httpd-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Sean Allen <s...@ardishealth.com>
Subject Re: [users@httpd] Conditional Error Logging
Date Tue, 12 Feb 2008 01:10:16 GMT

On Feb 11, 2008, at 4:19 PM, Joshua Slive wrote:

> On Feb 11, 2008 3:54 PM, Sean Allen <sean@ardishealth.com> wrote:
>>
>>
>> On Feb 11, 2008, at 3:52 PM, Joshua Slive wrote:
>>
>>> On Feb 11, 2008 3:22 PM, Sean Allen <sean@ardishealth.com> wrote:
>>>> I want to not log certain errors based on the user agent of the
>>>> requestor.
>>>>
>>>> Is there anyway to do that?
>>>
>>> No. Just post-filter your log to remove what you aren't interested  
>>> in.
>>>
>>
>> Problem there is that at that point, the user agent info is lost.
>> And the ip addresses are constantly changing.
>>
>> There isnt a convenient way to post filter.
>>
>> Might be time to hack the apache source. Arg.
>
> Give us more specifics about the exact error type and what you need to
> get out of the logs and we might have more suggestions.
>

We have the 'hackersafe' logo on our site.
They do nightly script kiddie etc type probes that result in a ton of  
garbage in our error logs.

Like:

[Sun Feb 10 01:58:08 2008] [error] [client 216.35.7.102] File does not  
exist: /ah/sites/dynamic/public/jretest.html

At this point the only way to filter out is by ip address which is a  
moving target as they have many and had
more all the time.

When the request are made, they send a custom user agent that we  
ignore for access log purposes.
Its only the error log that gets crammed with garbage at this point  
and tracking their ip address
changes is a bit time consuming compared to just not logging it at all.



> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server  
> Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
>   "   from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>


---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org


Mime
View raw message