Topic: Log File: Message .. httpReadReply: Excess data from "POST http://elmarkinosc.co

[Gaetan]

Hi,

Since the 01/10/2012,
I get some funny messages regarding httpReadReply ... hundred of them ...
See below.
My server is up to date 7.6.
Can someone clarify things ?
Thanks


Oct  1 13:20:42 sme2 esmith::event[25995]: adjusting supervised radiusd (sigterm) 
Oct  1 13:20:42 sme2 esmith::event[25995]: adjusting supervised radiusd (up) 
Oct  1 13:20:42 sme2 esmith::event[25995]: adjust-services=action|Event|password-modify|Action|adjust-services|Start|1349094042 883506|End|1349094042 983274|Elapsed|0.099768
Oct  1 13:21:19 sme2 squid[5384]: httpReadReply: Excess data from "POST http://elmarkinosc.com/ff/image.php"
Oct  1 13:21:19 sme2 squid[5384]: httpReadReply: Excess data from "POST http://a9h23nuianowj12.com/ff/image.php"
Oct  1 13:21:25 sme2 HORDE[12592]: [imp] Login success for andreas [192.168.11.200] to {localhost:143 [imap/notls]} [pid 12592 on line 307 of "/home/httpd/html/horde/imp/lib/Session.php"]
Oct  1 13:21:26 sme2 slapd[5098]: conn=651 fd=7 ACCEPT from IP=127.0.0.1:48085 (IP=0.0.0.0:389)
Oct  1 13:21:26 sme2 slapd[5098]: conn=651 op=0 BIND dn="" method=128
Oct  1 13:21:26 sme2 slapd[5098]: conn=651 op=0 RESULT tag=97 err=0 text=
Oct  1 13:21:26 sme2 slapd[5098]: conn=651 op=1 UNBIND
Oct  1 13:21:26 sme2 slapd[5098]: conn=651 fd=7 closed
Oct  1 13:21:28 sme2 slapd[5098]: conn=652 fd=7 ACCEPT from IP=127.0.0.1:48112 (IP=0.0.0.0:389)
Oct  1 13:21:28 sme2 slapd[5098]: conn=652 op=0 BIND dn="" method=128
Oct  1 13:21:28 sme2 slapd[5098]: conn=652 op=0 RESULT tag=97 err=0 text=
Oct  1 13:21:28 sme2 slapd[5098]: conn=652 op=1 UNBIND
Oct  1 13:21:28 sme2 slapd[5098]: conn=652 fd=7 closed
Oct  1 13:21:31 sme2 slapd[5098]: conn=653 fd=7 ACCEPT from IP=127.0.0.1:48116 (IP=0.0.0.0:389)
Oct  1 13:21:31 sme2 slapd[5098]: conn=653 op=0 BIND dn="" method=128
Oct  1 13:21:31 sme2 slapd[5098]: conn=653 op=0 RESULT tag=97 err=0 text=
Oct  1 13:21:31 sme2 slapd[5098]: conn=653 op=1 UNBIND
Oct  1 13:21:31 sme2 slapd[5098]: conn=653 fd=7 closed
Oct  1 13:21:33 sme2 slapd[5098]: conn=654 fd=7 ACCEPT from IP=127.0.0.1:48120 (IP=0.0.0.0:389)
Oct  1 13:21:33 sme2 slapd[5098]: conn=654 op=0 BIND dn="" method=128
Oct  1 13:21:33 sme2 slapd[5098]: conn=654 op=0 RESULT tag=97 err=0 text=
Oct  1 13:21:33 sme2 slapd[5098]: conn=654 op=1 UNBIND
Oct  1 13:21:33 sme2 slapd[5098]: conn=654 fd=7 closed
