Over at the Early Retirement Forum, for which I assist in maintaining the forum software, I've been adding RSS icons and "Add to [My Yahoo!, Google, Bloglines, My MSN, etc.]" icons and working on getting a sensible RSS link and info system laid out. I have a news fader/ticker item that lists some of the icons and points to more RSS feed info. After collecting a number of icons in the images directory I decided to make and rss subfolder and move the images there so as not to clutter up the site owner's images directory with RSS icons.
After moving the images I updated all my image links and made a mental note to check the log for 404 erros in the next day or two. The next day I checked, and one IP was creating three 404 errors every 30 seconds looking for the old image locations! Yikes! I tracked which user it was, and it's a user that I know uses RSS but is not destructive. But there were no RSS feed requests associated with the image requests, so my first conclusion that he's requesting RSS feeds to often was not correct. I made symlinks for the images in their original locations to stop the 404 errors and hopefully get the user agent, IE6 on WinXP, to cache the icons and quit requesting them.
I figured it out after checking the referer fields: The user must've left his browser open to the forum index before I made the image location changes. So his browser is staying open unattended all day while the news fader rotates through the messages and links to the images' old addresses every 30 seconds or so. That's why the images are being requested while he's not hitting page views and not showing up in Who's Online.
Normally this wouldn't be a problem because the browser will cache the images and not reload them. But every now and then it will check to see if the image changed, but in this case it found the image missing, so after that it re-checked every time the image was requested, which was every time the image came up in the news fader rotation.
Now that I've symlinked the images back to their original location the user's browser should cache the images and quit requesting them every time they come up on the fader. Next time he gets on the forum or closes the browser the issue will fix itself and I can take away the symlinks.
I love figuring stuff out. Note how some of the information seemed relevant at first but wasn't: the icons were about RSS, and the IP belonged to a user known to use RSS, but it turns out that had nothing to do with the issue. On the other hand I guess we're lucky it wasn't an anonymous user who left his browser open or I might've assumed he was misbehaving somehow and banned his IP telling him he's making too many requests when from his point of view he did nothing of the sort.