log format changes dynamically?

Giganews Newsgroups
Subject: log format changes dynamically?
Posted by:  patpro ~ Patrick Proniewski (patp…@boleskine.patpro.net)
Date: Mon, 19 Jul 2010

Hi all,

For the first time, I notice that my log format is changing depending on
client request.
Usual log output looks like this:

CLIENT_IP 15:35:18 "GET /blog/ HTTP/1.1" 200 13938 "-" "USER_AGENT"

But a client (appearing to be a bot) created logs a bit different:

CLIENT_IP - "" [19/Jul/2010:15:31:17 +0200] "GET /blog/ HTTP/1.1" 200
13938 "-" "USER_AGENT"

CLIENT_IP 15:31:19 "GET /document.txt HTTP/1.1" 200 3764 "-" "USER_AGENT"

I understand the - "" part, because my LogFormat directives is:

LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\""
combined

But I don't understand why the date-time change format!
By the way, the same client generates 'CLIENT_IP - "" [DATE:TIME TZ]'
lines for most GETs, but generates 'CLIENT_IP TIME' when it gets .txt
documents.

Any idea?

patpro

--
A vendre !http://www.patpro.net/blog/index.php/2008/01/12/133

Replies