HTTP error code question

[murphey]

I've been checking the logs on a website I manage and ran into this line

194.19.140.96 - - [09/Jul/2011:11:01:13 -0400] "GET /scripts/setup.php HTTP/1.0" 404 593 "-" "ZmEu"

The only item that baffles me is the 593 that follows the 404. Never saw it before. Anyone know what it's for, what it means?

 

[ebacon]

Can you search the httpd source code?

 

[ebacon]

What is the "ZmEu" at the end of the string? Have you seen that before? I looked at the Apache httpd error codes and the highest one is 510. The code numbers between 500 and 600 are reserved for server errors.

Supposedly ZmEu is a hacker bot that tries to exploit the server.

http://theta.tk/wiki/ZmEu

 

[jason]

593 isn't a response code. It looks like a standard apache log format. If so, the 593 would be the size of the document returned to the user (minus response headers). I think it's in bytes. So, your 404 response document is likely 593 bytes in size.

 

[zaitcev]

What is the "ZmEu" at the end of the string?

"ZmEu" is what the bot puts into the Referrer header.
Edit: My bad. Of course it's User-Agent.

 

[jesse]

593 isn't a response code. It looks like a standard apache log format. If so, the 593 would be the size of the document returned to the user (minus response headers). I think it's in bytes. So, your 404 response document is likely 593 bytes in size.

+1. The number is response in bytes minus headers. It's the combined log format. See:
http://httpd.apache.org/docs/2.0/logs.html#combined
The ZmEu is the user agent. The "-" means the request had no referrer.

 

[jwriteclub]

As an aside, I've never understood why bot makers use an easily identifiable User Agent string. If you really wanted to fly under the radar, wouldn't you get a list of real user agent strings and then just randomly cycle through them?

~ Christopher

 

[jesse]

As an aside, I've never understood why bot makers use an easily identifiable User Agent string. If you really wanted to fly under the radar, wouldn't you get a list of real user agent strings and then just randomly cycle through them?

~ Christopher

They're usually not trying to fly under the radar.