I am analyzing access_logs to check on PDF downloads. My "Digger" program written in RunRev, scans 1.5 gigs of 6 accesslogs from Jun28-Aug3, pulls out any lines with a particular PDF in them. I'm trying to determine where and when the problematic Acrobat/Windows web integration is failing (many users browser, or entire system hangs if the PDF is over 5 MB and is trying to load into IE) My result file from the "dig" shows multiple 206 - partial content, sessions being served. The PDF size is: 19030363 bytes and a "clean hit" looks like this:
65.55.106.160 - - [27/Jul/2009:02:29:29 -0700] "GET /archives/2009/1-3/pdf/Hin
duism-Toda
y_Jan-Feb-
Mar_2009.p
df HTTP/1.1" 200 19030363 "-" "msnbot/2.0b (+
http://search.msn.com/msnbot.htm)"
but, mostly I have lots of multiple attempts where we see a 200 at the start of the session followed by a series of 206's. The total byte counts of all the 206's is irrational (varies on every session, never adds up to the actual size of the file)
I am showing three cases below, but there are 1000's of these sessions. at least 75% of them include a 200 at the beginning, sometimes in the middle. Some of the 206 session series have no 200 among them for the same IP over the same session. My question(s) are:
1) how can I know, in a case where the logs are registering 206s, whether the person actually go the entire file.
Maybe we can't... if the browser hangs, but there is still an active adobe acrobat process running on the box with an open socket to the server, polling for the next byte range in the file, which never actually opens on the user's machine: the user will never know and neither can the web server know?
2) Why do we see a 200 at the beginning of the session-series followed by multiple 206 partial content codes. And does the 200 indicate the entire file was sent? If so, why is it followed subsequently with so many additional 206 requests?
Here are three examples, all the many others look much the same, though sometimes the 200 code is in the middle of the session somewhere. The 3rd one is the most bizarre, started at 9:32:20... ending at 9:33:40: Eighty(!) 206 requests served to Firefox with a single 200 at the beginning... "What's it all about?" Copy these out to your fav editor and turn off wrap.
========
ONE
76.70.84.23 - - [29/Jul/2009:16:56:27 -0700] "GET /archives/2009/1-3/pdf/Hin
duism-Toda
y_Jan-Feb-
Mar_2009.p
df HTTP/1.1" 200 19030363 "
http://www.hinduismtoday.com/modules/wfdownloads/visit.php?cid=19&lid=25" "Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/530.5 (KHTML, like Gecko) Chrome/2.0.172.37 Safari/530.5"
76.70.84.23 - - [29/Jul/2009:16:56:45 -0700] "GET /archives/2009/1-3/pdf/Hin
duism-Toda
y_Jan-Feb-
Mar_2009.p
df HTTP/1.1" 206 746632 "
http://www.hinduismtoday.com/archives/2009/1-3/pdf/Hinduism-Today_Jan-Feb-Mar_2009.pdf" "Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/530.5 (KHTML, like Gecko) Chrome/2.0.172.37 Safari/530.5"
76.70.84.23 - - [29/Jul/2009:16:56:47 -0700] "GET /archives/2009/1-3/pdf/Hin
duism-Toda
y_Jan-Feb-
Mar_2009.p
df HTTP/1.1" 206 1035 "
http://www.hinduismtoday.com/archives/2009/1-3/pdf/Hinduism-Today_Jan-Feb-Mar_2009.pdf" "Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/530.5 (KHTML, like Gecko) Chrome/2.0.172.37 Safari/530.5"
76.70.84.23 - - [29/Jul/2009:16:56:49 -0700] "GET /archives/2009/1-3/pdf/Hin
