Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Let's say we have a huge list of clients (~30) all running on the same server under different users (and other security settings).

I need to write a "spy/logging" script which is able to handle all HTTP traffic without actually modifying it or hindering its execution.

Usually, we have a setup as follows:

Web Browser <--> Apache <--> PHP/FCGI

I need a setup as follows:

Web Browser ---> Apache ---> PHP/FCGI
                      '----> PHP/CLI (or any other script, module...)

I need this set up so that I don't have to change each client's code (and having to maintain it as well), so instead I have only one script to have to manage by myself.

One way to do this is to somehow get a pcap daemon triggering a script of mine each time it receives an HTTP request, but I figured someone out there must have a better way of doing this?

share|improve this question
add comment

3 Answers

I can offer this variants:

  • Switch to pure CGI instead of FCGI, and write script, that will fork your script, and than give control to php-cgi. To make php files executable without adding shebang, use binfmt_misc This will significantly decrease performance, but may be used for testing.
  • Use some king of reverse proxy(like nginx) with some tricky settings in front of apache.
  • Slightly patch php-fcgi, so that it will fork your script on every request.
share|improve this answer
    
1. Not an option. 2. I don't quite understand that? 3. Ughhh... –  Christian Sep 19 '11 at 8:52
    
I lurked and didn't find the way for nginx to do 2nd... maybe I'm wrong and this is impossible. Then the fourth way: create very special apache log format, with all request information and headers. Create pipe file, configure apache to write this log to it. Use pipe file as input for script, that will fork your script for each request. Or this may be just regular file, and script will use inotify-tools to launch your script every time file is changed. What is original problem, that you try to solve in such unusual way? –  Selivanov Pavel Sep 19 '11 at 9:26
    
Those seem more practical ideas. I'm trying to do a basic IDS system with a specific entry point (as opposed to other IDSes). –  Christian Sep 19 '11 at 9:45
    
As you are doing host-based IDS, IMHO the best way to make deep request analysis without significant performance gap is writing your own reverse proxy or some kind of IDS module for existing. And this will allow to block bad request before apache can proceed it. –  Selivanov Pavel Sep 19 '11 at 10:21
    
I'm not looking at blocking the request, though. It's IDS not IPS :). The only "performance-loss" I'm allowing is that from parallel threads (multi-threading the scanner rather than doing this in the request processor itself). –  Christian Sep 19 '11 at 10:41
show 1 more comment

Apache LogForensic seems to achieve what I want. I have yet to try it out, but it looks ok so far...

http://httpd.apache.org/docs/2.0/mod/mod_log_forensic.html

The next step would be to figure out a way to make LogForensic ignore my requests to avoid infinite loops. For this, I could simply run my IDS system (which is PHP-based) through CLI.

share|improve this answer
add comment

to handle all HTTP traffic

Is there a reason you can't use the existing logging built into the webserver? Have you looked at mod_security

Is there a reason you have to do this on the webserver and not on a reverse proxy?

without ... hindering its execution

Then sniffing the traffic is the only way.

Usually, we have a setup as follows

So you only ever serve up content generated via PHP. No static CSS, HTML, javascript, images... Or do you mean you only want to monitor the PHP generated traffic? In which case you could easily add an auto_prepend script in Apache, and you could offload the processing by setting it to make an asynchronous call. But there will still be some performance impact.

share|improve this answer
    
1. That's what I'm asking, if people know about any specific functionality matching my needs. 2. To decrease complexity. 3. Yes I'm more interested in dynamic content than static one. –  Christian Sep 19 '11 at 19:29
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.