Topic: Seemingly random header errors with mod_perl and Safari

[dsiomtw]

Under mod_perl on Apache 2.2 we're getting all sorts of seemingly random header related errors. The common denominator is that the user agents show all the requests coming only from Safari browsers.

Did a Google search and learned that Safari has problems if you use compression with anything other than html files, so we just turned off compression for the files in question and were excited to have hopefully solved the problem.

Turning off compression eliminated most of the random header errors, but unfortunately we're still seeing some and I could really use some help figuring this out.

Here's a recent example. From the error log:

[Mon Nov 24 14:32:47 2014] [error] [client xxx] Premature end of script headers: index.cgi

The user agent for this request:

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_5_8) AppleWebKit/534.50.2 (KHTML, like Gecko) Version/5.0.6 Safari/533.22.3

According to several popular UA parsers this is:

Safari 5 on Mac OS X (Leopard)

What's interesting is that this same IP happened to make another request using a slightly different browser that that worked fine. Here's the UA for that request:

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_7; en-us) AppleWebKit/533.21.1 (KHTML, like Gecko) Version/5.0.5 Safari/533.21.1

This corresponds with Safari 5 on Mac OS X (Snow Leopard).

Now I don't know much about Macs, but the only difference between the 2 that I can see is that one says Mac OS X (Snow Leopard) and the other just says (Leopard)...

The pattern of requests that are generating these errors almost look like bots (many requests to different URLs in a short period of time, almost all from "3rd world" countries, etc), and I'm starting to think the remaining header errors are caused by bad requests from bots, but every now and then there's one that looks like a legit user (residential ISP, etc.) too.

I'm at a total loss here and just hoping someone has some ideas for me. This is a problem for us because these "false alarms" trigger our monitoring system and my admin is getting "emergency error notifications" at all hours of the day and night.

The index.cgi in question gets 100s of 1000s of requests per day, and works fine for 99.99% of users. And no matter how hard we try we can't duplicate the problem, so we're just sitting here scratching our heads...

Anyone?

[glsmith]

Just guessing here

From your description and thoughts on the source IPs, it just may be bots and the script is timing out before it can complete. They maybe doing a slowpost attack on you and that it is failing is a good thing

Even of the ISPs you think are legit, there's plenty of zombie computers in peoples homes around the globe.

If 99.99% of the 100s of 1000s are doing ok, I think I'd not sweat over it. But that's just me.

[dsiomtw]

Thanks for the reply. These are all GET requests, and there aren't enough of them for it to be any kind of attack. Most likely just bots sending weird requests with bad headers or something I assume??

Anyway, the real problem with this is that every time it happens the server treats it the same as a 500 server error, and that triggers our monitoring systems which then sends "get your butt online and fix this" emails and text messages to my head programmer because it thinks our app is broken. He's getting sick of being woken up at 2am because of these false alarms, so we'd all like to figure out a solution one way or another.

Any ideas?

[dsiomtw]

Anyone else by any chance? I'm really desperate for help on this. I'll pay $50 via PayPal right now for a solution!

[dsiomtw]

Anyone know where I can get help with something like this? I'm really desperate to get this figured out...

[admin]

The user mailing list at http://perl.apache.org/