From owner-freebsd-questions  Wed Oct 17  7:46:45 2001
Delivered-To: freebsd-questions@freebsd.org
Received: from webs1.accretive-networks.net (webs1.accretive-networks.net [207.246.154.13])
	by hub.freebsd.org (Postfix) with ESMTP id 16DC837B408
	for <questions@FreeBSD.ORG>; Wed, 17 Oct 2001 07:46:42 -0700 (PDT)
Received: from localhost (davidk@localhost)
	by webs1.accretive-networks.net (8.11.1/8.11.3) with ESMTP id f9HEke098991;
	Wed, 17 Oct 2001 07:46:40 -0700 (PDT)
Date: Wed, 17 Oct 2001 07:46:40 -0700 (PDT)
From: David Kirchner <davidk@accretivetg.com>
X-X-Sender:  <davidk@localhost>
To: "Maine LOA List Admin (Brent Bailey)" <brentb@loa.com>
Cc: <questions@FreeBSD.ORG>
Subject: Re: nimda & code-red & apache error logs
In-Reply-To: <000f01c15705$108529e0$37b4a8c0@pretorian>
Message-ID: <20011017074511.U85958-100000@localhost>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-freebsd-questions@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-questions.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-questions>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-questions>
X-Loop: FreeBSD.ORG

On Wed, 17 Oct 2001, Maine LOA List Admin (Brent Bailey) wrote:

> IM running a 4.3 FBSD machine that has apache 1.3.19 ..I'm aware that these
> viri are intended for IIS webservers ..but  on my webservers ... machines
> that are infected with nimda or code-red  trying to access my apache
> webservers ..is creating a ton of error logs ..im not sure this is affecting
> the performance of the box ..but i know that the amount of windows machines
> infected from these viri in crazy.
>
> seems most all the machines ive seen trying to access my webserver are from
> class A ip addresses...of 65.x.x.x
> is there a way to either stop the amount of loging this is causing ?? or at
> least stop the logging from these types of requests..
>
> Brent

The most elegant (IE simple) way I've seen people do this is to change
your ErrorLog line from:

ErrorLog /usr/local/example_path/logs/error_log

to:

ErrorLog "|egrep -v '\.exe' >> /usr/local/example_path/logs/error_log"

Someone else here may have a better regular expression to catch them all.


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message