Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an apache web server which is configured to allow access via client certificate to only a few people. I cannot lock down by IP because the certificate holders could potentially connect from anywhere.

Apache currently returns 403 to anyone not presenting a valid certificate or trying to access an invalid URL, but since the machine has no ACL restrictions it is frequently scanned for vulnerabilities. These scans cause quite a lot of noise in the logs.

Is there a way to log to a different file based on the response code? Is it possible to send all logging for requests which result in a 403 to a different file?

share|improve this question
up vote 7 down vote accepted

You can get Apache to pipe the custom log to a script. So for example, change the CustomLog entry in the vhost to:

CustomLog "|/path/to/script"

The you can have a script that does something like:

while ($log = <STDIN>) {
    if ($log =~ /403/) {
        open(LOG, '>>/path/to/403log');
        print LOG $log;
    } else {
        open(LOG, '>>/path/to/mainlog');
        print $log LOG;

The above script is untested, but it should give you an idea of what you can do.

share|improve this answer
That's cool. :) Another approach using CustomLog: if using syslog-ng, you can use CustomLog directive like CustomLog "/usr/bin/logger ..." and then do the log file separation in syslog-ng pattern matching. – Janne Pikkarainen Jan 27 '11 at 13:04
Yup, that would also work. +1 – Niall Donegan Jan 27 '11 at 13:12
Thanks for the tip, Niall. +1 – Jonathan Rioux Jan 27 '11 at 13:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.