Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an apache web server which is configured to allow access via client certificate to only a few people. I cannot lock down by IP because the certificate holders could potentially connect from anywhere.

Apache currently returns 403 to anyone not presenting a valid certificate or trying to access an invalid URL, but since the machine has no ACL restrictions it is frequently scanned for vulnerabilities. These scans cause quite a lot of noise in the logs.

Is there a way to log to a different file based on the response code? Is it possible to send all logging for requests which result in a 403 to a different file?

share|improve this question
add comment

1 Answer

up vote 6 down vote accepted

You can get Apache to pipe the custom log to a script. So for example, change the CustomLog entry in the vhost to:

CustomLog "|/path/to/script"

The you can have a script that does something like:

#!/usr/bin/perl
while ($log = <STDIN>) {
    if ($log =~ /403/) {
        open(LOG, '>>/path/to/403log');
        print LOG $log;
        close(LOG);
    } else {
        open(LOG, '>>/path/to/mainlog');
        print $log LOG;
        close(LOG);
    }
}

The above script is untested, but it should give you an idea of what you can do.

share|improve this answer
1  
That's cool. :) Another approach using CustomLog: if using syslog-ng, you can use CustomLog directive like CustomLog "/usr/bin/logger ..." and then do the log file separation in syslog-ng pattern matching. –  Janne Pikkarainen Jan 27 '11 at 13:04
    
Yup, that would also work. +1 –  Niall Donegan Jan 27 '11 at 13:12
    
Thanks for the tip, Niall. +1 –  Jonathan Rioux Jan 27 '11 at 13:38
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.