1

We have SVN running via Apache httpd. For authentication we use Active Directory and if the user isn't in AD, we fallback to file authentication. This works fine, except for the error messages in case of file authentication. The error message we get over and over again:

auth_ldap authenticate: user <user> authentication failed; URI /svn/some/uri [User not found][No such object]

We would like to filter out these messages since our log files grows rapidly due to this unnecessary log message.

Improve this question
1
  • I can't personally condone filtering out authentication failures. If this is on a local network and truly is generating that much spam, then there is a misbehaving process that needs to be dealt with. If this is internet facing, forwarding directly to AD without middleware is a really bad idea.
    – Andrew B
    Jun 16, 2013 at 19:19

3 Answers 3

Reset to default
2

Sorry for answering my own question, but I have implemented a solution that I wanted to share wit you since you were helping me out and it may be of value to others.

Basically its rather simple, I didn't change the logging at all, I just changed the log rotation (/etc/logrotate.d/httpd) to:

/var/log/httpd/*log {
        compress
        compresscmd /usr/bin/bzip2
        compressext .bz2
        daily
        dateext
        maxage 31
        rotate 14
        size=+4096k
        notifempty
        missingok
        sharedscripts
        prerotate
                /bin/sed -i '/User not found/d' /var/log/httpd/*svn_error_log
        endscript
        postrotate
                /sbin/service httpd graceful > /dev/null 2>/dev/null || true
        endscript
}

This way all false positives are removed from the log file on a daily basis. The size of the log files is reduced and doesn't grow over time, since the files are removed after 31 days (max).

Improve this answer
0

Provided that the intent is to filter these logs to a different file, there are a few ways to go about it.

  1. Send the ErrorLog to syslog and log to different files based on the input.
  2. Use pipe syntax to send the logs to a dedicated helper program, and use it to split the authentication failures off into a separate file. It's recommended to use a dedicated binary in conjunction with this directive in production (not a shell script) as it's performance sensitive.

Turning down LogLevel verbosity is probably a bad idea because it effects other messages within the VirtualHost. Same with LDAPLibraryDebug, and I think those messages are coming from Apache and not the LDAP library anyway.

Improve this answer
-1

You can disable error log messages at all. Something like

ErrorLog /dev/null

Improve this answer
3
  • Recommending that someone turn off their ErrorLog entirely does not answer the question. (and a bad idea in production environments)
    – Andrew B
    Jun 16, 2013 at 19:06
  • As far as I know, there is no way to filter such messages. Only all messages at once
    – ALex_hha
    Jun 17, 2013 at 9:55
  • Hi,I Agree that turning the logging off isn't what we want. I only want to exclude the warnings about users not authenticated against AD, since this is in a way a false positive.
    – JohanKees
    Jul 4, 2013 at 8:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .