowledge of what they are.

I currently have my firewall setup to block a few countries that I was constantly getting hits from.

87.10.175.94 port-56891 - 09/Oct/2019:03:47:31 -0500 "GET / HTTP/1.0" 200 1893838
60.51.26.230 port-39709 - 09/Oct/2019:03:51:21 -0500 "POST /editBlackAndWhiteList HTTP/1.1" 404 123
85.14.245.156 port-62631 - 09/Oct/2019:14:18:07 -0500 "

Is there a document for the logs of what these indicate that someone can point me to? Generally it seems as though my log stops generating any new lines once I receive that box looking ascii character at the end. I end up having to clear the log so it can begin again.

kovidgoyal · 10-09-2019, 08:34 PM

No idea what that box character is, presumably somebody trying to crash the server with invalid encoded HTTP requests. The other two lines are just HTTP requests, GETand POST, the second one definitely being a portscan.

ZyloxDragon · 10-09-2019, 10:31 PM

I saw more after the box character when I opened the log directly thru notepad. It was:

/*à Cookie: mstshash=Administr" 400 148

I'm guessing that particular box character just ends up makes it non-readable from within the application itself? The rest of the line I was able to find on the web as relating to someone trying to RDP into the system.

Thank you for details on the other 2 lines. It's mainly just the GET requests that I have.

kovidgoyal · 10-10-2019, 12:51 PM

Yeah another portscan, the calibre server simply returned the HTPP 400 bad request error for it.

10-09-2019, 03:50 PM	#1
ZyloxDragon New User Posts: 2 Karma: 10 Join Date: Oct 2019 Device: none	Access Log Hello all, I'm somewhat new to Calibre server. I have it setup currently running through noIP to make it so I can access my collection when I'm out on my work runs. I have a few questions on what some lines are indicating in my Access Log. I would assume that they are portscans, but I'm sure others here have a more in depth knowledge of what they are. I currently have my firewall setup to block a few countries that I was constantly getting hits from. 87.10.175.94 port-56891 - 09/Oct/2019:03:47:31 -0500 "GET / HTTP/1.0" 200 1893838 60.51.26.230 port-39709 - 09/Oct/2019:03:51:21 -0500 "POST /editBlackAndWhiteList HTTP/1.1" 404 123 85.14.245.156 port-62631 - 09/Oct/2019:14:18:07 -0500 " Is there a document for the logs of what these indicate that someone can point me to? Generally it seems as though my log stops generating any new lines once I receive that box looking ascii character at the end. I end up having to clear the log so it can begin again.

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Content Server -- access log info	Ginnia	Library Management	5	09-12-2017 06:07 AM
Customizing Calibre's Access Log	petermj	Calibre	2	08-13-2017 10:10 AM
calibre-server access log?	Geremia	Calibre	5	06-29-2013 10:18 PM
Kobo Firmware Access and Early Access Program	PeterT	Kobo Reader	115	08-09-2010 08:06 PM
I can log on to Sony Store, but I can't access the Store	Dr. Drib	Sony Reader	3	04-11-2009 09:05 AM

10-09-2019, 08:34 PM	#2
kovidgoyal creator of calibre Posts: 44,012 Karma: 22669822 Join Date: Oct 2006 Location: Mumbai, India Device: Various	No idea what that box character is, presumably somebody trying to crash the server with invalid encoded HTTP requests. The other two lines are just HTTP requests, GETand POST, the second one definitely being a portscan.

10-09-2019, 10:31 PM	#3
ZyloxDragon New User Posts: 2 Karma: 10 Join Date: Oct 2019 Device: none	I saw more after the box character when I opened the log directly thru notepad. It was: /*à Cookie: mstshash=Administr" 400 148 I'm guessing that particular box character just ends up makes it non-readable from within the application itself? The rest of the line I was able to find on the web as relating to someone trying to RDP into the system. Thank you for details on the other 2 lines. It's mainly just the GET requests that I have.

10-10-2019, 12:51 PM	#4
kovidgoyal creator of calibre Posts: 44,012 Karma: 22669822 Join Date: Oct 2006 Location: Mumbai, India Device: Various	Yeah another portscan, the calibre server simply returned the HTPP 400 bad request error for it.