0

I have an apache web server which is configured to allow access via client certificate to only a few people. I cannot lock down by IP because the certificate holders could potentially connect from anywhere.

Apache currently returns 403 to anyone not presenting a valid certificate or trying to access an invalid URL, but since the machine has no ACL restrictions it is frequently scanned for vulnerabilities. These scans cause quite a lot of noise in the logs.

Is there a way to log to a different file based on the response code? Is it possible to send all logging for requests which result in a 403 to a different file?

7

You can get Apache to pipe the custom log to a script. So for example, change the CustomLog entry in the vhost to:

CustomLog "|/path/to/script"

The you can have a script that does something like:

#!/usr/bin/perl
while ($log = <STDIN>) {
    if ($log =~ /403/) {
        open(LOG, '>>/path/to/403log');
        print LOG $log;
        close(LOG);
    } else {
        open(LOG, '>>/path/to/mainlog');
        print $log LOG;
        close(LOG);
    }
}

The above script is untested, but it should give you an idea of what you can do.

| improve this answer | |
  • 2
    That's cool. :) Another approach using CustomLog: if using syslog-ng, you can use CustomLog directive like CustomLog "/usr/bin/logger ..." and then do the log file separation in syslog-ng pattern matching. – Janne Pikkarainen Jan 27 '11 at 13:04
  • Yup, that would also work. +1 – Niall Donegan Jan 27 '11 at 13:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.