logo
Apache Lounge
Webmasters

 

About Forum Index Downloads Search Register Log in RSS X


Keep Server Online

If you find the Apache Lounge, the downloads and overall help useful, please express your satisfaction with a donation.

or

Bitcoin

A donation makes a contribution towards the costs, the time and effort that's going in this site and building.

Thank You! Steffen

Your donations will help to keep this site alive and well, and continuing building binaries. Apache Lounge is not sponsored.
Post new topic   Forum Index -> Apache View previous topic :: View next topic
Reply to topic   Topic: conditional logging
Author
Sparky1



Joined: 01 Mar 2007
Posts: 4
Location: Canada

PostPosted: Thu 01 Mar '07 18:54    Post subject: conditional logging Reply with quote

Hi!
First time caller, long time listener Smile
This could be a complete n00bie question, but my 'extensive research' turned up nothing.
I'd like to set up conditional logging based on the "status code"
This may seem a little odd, but this is what's happening--
I'm running Apache 2.0.59 and mod security
I'm using mod security mostly to stop spammers, and have compiled (as well as downloaded from others) extensive spammer lists.
Even though mod security denies access to these spammers to spam my website, their requests still show up in my log files. Since my website is getting spammed 1 to 2 times a second, my access.log file is huge on a daily basis--I rotate it once a day, but I'm getting sometimes a 10 meg file for 1 day. I'd like to reduce that to 'legitimate' accesses.
My solution thus far is to use conditional logging for Remote_Host and Referer, but that doesn't by far eliminate them all from the log file.
I figured if I could use a SetEnvIf for the status code and not log '301' or a '410' (or whatever I tell mod security to set the response to), then the spammers stopped by mod security would not be logged in my access.log file.
I tried 'SetEnvIf Status_Code 301 omitlog-req' but that didn't work (didn't think it'd be that easy Smile )
Anyway, any help would be appreciated.
Sparky
Back to top
James Blond
Moderator


Joined: 19 Jan 2006
Posts: 7371
Location: Germany, Next to Hamburg

PostPosted: Wed 07 Mar '07 23:50    Post subject: Reply with quote

Can you post the line you made in httpd.conf.

e.g.
Code:

SetEnvIf Remote_Addr "127\.0\.0\.1" dontlog
SetEnvIf Remote_Addr "192\.168\.178\.20" dontlog
SetEnvIf Remote_Addr "212\.105\.204\.244" dontlog

CustomLog /server2/logs/access.log common env=!dontlog
Back to top
Sparky1



Joined: 01 Mar 2007
Posts: 4
Location: Canada

PostPosted: Thu 08 Mar '07 5:49    Post subject: Reply with quote

Here's my logging info for Apache--

Code:
LogLevel warn

SetEnvIfNoCase Request_URI \.gif omitlog-req
SetEnvIfNoCase Request_URI \.jpg omitlog-req
SetEnvIfNoCase Request_URI \.ico omitlog-req
SetEnvIfNoCase Request_URI \.bmp omitlog-req
SetEnvIfNoCase Request_URI \.png omitlog-req
SetEnvIfNoCase Request_URI \.mid omitlog-req
SetEnvIfNoCase Request_URI "^/bars" omitlog-req
SetEnvIfNoCase Request_URI header.php omitlog-req
SetEnvIfNoCase Request_URI "^/cgi-bin/tb-inc\.*" omitlog-req

# log spammers
SetEnvIfNoCase Referer allabouttramadol\.blogspot\.com omitlog-req
SetEnvIfNoCase Referer tramadolonlinediscountpharmacy\.blogspot\.com omitlog-req
SetEnvIfNoCase Referer anna-av\.blogspot\.com omitlog-req
SetEnvIfNoCase Referer tramadol omitlog-req
SetEnvIfNoCase Remote_Host "81.95.148.50" omitlog-req


SetEnvIfNoCase Remote_Host "66.46.10.130" omitlog-req
SetEnvIfNoCase Remote_Host "googlebot" omitlog-req
SetEnvIfNoCase Remote_Host "inktomisearch" omitlog-req
SetEnvIfNoCase Remote_Host "search.live.com" omitlog-req

LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%a %h %l %u %t \"%r\" %>s %b" common

ErrorLog c:/www/logs/error.log
CustomLog c:/www/logs/access.log combined env=!omitlog-req
CustomLog c:/www/logs/allaccess.log combined


If anyone can let me know how to add set a conditional logging entry for status code, it would be appreciated.

Thanks!
Back to top


Reply to topic   Topic: conditional logging View previous topic :: View next topic
Post new topic   Forum Index -> Apache