Skip site navigation (1)Skip section navigation (2)
Date:      Mon, 30 Mar 2009 16:47:14 -0500
From:      Charles Howse <chowse@charter.net>
To:        Mel Flynn <mel.flynn+fbsd.questions@mailing.thruhere.net>
Cc:        FreeBSD Questions <freebsd-questions@freebsd.org>
Subject:   Re: analyzing httpd-error.log
Message-ID:  <534421C4-E2C1-4694-AB8A-D1CEC7D5CBB2@charter.net>
In-Reply-To: <200903302309.11020.mel.flynn%2Bfbsd.questions@mailing.thruhere.net>
References:  <5BCD53E0-5B9F-4349-8401-FBF0ACF369C2@charter.net> <200903302211.30208.mel.flynn%2Bfbsd.questions@mailing.thruhere.net> <82E8EACC-E6A3-48FA-9203-80A5F924870F@charter.net> <200903302309.11020.mel.flynn%2Bfbsd.questions@mailing.thruhere.net>

next in thread | previous in thread | raw e-mail | index | archive | help

On Mar 30, 2009, at 4:09 PM, Mel Flynn wrote:

> On Monday 30 March 2009 22:55:35 Charles Howse wrote:
>
>> grep "$date" httpd-error.log | grep -v 192.168.254.254 | grep -v
>> 192.168.254.3 > /root/err.log
>
> Using pcregrep, installed by devel/pcre, typically available on apache
> systems:
> pcregrep "$date.* \[client (?!192\.168\.254)" /var/log/httpd- 
> error.log | \
> 	mail -s"Error log for $date" charles
>
> Should work. As far as I know, look ahead assertions aren't  
> supported by re(7)
> or the extended version.

Sweet!  Look at the intrusion attempt by 130.79.37.213 (it's from the  
Universite de Strasbourg in France):

