POST /login/?login_only=1 HTTP/1.1 entries in access log

After being warned of "Failed attempts" of loggin by the firewall I figure out how to see what attempts were successful in access.log. I see a several entries that I am not sure about. They are similar to the following:

ip address "get /http/1.1"
ip address "Post/login/?login_only=1 HTTP/1.1"

Are these usual entries?
What do they mean?

Thanks
Ed

 

Thanks.

Don't see that in the access.log. I looked there because I saw that
The file "login_log" does not include successful authentications. So, since it is in the access.log file I assumed it had been successfull and so was wondering what the codes meant.

 

Yes I do. That is what peaked my interest. Have gotten emails saying so and so failed attempt to log into one account or another (usually not a real account name but close enough to make you think they knew something). I understand failed attempts are to be expected and it is good news - the firewall is really working. My concern was what if they succeed, how would I know, that led me to the access.log which, as I understand it, logs successful attempts. I find several entries in the access.log from suspicious IPs with the codes in my first post. I don't know what those codes mean they succeeded in doing.