0

Last week a VPS crashed multiple times and I try to figure out, why.

There is a pretty high amount of 404 in apache's log for /autodiscover/autodiscover.xml The logs aren't in chronological order …

aa.bb.cc.dd - - [02/Feb/2018:09:50:11 +0100] "POST /autodiscover/autodiscover.xml HTTP/1.1" 301 258 "-" "Microsoft Office/14.0 (Windows NT 6.1; Microsoft Outlook 14.0.7192; Pro)"
aa.bb.cc.dd - - [02/Feb/2018:09:55:32 +0100] "POST /autodiscover/autodiscover.xml HTTP/1.1" 301 258 "-" "Microsoft Office/14.0 (Windows NT 6.1; Microsoft Outlook 14.0.7192; Pro)"
aa.bb.cc.dd - - [02/Feb/2018:09:58:56 +0100] "POST /autodiscover/autodiscover.xml HTTP/1.1" 301 258 "-" "Microsoft Office/14.0 (Windows NT 6.1; Microsoft Outlook 14.0.7192; Pro)"
aa.bb.cc.dd - - [02/Feb/2018:10:04:02 +0100] "POST /autodiscover/autodiscover.xml HTTP/1.1" 301 258 "-" "Microsoft Office/14.0 (Windows NT 6.1; Microsoft Outlook 14.0.7192; Pro)"
aa.bb.cc.dd - - [02/Feb/2018:09:53:50 +0100] "POST /autodiscover/autodiscover.xml HTTP/1.1" 301 258 "-" "Microsoft Office/14.0 (Windows NT 6.1; Microsoft Outlook 14.0.7192; Pro)"
aa.bb.cc.dd - - [02/Feb/2018:10:00:53 +0100] "POST /autodiscover/autodiscover.xml HTTP/1.1" 301 258 "-" "Microsoft Office/14.0 (Windows NT 6.1; Microsoft Outlook 14.0.7192; Pro)"
aa.bb.cc.dd - - [02/Feb/2018:10:00:53 +0100] "POST /autodiscover/autodiscover.xml HTTP/1.1" 301 258 "-" "Microsoft Office/14.0 (Windows NT 6.1; Microsoft Outlook 14.0.7192; Pro)"
aa.bb.cc.dd - - [02/Feb/2018:10:09:06 +0100] "POST /autodiscover/autodiscover.xml HTTP/1.1" 301 258 "-" "Microsoft Office/14.0 (Windows NT 6.1; Microsoft Outlook 14.0.7192; Pro)"
aa.bb.cc.dd - - [02/Feb/2018:09:50:11 +0100] "POST /autodiscover/autodiscover.xml HTTP/1.1" 301 258 "-" "Microsoft Office/14.0 (Windows NT 6.1; Microsoft Outlook 14.0.7192; Pro)"
aa.bb.cc.dd - - [02/Feb/2018:10:11:33 +0100] "POST /autodiscover/autodiscover.xml HTTP/1.1" 301 258 "-" "Microsoft Office/14.0 (Windows NT 6.1; Microsoft Outlook 14.0.7192; Pro)"
aa.bb.cc.dd - - [02/Feb/2018:10:06:12 +0100] "POST /autodiscover/autodiscover.xml HTTP/1.1" 301 258 "-" "Microsoft Office/14.0 (Windows NT 6.1; Microsoft Outlook 14.0.7192; Pro)"

I've read logs are created in order of request, not completion. Does it mean the log from 09:53:50 needed at least about 7 minutes to complete?

What is Exchange posting to that URL? Why does it take several minutes? Do you think that can crash a server?

FYI The VPS (2GB RAM, FreeBSD, Apache) has a really small website/CMS installed (which generates the 404 page as well). My client uses (somewhere else) an Exchange-Server associated with the domain.

suntrop
  • 101
  • 1
  • 1
    If the domain pointing to this server is also a domain used for email, then it is perfectly natural to have Outlook querying this server for auto discover information. It is one choice, amongst several, methods Outlook uses to try to find an exchange server. I don’t know why you are thinking this is related to your crashing server. – Appleoddity Feb 02 '18 at 13:55
  • None of those are 404s. They all show a status code of `301`. – ceejayoz Feb 02 '18 at 13:59
  • Ok, thanks. But what about the strange sort order? Is there something wrong with the POST data? – suntrop Feb 02 '18 at 15:20
  • Hard to say. What happens if you issue a `POST` request to that URL via cURL or something similar? – ceejayoz Feb 02 '18 at 19:47
  • You need to go far beyond the web server request logs to look into stability problems. syslog, memory consumption, software crashes and any core dumps, recent software updates, VM host stability if known. – John Mahowald Feb 03 '18 at 14:00

0 Answers0