Oct  1 13:21:34 sme2 slapd[5098]: conn=655 fd=7 ACCEPT from IP=127.0.0.1:48121 (IP=0.0.0.0:389)
Oct  1 13:21:34 sme2 slapd[5098]: conn=655 op=0 BIND dn="" method=128
Oct  1 13:21:34 sme2 slapd[5098]: conn=655 op=0 RESULT tag=97 err=0 text=
Oct  1 13:21:34 sme2 slapd[5098]: conn=655 op=1 UNBIND
Oct  1 13:21:34 sme2 slapd[5098]: conn=655 fd=7 closed
Oct  1 13:21:51 sme2 slapd[5098]: conn=656 fd=7 ACCEPT from IP=127.0.0.1:48139 (IP=0.0.0.0:389)
Oct  1 13:21:51 sme2 slapd[5098]: conn=656 op=0 BIND dn="" method=128
Oct  1 13:21:51 sme2 slapd[5098]: conn=656 op=0 RESULT tag=97 err=0 text=
Oct  1 13:21:51 sme2 slapd[5098]: conn=656 op=1 UNBIND
Oct  1 13:21:51 sme2 slapd[5098]: conn=656 fd=7 closed
Oct  1 13:21:51 sme2 HORDE[28709]: [imp] Logout for andreas [192.168.11.200] to {localhost:143 [imap/notls]} [pid 28709 on line 67 of "/home/httpd/html/horde/imp/login.php"]
Oct  1 13:21:53 sme2 slapd[5098]: conn=657 fd=7 ACCEPT from IP=127.0.0.1:48142 (IP=0.0.0.0:389)
Oct  1 13:21:53 sme2 slapd[5098]: conn=657 op=0 BIND dn="" method=128
Oct  1 13:21:53 sme2 slapd[5098]: conn=657 op=0 RESULT tag=97 err=0 text=
Oct  1 13:21:53 sme2 slapd[5098]: conn=657 op=1 UNBIND
Oct  1 13:21:53 sme2 slapd[5098]: conn=657 fd=7 closed
Oct  1 13:21:55 sme2 slapd[5098]: conn=658 fd=7 ACCEPT from IP=127.0.0.1:48145 (IP=0.0.0.0:389)
Oct  1 13:21:55 sme2 slapd[5098]: conn=658 op=0 BIND dn="" method=128
Oct  1 13:21:55 sme2 slapd[5098]: conn=658 op=0 RESULT tag=97 err=0 text=
Oct  1 13:21:55 sme2 slapd[5098]: conn=658 op=1 UNBIND
Oct  1 13:21:55 sme2 slapd[5098]: conn=658 fd=7 closed
Oct  1 13:22:07 sme2 slapd[5098]: conn=659 fd=7 ACCEPT from IP=127.0.0.1:48159 (IP=0.0.0.0:389)
Oct  1 13:22:07 sme2 slapd[5098]: conn=659 op=0 BIND dn="" method=128
Oct  1 13:22:07 sme2 slapd[5098]: conn=659 op=0 RESULT tag=97 err=0 text=
Oct  1 13:22:07 sme2 slapd[5098]: conn=659 op=1 UNBIND
Oct  1 13:22:07 sme2 slapd[5098]: conn=659 fd=7 closed
Oct  1 13:22:09 sme2 slapd[5098]: conn=660 fd=7 ACCEPT from IP=127.0.0.1:48160 (IP=0.0.0.0:389)
Oct  1 13:22:09 sme2 slapd[5098]: conn=660 op=0 BIND dn="" method=128
Oct  1 13:22:09 sme2 slapd[5098]: conn=660 op=0 RESULT tag=97 err=0 text=
Oct  1 13:22:09 sme2 slapd[5098]: conn=660 op=1 UNBIND
Oct  1 13:22:09 sme2 slapd[5098]: conn=660 fd=7 closed
Oct  1 13:22:10 sme2 slapd[5098]: conn=661 fd=7 ACCEPT from IP=127.0.0.1:48161 (IP=0.0.0.0:389)
Oct  1 13:22:10 sme2 slapd[5098]: conn=661 op=0 BIND dn="" method=128