[Mon Mar 30 00:02:24 2009] [error] [client 72.14.199.109] File does  
not exist: /usr/local/www/apache22/data/blog.rss
[Mon Mar 30 00:13:26 2009] [error] [client 130.79.37.213] script not  
found or unable to stat: /usr/local/www/apache22/cgi-bin/awstats
[Mon Mar 30 00:13:26 2009] [error] [client 130.79.37.213] script not  
found or unable to stat: /usr/local/www/apache22/cgi-bin/awstats.pl
[Mon Mar 30 00:13:27 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/cgi
[Mon Mar 30 00:13:29 2009] [error] [client 130.79.37.213] script not  
found or unable to stat: /usr/local/www/apache22/cgi-bin/stats
[Mon Mar 30 00:13:29 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/stats
[Mon Mar 30 00:13:30 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/awstats.pl
[Mon Mar 30 00:13:30 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/cgi
[Mon Mar 30 00:13:30 2009] [error] [client 130.79.37.213] script not  
found or unable to stat: /usr/local/www/apache22/cgi-bin/awstats.pl
[Mon Mar 30 00:13:31 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/scgi-bin
[Mon Mar 30 00:13:31 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/scgi-bin
[Mon Mar 30 00:13:31 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/cgi
[Mon Mar 30 00:13:32 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/scgi
[Mon Mar 30 00:13:32 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/scripts
[Mon Mar 30 00:13:32 2009] [error] [client 130.79.37.213] script not  
found or unable to stat: /usr/local/www/apache22/cgi-bin/awstats
[Mon Mar 30 00:13:33 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/scgi-bin
[Mon Mar 30 00:13:33 2009] [error] [client 130.79.37.213] script not  
found or unable to stat: /usr/local/www/apache22/cgi-bin/stats
[Mon Mar 30 00:13:33 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/scgi-bin
[Mon Mar 30 00:13:34 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/stats
[Mon Mar 30 00:13:34 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/hints.pl
[Mon Mar 30 00:13:34 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/cgi
[Mon Mar 30 00:13:34 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/scgi
[Mon Mar 30 00:13:35 2009] [error] [client 130.79.37.213] script not  
found or unable to stat: /usr/local/www/apache22/cgi-bin/hints.pl
[Mon Mar 30 00:13:35 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/scgi-bin
[Mon Mar 30 00:13:35 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/hints
[Mon Mar 30 00:13:36 2009] [error] [client 130.79.37.213] script not  
found or unable to stat: /usr/local/www/apache22/cgi-bin/hints
[Mon Mar 30 00:13:36 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/scgi-bin
[Mon Mar 30 00:13:36 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/webhints
[Mon Mar 30 00:13:37 2009] [error] [client 130.79.37.213] script not  
found or unable to stat: /usr/local/www/apache22/cgi-bin/webhints
[Mon Mar 30 00:13:37 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/scgi-bin
[Mon Mar 30 00:13:37 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/hints.cgi
[Mon Mar 30 00:13:38 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/cgi
[Mon Mar 30 00:13:38 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/scgi
[Mon Mar 30 00:13:38 2009] [error] [client 130.79.37.213] script not  
found or unable to stat: /usr/local/www/apache22/cgi-bin/hints.cgi
[Mon Mar 30 00:13:39 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/scgi-bin
[Mon Mar 30 00:13:39 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/hints
[Mon Mar 30 00:13:39 2009] [error] [client 130.79.37.213] script not  
found or unable to stat: /usr/local/www/apache22/cgi-bin/hints
[Mon Mar 30 00:13:40 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/scgi-bin
[Mon Mar 30 00:13:40 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/webhints
[Mon Mar 30 00:13:40 2009] [error] [client 130.79.37.213] script not  
found or unable to stat: /usr/local/www/apache22/cgi-bin/webhints
[Mon Mar 30 00:13:41 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/scgi-bin
[Mon Mar 30 00:13:41 2009] [error] [client 130.79.37.213] script not  
found or unable to stat: /usr/local/www/apache22/cgi-bin/includer.cgi
[Mon Mar 30 00:13:41 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/scgi-bin
[Mon Mar 30 00:13:42 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/includer.cgi
[Mon Mar 30 00:13:42 2009] [error] [client 130.79.37.213] script not  
found or unable to stat: /usr/local/www/apache22/cgi-bin/include
[Mon Mar 30 00:13:42 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/scgi-bin
[Mon Mar 30 00:13:42 2009] [error] [client 130.79.37.213] script not  
found or unable to stat: /usr/local/www/apache22/cgi-bin/inc
[Mon Mar 30 00:13:43 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/scgi-bin
[Mon Mar 30 00:13:43 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/cgi-local
[Mon Mar 30 00:13:43 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/scgi-local
[Mon Mar 30 00:13:44 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/cgi
[Mon Mar 30 00:13:44 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/scgi
[Mon Mar 30 00:15:36 2009] [error] [client 72.14.199.109] File does  
not exist: /usr/local/www/apache22/data/adsense.rss
[Mon Mar 30 03:02:24 2009] [error] [client 72.14.199.109] File does  
not exist: /usr/local/www/apache22/data/blog.rss
[Mon Mar 30 03:15:58 2009] [error] [client 72.14.199.109] File does  
not exist: /usr/local/www/apache22/data/adsense.rss
[Mon Mar 30 06:02:29 2009] [error] [client 72.14.199.109] File does  
not exist: /usr/local/www/apache22/data/blog.rss
[Mon Mar 30 06:15:58 2009] [error] [client 72.14.199.109] File does  
not exist: /usr/local/www/apache22/data/adsense.rss
[Mon Mar 30 06:20:12 2009] [error] [client 74.6.18.230] File does not  
exist: /usr/local/www/apache22/data/webmaster/chickencook
[Mon Mar 30 08:13:40 2009] [error] [client 61.160.217.15] File does  
not exist: /usr/local/www/apache22/data/azenv.php
[Mon Mar 30 09:02:39 2009] [error] [client 72.14.199.109] File does  
not exist: /usr/local/www/apache22/data/blog.rss
[Mon Mar 30 09:15:59 2009] [error] [client 72.14.199.109] File does  
not exist: /usr/local/www/apache22/data/adsense.rss
[Mon Mar 30 12:08:59 2009] [error] [client 72.14.199.90] File does not  
exist: /usr/local/www/apache22/data/blog.rss
[Mon Mar 30 13:02:25 2009] [error] [client 72.14.199.90] File does not  
exist: /usr/local/www/apache22/data/adsense.rss
[Mon Mar 30 16:02:25 2009] [error] [client 72.14.199.90] File does not  
exist: /usr/local/www/apache22/data/adsense.rss
[Mon Mar 30 16:20:40 2009] [error] [client 72.14.199.90] File does not  
exist: /usr/local/www/apache22/data/blog.rss



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?534421C4-E2C1-4694-AB8A-D1CEC7D5CBB2>