QNAP's daemon_mgr thttpd health check resulting in annoying 404 error in syslog requesting "HEAD /XXXXXX" every 30 sec

esl · Post by **esl** » Mon Oct 18, 2021 4:25 am

I am a fan of logging so enabled 'syslog-ng' via Entware.

For me, this extra insight is helpful to ensure healthy operation of my NAS device (once a linux admin, always a linux admin).

For at least a few years my syslog has reported a peculiar log message that looks a little like this, repeated about 30 seconds of every minute of every day:

Code: Select all

Oct 17 12:19:38 localhost _thttpd_[22252]: 127.0.0.1 - - "HEAD /XXXXXX HTTP/1.1" 404 - "" "Wget/1.20.3 (linux-gnu)"

Today, I decided to look into it.

It appears that this is the mechanism that QNAP developers are using to validate that Qthttpd/thttpd (responsible for QNAP's web-based management console) is operational. If the web server does not respond (specifically, if the header of the bogus request does not come back with the "Content-type" header) then daemon_mgr restarts the Qthttpd/thttpd scripts in /etc/init.d to try to self-heal from any crash that may have occurred.

You can see the following plaintext command if you examine (less) the /sbin/daemon_mgr binary:

Code: Select all

/bin/wget-s -4 -t 2 -T 10 --server-response --spider http://127.0.0.1:%d/XXXXXX 2>&1 | /bin/grep "Content-type" -i 1>/dev/null

The %d is replaced by the port passed in via the startup scripts, which I suspect is returned by `/sbin/getcfg System "Web Access Port"`

While this approach does achieve the objective of a health check, it does also produce 2880 log errors/day (or 1051200/year), translating to about 118MB of pre-rotated storage per annum which is nothing but still something that gets in the way of a clean log.

I am wondering if there may be a non-logging alternative to accomplish this same health check? Or alternatively a syslog-ng filter/config that allows me to just drop reporting this request?

Sidenote: if one makes a Bad Request (400) to the web server, the header info is returned but the request is not logged by Apache

For example, if you telnet to the server port and send an invalid HTTP command like "healthcheck" Apache comes back with "HTTP/1.1 400 Bad Request" with the same header info and the request is not logged by Apache--I am not recommending this approach, but just found that interesting!

I have a sneaky suspicion I am not the only QNAP power user that was confused by this HEADER request.

Thanks for any advice or solutions!