duism-Toda
y_Jan-Feb-
Mar_2009.p
df HTTP/1.1" 206 33005 "
http://www.hinduismtoday.com/archives/2009/1-3/pdf/Hinduism-Today_Jan-Feb-Mar_2009.pdf" "Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/530.5 (KHTML, like Gecko) Chrome/2.0.172.37 Safari/530.5"
76.70.84.23 - - [29/Jul/2009:16:56:49 -0700] "GET /archives/2009/1-3/pdf/Hin
duism-Toda
y_Jan-Feb-
Mar_2009.p
df HTTP/1.1" 206 30949 "
http://www.hinduismtoday.com/archives/2009/1-3/pdf/Hinduism-Today_Jan-Feb-Mar_2009.pdf" "Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/530.5 (KHTML, like Gecko) Chrome/2.0.172.37 Safari/530.5"
76.70.84.23 - - [29/Jul/2009:16:56:50 -0700] "GET /archives/2009/1-3/pdf/Hin
duism-Toda
y_Jan-Feb-
Mar_2009.p
df HTTP/1.1" 206 33001 "
http://www.hinduismtoday.com/archives/2009/1-3/pdf/Hinduism-Today_Jan-Feb-Mar_2009.pdf" "Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/530.5 (KHTML, like Gecko) Chrome/2.0.172.37 Safari/530.5"
76.70.84.23 - - [29/Jul/2009:16:56:49 -0700] "GET /archives/2009/1-3/pdf/Hin
duism-Toda
y_Jan-Feb-
Mar_2009.p
df HTTP/1.1" 206 703832 "
http://www.hinduismtoday.com/archives/2009/1-3/pdf/Hinduism-Today_Jan-Feb-Mar_2009.pdf" "Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/530.5 (KHTML, like Gecko) Chrome/2.0.172.37 Safari/530.5"
76.70.84.23 - - [29/Jul/2009:16:56:56 -0700] "GET /archives/2009/1-3/pdf/Hin
duism-Toda
y_Jan-Feb-
Mar_2009.p
df HTTP/1.1" 206 1154650 "
http://www.hinduismtoday.com/archives/2009/1-3/pdf/Hinduism-Today_Jan-Feb-Mar_2009.pdf" "Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/530.5 (KHTML, like Gecko) Chrome/2.0.172.37 Safari/530.5"
76.70.84.23 - - [29/Jul/2009:16:57:01 -0700] "GET /archives/2009/1-3/pdf/Hin
duism-Toda
y_Jan-Feb-
Mar_2009.p
df HTTP/1.1" 206 1546723 "
http://www.hinduismtoday.com/archives/2009/1-3/pdf/Hinduism-Today_Jan-Feb-Mar_2009.pdf" "Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/530.5 (KHTML, like Gecko) Chrome/2.0.172.37 Safari/530.5"
76.70.84.23 - - [29/Jul/2009:16:57:06 -0700] "GET /archives/2009/1-3/pdf/Hin
duism-Toda
y_Jan-Feb-
Mar_2009.p
df HTTP/1.1" 206 2359920 "
http://www.hinduismtoday.com/archives/2009/1-3/pdf/Hinduism-Today_Jan-Feb-Mar_2009.pdf" "Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/530.5 (KHTML, like Gecko) Chrome/2.0.172.37 Safari/530.5"
76.70.84.23 - - [29/Jul/2009:16:57:13 -0700] "GET /archives/2009/1-3/pdf/Hin
duism-Toda
y_Jan-Feb-
Mar_2009.p
df HTTP/1.1" 206 1219067 "
http://www.hinduismtoday.com/archives/2009/1-3/pdf/Hinduism-Today_Jan-Feb-Mar_2009.pdf" "Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/530.5 (KHTML, like Gecko) Chrome/2.0.172.37 Safari/530.5"
76.70.84.23 - - [29/Jul/2009:16:57:15 -0700] "GET /archives/2009/1-3/pdf/Hin
duism-Toda
y_Jan-Feb-
Mar_2009.p
df HTTP/1.1" 206 11206313 "
http://www.hinduismtoday.com/archives/2009/1-3/pdf/Hinduism-Today_Jan-Feb-Mar_2009.pdf" "Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/530.5 (KHTML, like Gecko) Chrome/2.0.172.37 Safari/530.5"
TWO
58.185.0.114 - - [30/Jul/2009:00:50:17 -0700] "GET /archives/2009/1-3/pdf/Hin
duism-Toda
y_Jan-Feb-
Mar_2009.p
df HTTP/1.1" 200 19030363 "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30618)"
58.185.0.114 - - [30/Jul/2009:00:50:20 -0700] "GET /archives/2009/1-3/pdf/Hin
duism-Toda
y_Jan-Feb-
Mar_2009.p
