# Access log get /

**URL:** <https://community.traefik.io/t/access-log-get/11225>\
**Category:** Traefik v2\
**Tags:** docker\
**Created:** [July 19, 2021, 12:13pm UTC](https://community.traefik.io/t/access-log-get/11225 "2021-07-19T12:13:28Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![thopic](https://avatars.discourse-cdn.com/v4/letter/t/b487fb/32.png) [@thopic](https://community.traefik.io/u/thopic)\
**Post date:** [July 19, 2021, 12:13pm UTC](https://community.traefik.io/t/access-log-get/11225/1 "2021-07-19T12:13:28Z")

</div>

Hi,

sorry if this topic has already been addressed, I didn't find any history (but I might have the wrong keywords).

I am using traefik as main reverse-proxy for a docker infrastructure for a while now, and I've always wanted to know why there is a lot of 404 hits for `/` resource as you can see in example below.

```auto
traefik | xxx.xxx.xxx.xxx - - [19/Jul/2021:11:59:26 +0000] "GET / HTTP/1.1" 404 19 "-" "-" 47981 "-" "-" 0ms

```

I did read [this topic](https://community.traefik.io/t/details-on-404-request/6038) but it is case-specific so I can't apply the solution to my situation nor use it for investigation.

Does anyone have some clues for me to understand these requests?

Thanks a lot!

thopic

---

<div class="post-metadata">

**Author:** ![daniel.tomcej](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/daniel.tomcej/32/262_2.png) [@daniel.tomcej](https://community.traefik.io/u/daniel.tomcej)\
**Post date:** [July 19, 2021, 4:58pm UTC](https://community.traefik.io/t/access-log-get/11225/2 "2021-07-19T16:58:43Z")

</div>

Hello @thopic,

Often this sort of entry is caused by a healthcheck of some sort. Have you configured http healthchecks on your Traefik service?

---

<div class="post-metadata">

**Author:** ![thopic](https://avatars.discourse-cdn.com/v4/letter/t/b487fb/32.png) [@thopic](https://community.traefik.io/u/thopic)\
**Post date:** [July 19, 2021, 5:18pm UTC](https://community.traefik.io/t/access-log-get/11225/3 "2021-07-19T17:18:45Z")

</div>

Hello @daniel.tomcej,

I do make some API requests on my docker services but not directly on traefik. Furthermore, lots of these requests (`GET /`) come from IP addresses I don't own (the vast majority actually).  
I understand this behavior might be caused by bots, but doing what? And how is it possible to hit `/` if the request is not managed by any traefik router?

Thank you for your help 🙂

---

<div class="post-metadata">

**Author:** ![daniel.tomcej](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/daniel.tomcej/32/262_2.png) [@daniel.tomcej](https://community.traefik.io/u/daniel.tomcej)\
**Post date:** [July 19, 2021, 6:31pm UTC](https://community.traefik.io/t/access-log-get/11225/4 "2021-07-19T18:31:56Z")

</div>

Hello @thopic,

> I understand this behavior might be caused by bots, but doing what?

If you expose a webserver or a proxy on the web, it will get scraped and crawled by a variety of bots for a variety of reasons (indexing, IP address usage, etc). Some bots are malicious, looking for exposed systems with vulnerabilities, but not all bots are.

> And how is it possible to hit `/` if the request is not managed by any traefik router?

The HTTP request is processed whether there is matching route or not...If there is no matching route, a 404 is returned, which is exactly what is happening in your log.

---

<div class="post-metadata">

**Author:** ![thopic](https://avatars.discourse-cdn.com/v4/letter/t/b487fb/32.png) [@thopic](https://community.traefik.io/u/thopic)\
**Post date:** [July 19, 2021, 6:48pm UTC](https://community.traefik.io/t/access-log-get/11225/5 "2021-07-19T18:48:59Z")

</div>

Hm okay... Sorry I see you are giving me the explanation, but I still feel confused...

I forgot to mention that I have a maintenance service that should collect any request that doesn't match any route (but now I guess, I'm wrong). I give you below the details of this configuration :

```yaml

services:
  web:
      build: ..
      image: my_apache:7.4.21
      container_name: maintenance
      networks:
        - proxy
      expose:
        - "80"
      restart: unless-stopped
      volumes:
        - /usr/lib/locale/:/usr/lib/locale/
        - /etc/localtime:/etc/localtime:ro
        - ${DATA_PATH}/public-html:/var/www/html/
      labels:
        - "traefik.enable=true"
        - "traefik.http.routers.maintenance-http.rule=HostRegexp(`{catchall:.+}`)"
        - "traefik.http.routers.maintenance-http.entrypoints=web"
        - "traefik.http.routers.maintenance-http.priority=1"
        - "traefik.http.routers.maintenance-https.rule=HostRegexp(`{catchall:.+}`)"
        - "traefik.http.routers.maintenance-https.entrypoints=websecure"
        - "traefik.http.routers.maintenance-https.priority=1"
        - "traefik.http.routers.maintenance-https.tls=true"
        - "co.elastic.logs/module=apache"
        - "co.elastic.logs/fileset=access"
                        
networks:
  proxy:
    external: true

```

If my configuration is right, it means these requests are done directly with the ip address? Like [http://my.ip.add.ress](http://my.ip.add.ress) ?

Thank you again

---

<div class="post-metadata">

**Author:** ![daniel.tomcej](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/daniel.tomcej/32/262_2.png) [@daniel.tomcej](https://community.traefik.io/u/daniel.tomcej)\
**Post date:** [July 19, 2021, 6:59pm UTC](https://community.traefik.io/t/access-log-get/11225/6 "2021-07-19T18:59:44Z")

</div>

Hello @thopic,

Yes, many bots will use raw IP addresses, since there are far less of them than domain names. You can also enable further headers if you feel it would help out your investigation: ([Access Logs - Traefik](https://doc.traefik.io/traefik/observability/access-logs/#limiting-the-fieldsincluding-headers))

Many firewalls allow you to block requests that don't match your domain list to filter out these kinds of requests.

---

<div class="post-metadata">

**Author:** ![thopic](https://avatars.discourse-cdn.com/v4/letter/t/b487fb/32.png) [@thopic](https://community.traefik.io/u/thopic)\
**Post date:** [July 19, 2021, 7:42pm UTC](https://community.traefik.io/t/access-log-get/11225/7 "2021-07-19T19:42:31Z")

</div>

It sounds clear enough. Thank you very much @daniel.tomcej for these tips 🙂

---

<div class="post-metadata">

**Author:** ![thopic](https://avatars.discourse-cdn.com/v4/letter/t/b487fb/32.png) [@thopic](https://community.traefik.io/u/thopic)\
**Post date:** [July 20, 2021, 2:51pm UTC](https://community.traefik.io/t/access-log-get/11225/8 "2021-07-20T14:51:48Z")

</div>

After all, I still didn't understand why the request could not be handled by any router if there was at least the maintenance service up. My mistake was to use `+` in the regex although it is possible (eg with telnet) not to set the HTTP `Host` header.  
Pfiou

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/b/bd81ebdb578656e76e56ff3cc3eed021d3ba132d.png) [@system](https://community.traefik.io/u/system)\
**Post date:** [July 23, 2021, 2:52pm UTC](https://community.traefik.io/t/access-log-get/11225/9 "2021-07-23T14:52:28Z")

</div>

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.