Oct  1 13:22:10 sme2 slapd[5098]: conn=661 op=0 RESULT tag=97 err=0 text=
Oct  1 13:22:10 sme2 slapd[5098]: conn=661 op=1 UNBIND
Oct  1 13:22:10 sme2 slapd[5098]: conn=661 fd=7 closed
Oct  1 13:22:11 sme2 slapd[5098]: conn=662 fd=7 ACCEPT from IP=127.0.0.1:48163 (IP=0.0.0.0:389)
Oct  1 13:22:11 sme2 slapd[5098]: conn=662 op=0 BIND dn="" method=128
Oct  1 13:22:11 sme2 slapd[5098]: conn=662 op=0 RESULT tag=97 err=0 text=
Oct  1 13:22:11 sme2 slapd[5098]: conn=662 op=1 UNBIND
Oct  1 13:22:11 sme2 slapd[5098]: conn=662 fd=7 closed
Oct  1 13:22:19 sme2 squid[5384]: httpReadReply: Excess data from "POST http://elmarkinosc.com/ff/image.php"
Oct  1 13:22:20 sme2 squid[5384]: httpReadReply: Excess data from "POST http://a9h23nuianowj12.com/ff/image.php"
Oct  1 13:22:40 sme2 slapd[5098]: conn=663 fd=7 ACCEPT from IP=127.0.0.1:48262 (IP=0.0.0.0:389)
Oct  1 13:22:40 sme2 slapd[5098]: conn=663 op=0 BIND dn="" method=128
Oct  1 13:22:40 sme2 slapd[5098]: conn=663 op=0 RESULT tag=97 err=0 text=
Oct  1 13:22:40 sme2 slapd[5098]: conn=663 op=1 UNBIND
Oct  1 13:22:40 sme2 slapd[5098]: conn=663 fd=7 closed
Oct  1 13:23:20 sme2 squid[5384]: httpReadReply: Excess data from "POST http://elmarkinosc.com/ff/image.php"
Oct  1 13:23:20 sme2 squid[5384]: httpReadReply: Excess data from "POST http://a9h23nuianowj12.com/ff/image.php"
Oct  1 13:24:21 sme2 squid[5384]: httpReadReply: Excess data from "POST http://elmarkinosc.com/ff/image.php"
Oct  1 13:24:21 sme2 squid[5384]: httpReadReply: Excess data from "POST http://a9h23nuianowj12.com/ff/image.php"
Oct  1 13:24:59 sme2 sshd(pam_unix)[27796]: session opened for user root by (uid=0)
Oct  1 13:25:21 sme2 squid[5384]: httpReadReply: Excess data from "POST http://elmarkinosc.com/ff/image.php"
Oct  1 13:25:22 sme2 squid[5384]: httpReadReply: Excess data from "POST http://a9h23nuianowj12.com/ff/image.php"
Oct  1 13:26:22 sme2 squid[5384]: httpReadReply: Excess data from "POST http://elmarkinosc.com/ff/image.php"
Oct  1 13:26:23 sme2 squid[5384]: httpReadReply: Excess data from "POST http://a9h23nuianowj12.com/ff/image.php"
Oct  1 13:27:23 sme2 squid[5384]: httpReadReply: Excess data from "POST http://elmarkinosc.com/ff/image.php"
Oct  1 13:27:23 sme2 squid[5384]: httpReadReply: Excess data from "POST http://a9h23nuianowj12.com/ff/image.php"
Oct  1 13:27:41 sme2 slapd[5098]: conn=664 fd=7 ACCEPT from IP=127.0.0.1:49184 (IP=0.0.0.0:389)