df HTTP/1.1" 206 798 "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30618)"
58.185.0.114 - - [30/Jul/2009:00:50:21 -0700] "GET /archives/2009/1-3/pdf/Hin
duism-Toda
y_Jan-Feb-
Mar_2009.p
df HTTP/1.1" 206 4096 "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30618)"
58.185.0.114 - - [30/Jul/2009:00:50:22 -0700] "GET /archives/2009/1-3/pdf/Hin
duism-Toda
y_Jan-Feb-
Mar_2009.p
df HTTP/1.1" 206 673 "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30618)"
58.185.0.114 - - [30/Jul/2009:00:50:18 -0700] "GET /archives/2009/1-3/pdf/Hin
duism-Toda
y_Jan-Feb-
Mar_2009.p
df HTTP/1.1" 206 743896 "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30618)"
58.185.0.114 - - [30/Jul/2009:00:50:22 -0700] "GET /archives/2009/1-3/pdf/Hin
duism-Toda
y_Jan-Feb-
Mar_2009.p
df HTTP/1.1" 206 1760 "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30618)"
58.185.0.114 - - [30/Jul/2009:00:50:23 -0700] "GET /archives/2009/1-3/pdf/Hin
duism-Toda
y_Jan-Feb-
Mar_2009.p
df HTTP/1.1" 206 2336 "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30618)"
58.185.0.114 - - [30/Jul/2009:00:50:24 -0700] "GET /archives/2009/1-3/pdf/Hin
duism-Toda
y_Jan-Feb-
Mar_2009.p
df HTTP/1.1" 206 1920123 "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30618)"
58.185.0.114 - - [30/Jul/2009:00:50:33 -0700] "GET /archives/2009/1-3/pdf/Hin
duism-Toda
y_Jan-Feb-
Mar_2009.p
df HTTP/1.1" 206 1551351 "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30618)"
58.185.0.114 - - [30/Jul/2009:00:50:41 -0700] "GET /archives/2009/1-3/pdf/Hin
duism-Toda
y_Jan-Feb-
Mar_2009.p
df HTTP/1.1" 206 2359710 "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30618)"
58.185.0.114 - - [30/Jul/2009:00:50:53 -0700] "GET /archives/2009/1-3/pdf/Hin
duism-Toda
y_Jan-Feb-
Mar_2009.p
df HTTP/1.1" 206 1223229 "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30618)"
58.185.0.114 - - [30/Jul/2009:00:50:59 -0700] "GET /archives/2009/1-3/pdf/Hin
duism-Toda
y_Jan-Feb-
Mar_2009.p
df HTTP/1.1" 206 1306358 "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30618)"
58.185.0.114 - - [30/Jul/2009:00:51:07 -0700] "GET /archives/2009/1-3/pdf/Hin
duism-Toda
y_Jan-Feb-
Mar_2009.p
df HTTP/1.1" 206 1094190 "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30618)"
58.185.0.114 - - [30/Jul/2009:00:51:14 -0700] "GET /archives/2009/1-3/pdf/Hin
duism-Toda
y_Jan-Feb-
Mar_2009.p
df HTTP/1.1" 206 1051943 "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30618)"
58.185.0.114 - - [30/Jul/2009:00:51:20 -0700] "GET /archives/2009/1-3/pdf/Hin
duism-Toda
y_Jan-Feb-
Mar_2009.p
df HTTP/1.1" 206 1229836 "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30618)"
58.185.0.114 - - [30/Jul/2009:00:51:26 -0700] "GET /archives/2009/1-3/pdf/Hin
duism-Toda
y_Jan-Feb-
Mar_2009.p
df HTTP/1.1" 206 1247949 "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30618)"
58.185.0.114 - - [30/Jul/2009:00:51:33 -0700] "GET /archives/2009/1-3/pdf/Hin
duism-Toda
y_Jan-Feb-
Mar_2009.p
df HTTP/1.1" 206 2288852 "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30618)"
58.185.0.114 - - [30/Jul/2009:00:51:43 -0700] "GET /archives/2009/1-3/pdf/Hin
duism-Toda
y_Jan-Feb-
Mar_2009.p
df HTTP/1.1" 206 2428356 "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30618)"
58.185.0.114 - - [30/Jul/2009:00:51:53 -0700] "GET /archives/2009/1-3/pdf/Hin
duism-Toda
y_Jan-Feb-
Mar_2009.p
