http://scratchy.sourceforge.net/ Scratchy is an Apache Web Server log parser and HTML report generator written in Python.
http://mandrake.vmlinuz.ca/bin/view/Main/ApachelogManagement
http://www.keithjbrown.co.uk/vworks/unix/logs.shtml http://www.keithjbrown.co.uk/vworks/unix/logs.shtml
http://www.keithjbrown.co.uk/vworks/mysql/mysql_pA.shtml http://httpd.apache.org/docs/env.html
http://diveintomark.org/projects/pysitestats/index.html
http://www.mrunix.net/webalizer/download.html
http://www.apache-httpd.com/msg/6456.html
http://www.monkeynoodle.org/comp/tools
# Redirect allows you to tell clients about documents which used to exist in
# your server's namespace, but do not anymore. This allows you to tell the
# clients where to look for the relocated document.
# Format: Redirect old-URI new-URL
RedirectMatch ^.*\.(exe|dll|ida).* http://192.0.2.1
#
RewriteCond %{HTTP_USER_AGENT} Yahoo\!\ Slurp
RewriteRule ^.*$ - [F]
SetEnvIf Request_URI "(\.gif|\.jpe?g|\.png|\.css|\.js)$" !log
#make sure we log legit requests
SetEnvIf Request_Method "(GET)|(POST)|(PUT)|(DELETE)|(HEAD)" log
# SEARCH is not a legit method in Apache and the objective of a current
# worm. So I am going to send it to oblivion. It creates broken log
# files if I don't
SetEnvIf Request_Method "(SEARCH)" worm
# RegEx's to trap a number of windows worms I know of. Send them to
# the worm logfile and not the one I mine for data.
SetEnvIf Request_URI "_vti_inf\.html$" worm !log
SetEnvIf Request_URI "^/_mem_bin/" worm !log
SetEnvIf Request_URI "^/_vti_bin/" worm !log
SetEnvIf Request_URI "^/c/" worm !log
SetEnvIf Request_URI "^/d/" worm !log
SetEnvIf Request_URI ^/scripts/ worm !log
SetEnvIfNoCase Request_URI "^/msadc/" worm !log
#Code Red
SetEnvIf Request_URI "default\.ida" worm !log
SetEnvIfNoCase Request_URI "null\.ida" worm !log
#NIMDA
SetEnvIf Request_URI "cmd\.exe" worm !log
SetEnvIf Request_URI "root\.exe" worm !log
SetEnvIf Request_URI "Admin\.dll" worm !log
# These are optional
# This sets it so that requests for your images aren't logged.
SetEnvIf Request_URI "(\.gif|\.jpe?g|\.png|\.css|\.js)$" !log
# this makes it so that requests from my home lan aren't logged.
SetEnvIf Remote_Addr "^192\.168\." !log
# If I'm on the box testing I don't want that logged.
SetEnvIf Remote_Addr "^127\.0\." !log
# This is an example of how to not log XXX referrer.
SetEnvIf referer "somedangsite\.com" !log
# Now set where the logs are. I'm sending worms to /dev/null but
# it could be any full path.
CustomLog /var/log/httpd/access_log combined env=log
CustomLog /dev/null combined env=worm
Tags: linux | gnu | unix | howto | apache | webdserver | php | mysql | python | www | web | https
Linux/Apache/Logfile (last edited 2008-11-17 16:13:48 by )