.....

Oct  2 14:07:17 sme2 squid[5384]: httpReadReply: Excess data from "POST http://a9h23nuianowj12.com/ff/image.php"
Oct  2 14:08:18 sme2 squid[5384]: httpReadReply: Excess data from "POST http://elmarkinosc.com/ff/image.php"
Oct  2 14:08:19 sme2 squid[5384]: httpReadReply: Excess data from "POST http://a9h23nuianowj12.com/ff/image.php"
Oct  2 14:09:19 sme2 squid[5384]: httpReadReply: Excess data from "POST http://elmarkinosc.com/ff/image.php"
Oct  2 14:09:20 sme2 squid[5384]: httpReadReply: Excess data from "POST http://a9h23nuianowj12.com/ff/image.php"
Oct  2 14:10:20 sme2 squid[5384]: httpReadReply: Excess data from "POST http://elmarkinosc.com/ff/image.php"
Oct  2 14:10:20 sme2 squid[5384]: httpReadReply: Excess data from "POST http://a9h23nuianowj12.com/ff/image.php"
Oct  2 14:11:21 sme2 squid[5384]: httpReadReply: Excess data from "POST http://elmarkinosc.com/ff/image.php"
Oct  2 14:11:21 sme2 squid[5384]: httpReadReply: Excess data from "POST http://a9h23nuianowj12.com/ff/image.php"
Oct  2 14:12:22 sme2 squid[5384]: httpReadReply: Excess data from "POST http://elmarkinosc.com/ff/image.php"
Oct  2 14:12:22 sme2 squid[5384]: httpReadReply: Excess data from "POST http://a9h23nuianowj12.com/ff/image.php"
Oct  2 14:13:22 sme2 squid[5384]: httpReadReply: Excess data from "POST http://elmarkinosc.com/ff/image.php"
Oct  2 14:13:23 sme2 squid[5384]: httpReadReply: Excess data from "POST http://a9h23nuianowj12.com/ff/image.php"
Oct  2 14:14:23 sme2 squid[5384]: httpReadReply: Excess data from "POST http://elmarkinosc.com/ff/image.php"
Oct  2 14:14:23 sme2 squid[5384]: httpReadReply: Excess data from "POST http://a9h23nuianowj12.com/ff/image.php"
Oct  2 14:15:24 sme2 squid[5384]: httpReadReply: Excess data from "POST http://elmarkinosc.com/ff/image.php"
Oct  2 14:15:24 sme2 squid[5384]: httpReadReply: Excess data from "POST http://a9h23nuianowj12.com/ff/image.php"
Oct  2 14:16:24 sme2 squid[5384]: httpReadReply: Excess data from "POST http://elmarkinosc.com/ff/image.php"
Oct  2 14:16:25 sme2 squid[5384]: httpReadReply: Excess data from "POST http://a9h23nuianowj12.com/ff/image.php"
Oct  2 14:17:25 sme2 squid[5384]: httpReadReply: Excess data from "POST http://elmarkinosc.com/ff/image.php"
Oct  2 14:17:25 sme2 squid[5384]: httpReadReply: Excess data from "POST http://a9h23nuianowj12.com/ff/image.php"
Oct  2 14:18:26 sme2 squid[5384]: httpReadReply: Excess data from "POST http://elmarkinosc.com/ff/image.php"
Oct  2 14:18:26 sme2 squid[5384]: httpReadReply: Excess data from "POST http://a9h23nuianowj12.com/ff/image.php"
Oct  2 14:19:28 sme2 squid[5384]: httpReadReply: Excess data from "POST http://elmarkinosc.com/ff/image.php"
Oct  2 14:19:28 sme2 squid[5384]: httpReadReply: Excess data from "POST http://a9h23nuianowj12.com/ff/image.php"
Oct  2 14:20:29 sme2 squid[5384]: httpReadReply: Excess data from "POST http://elmarkinosc.com/ff/image.php"
Oct  2 14:20:29 sme2 squid[5384]: httpReadReply: Excess data from "POST http://a9h23nuianowj12.com/ff/image.php"
Oct  2 14:21:29 sme2 squid[5384]: httpReadReply: Excess data from "POST http://elmarkinosc.com/ff/image.php"
Oct  2 14:21:30 sme2 squid[5384]: httpReadReply: Excess data from "POST http://a9h23nuianowj12.com/ff/image.php"
Oct  2 14:22:30 sme2 squid[5384]: httpReadReply: Excess data from "POST http://elmarkinosc.com/ff/image.php"
Oct  2 14:22:30 sme2 squid[5384]: httpReadReply: Excess data from "POST http://a9h23nuianowj12.com/ff/image.php"
Oct  2 14:23:31 sme2 squid[5384]: httpReadReply: Excess data from "POST http://elmarkinosc.com/ff/image.php"
Oct  2 14:23:32 sme2 squid[5384]: httpReadReply: Excess data from "POST http://a9h23nuianowj12.com/ff/image.php"
Oct  2 14:24:32 sme2 squid[5384]: httpReadReply: Excess data from "POST http://elmarkinosc.com/ff/image.php"
Oct  2 14:24:32 sme2 squid[5384]: httpReadReply: Excess data from "POST http://a9h23nuianowj12.com/ff/image.php"
Oct  2 14:25:33 sme2 squid[5384]: httpReadReply: Excess data from "POST http://elmarkinosc.com/ff/image.php"
Oct  2 14:25:33 sme2 squid[5384]: httpReadReply: Excess data from "POST http://a9h23nuianowj12.com/ff/image.php"
Oct  2 14:26:33 sme2 squid[5384]: httpReadReply: Excess data from "POST http://elmarkinosc.com/ff/image.php"
Oct  2 14:26:34 sme2 squid[5384]: httpReadReply: Excess data from "POST http://a9h23nuianowj12.com/ff/image.php"
Oct  2 14:27:34 sme2 squid[5384]: httpReadReply: Excess data from "POST http://elmarkinosc.com/ff/image.php"

[CharlieBrady]

If you google for 'httpReadReply: Excess data' you'll find a squid FAQ entry about that. It's an error in the data arriving in response to web requests - the site is lying about the size of the response (bogus or incorrect content-length header), or the response is being altered in transit, e.g. by an upstream proxy.

[Gaetan]

Hi,
Thanks for your reply.
I managed to stop those messages by blocking those domains via Dansguardian.