df HTTP/1.1" 206 416330 "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30618)"
58.185.0.114 - - [30/Jul/2009:00:51:56 -0700] "GET /archives/2009/1-3/pdf/Hin
duism-Toda
y_Jan-Feb-
Mar_2009.p
df HTTP/1.1" 206 175960 "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30618)"
THREE
24.147.248.93 - - [19/Jul/2009:09:32:20 -0700] "GET /archives/2009/1-3/pdf/Hin
duism-Toda
y_Jan-Feb-
Mar_2009.p
df HTTP/1.1" 200 19030363 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.1) Gecko/20090715 Firefox/3.5.1 (.NET CLR 3.5.30729)"
24.147.248.93 - - [19/Jul/2009:09:32:22 -0700] "GET /archives/2009/1-3/pdf/Hin
duism-Toda
y_Jan-Feb-
Mar_2009.p
df HTTP/1.1" 206 18910907 "
http://www.hinduismtoday.com/modules/wfdownloads/visit.php?cid=19&lid=25" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.1) Gecko/20090715 Firefox/3.5.1 (.NET CLR 3.5.30729)"
24.147.248.93 - - [19/Jul/2009:09:32:23 -0700] "GET /archives/2009/1-3/pdf/Hin
duism-Toda
y_Jan-Feb-
Mar_2009.p
df HTTP/1.1" 206 1035 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.1) Gecko/20090715 Firefox/3.5.1 (.NET CLR 3.5.30729)"
24.147.248.93 - - [19/Jul/2009:09:32:23 -0700] "GET /archives/2009/1-3/pdf/Hin
duism-Toda
y_Jan-Feb-
Mar_2009.p
df HTTP/1.1" 206 1035 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.1) Gecko/20090715 Firefox/3.5.1 (.NET CLR 3.5.30729)"
24.147.248.93 - - [19/Jul/2009:09:32:22 -0700] "GET /archives/2009/1-3/pdf/Hin
duism-Toda
y_Jan-Feb-
Mar_2009.p
df HTTP/1.1" 206 643053 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.1) Gecko/20090715 Firefox/3.5.1 (.NET CLR 3.5.30729)"
24.147.248.93 - - [19/Jul/2009:09:32:24 -0700] "GET /archives/2009/1-3/pdf/Hin
duism-Toda
y_Jan-Feb-
Mar_2009.p
df HTTP/1.1" 206 4333 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.1) Gecko/20090715 Firefox/3.5.1 (.NET CLR 3.5.30729)"
24.147.248.93 - - [19/Jul/2009:09:32:25 -0700] "GET /archives/2009/1-3/pdf/Hin
duism-Toda
y_Jan-Feb-
Mar_2009.p
df HTTP/1.1" 206 910 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.1) Gecko/20090715 Firefox/3.5.1 (.NET CLR 3.5.30729)"
[snip] Total of 80 lines of 206's!
24.147.248.93 - - [19/Jul/2009:09:33:31 -0700] "GET /archives/2009/1-3/pdf/Hin
duism-Toda
y_Jan-Feb-
Mar_2009.p
df HTTP/1.1" 206 673186 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.1) Gecko/20090715 Firefox/3.5.1 (.NET CLR 3.5.30729)"
24.147.248.93 - - [19/Jul/2009:09:33:31 -0700] "GET /archives/2009/1-3/pdf/Hin
duism-Toda
y_Jan-Feb-
Mar_2009.p
df HTTP/1.1" 206 776159 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.1) Gecko/20090715 Firefox/3.5.1 (.NET CLR 3.5.30729)"
24.147.248.93 - - [19/Jul/2009:09:33:31 -0700] "GET /archives/2009/1-3/pdf/Hin
duism-Toda
y_Jan-Feb-
Mar_2009.p
df HTTP/1.1" 206 979061 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.1) Gecko/20090715 Firefox/3.5.1 (.NET CLR 3.5.30729)"
24.147.248.93 - - [19/Jul/2009:09:33:38 -0700] "GET /archives/2009/1-3/pdf/Hin
duism-Toda
y_Jan-Feb-
Mar_2009.p
df HTTP/1.1" 206 416330 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.1) Gecko/20090715 Firefox/3.5.1 (.NET CLR 3.5.30729)"
24.147.248.93 - - [19/Jul/2009:09:33:44 -0700] "GET /archives/2009/1-3/pdf/Hin
duism-Toda
y_Jan-Feb-
Mar_2009.p
df HTTP/1.1" 206 175960 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.1) Gecko/20090715 Firefox/3.5.1 (.NET CLR 3.5.30729)"
=========
Mahalo Nui Loa (I'm on Kauai- smile)