Nagios Support Forum

Update to 5.2.9 results in a constant flood of http errors:
"POST /nagiosxi/backend/ HTTP/1.1" 301 369 "-" "BinGet/1.00.A (http://www.bin-co.com/php/scripts/load/)"

Status code 301 represents a URL that has been "moved permanently". It's not an error strictly speaking, but seeing "a constant flood" of any unexpected HTTP responses can be a point of concern.

Could you please try the following things:

• Visit http://x.x.x.x/nagiosxi/backend/?cmd=hello (where x.x.x.x is your Nagios XI server) and post the content that page displays
• Post the contents of your /etc/httpd/conf.d/nagiosxi.conf file
• Post (or PM) your Program URL and External URL ("Admin" from the top menu, then "System Settings" from the left menu)

<productinfo>
<productname>Nagios XI</productname>
<productversion>5.2.9</productversion>
<productbuild>1465567804</productbuild>
</productinfo>
<apis>
<backend>https://xxxxx.uw.edu/nagiosxi/backend/i ... p</backend>
</apis>
------------------------------------------------------------------------------------------------------
nagiosxi.conf
----------------
<Directory "/usr/local/nagiosxi/html">
Options None
AllowOverride None
Order allow,deny
Allow from all
</Directory>
Alias /nagiosxi "/usr/local/nagiosxi/html"
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule nagiosxi/api/v1/(.*)$ /usr/local/nagiosxi/html/api/v1/index.php?request=$1 [QSA,NC,L]
</IfModule>

Redirecting from HTTP to HTTPS will (generally) create a 301 response code for the request. This appears to be what is happening here.

Are you experiencing any interruptions of your API calls (or your XI installation in general)?

This is the third year of continuous operation for this instance.
The issue with "www.bin-co.com" started immediately after the one-click update to version 5.2.9.
It also happen on our development instance (in a different data center) which has been running only a few months immediately after the one-click update to version 5.2.9.
In summary:
No "www.bin-co.com" log flood prior to version 5.2.9.
On the only two systems we updated to version 5.2.9 our logs are flooded with messages that include the sub-string "www.bin-co.com".

What version of XI did you upgrade from?

Those "www.bin-co.com" messages often pertain to internal AJAX calls that XI is doing. Some of our internal code makes use of the plugin listed on that page (http://bin-co.com/php/scripts/load/) showing up in your logs.

We each upgraded from version 5.2.8.

I cannot find any recent changes to internal functions that would suddenly cause these messages to appear in your access_log. Even on an old 5.2.3 installation we still see them.