From owner-freebsd-questions@FreeBSD.ORG Mon Mar 30 21:47:29 2009 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 0CF721065674 for ; Mon, 30 Mar 2009 21:47:29 +0000 (UTC) (envelope-from chowse@charter.net) Received: from mta21.charter.net (mta21.charter.net [216.33.127.81]) by mx1.freebsd.org (Postfix) with ESMTP id C19F58FC23 for ; Mon, 30 Mar 2009 21:47:28 +0000 (UTC) (envelope-from chowse@charter.net) Received: from imp11 ([10.20.200.11]) by mta21.charter.net (InterMail vM.7.09.01.00 201-2219-108-20080618) with ESMTP id <20090330214715.YUFV3344.mta21.charter.net@imp11>; Mon, 30 Mar 2009 17:47:15 -0400 Received: from [192.168.254.3] ([24.176.107.216]) by imp11 with charter.net id ZZnE1b00N4g9tMU05ZnEjT; Mon, 30 Mar 2009 17:47:15 -0400 Message-Id: <534421C4-E2C1-4694-AB8A-D1CEC7D5CBB2@charter.net> From: Charles Howse To: Mel Flynn In-Reply-To: <200903302309.11020.mel.flynn+fbsd.questions@mailing.thruhere.net> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v930.3) Date: Mon, 30 Mar 2009 16:47:14 -0500 References: <5BCD53E0-5B9F-4349-8401-FBF0ACF369C2@charter.net> <200903302211.30208.mel.flynn+fbsd.questions@mailing.thruhere.net> <82E8EACC-E6A3-48FA-9203-80A5F924870F@charter.net> <200903302309.11020.mel.flynn+fbsd.questions@mailing.thruhere.net> X-Mailer: Apple Mail (2.930.3) Cc: FreeBSD Questions Subject: Re: analyzing httpd-error.log X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 30 Mar 2009 21:47:30 -0000 On Mar 30, 2009, at 4:09 PM, Mel Flynn wrote: > On Monday 30 March 2009 22:55:35 Charles Howse wrote: > >> grep "$date" httpd-error.log | grep -v 192.168.254.254 | grep -v >> 192.168.254.3 > /root/err.log > > Using pcregrep, installed by devel/pcre, typically available on apache > systems: > pcregrep "$date.* \[client (?!192\.168\.254)" /var/log/httpd- > error.log | \ > mail -s"Error log for $date" charles > > Should work. As far as I know, look ahead assertions aren't > supported by re(7) > or the extended version. Sweet! Look at the intrusion attempt by 130.79.37.213 (it's from the Universite de Strasbourg in France): [Mon Mar 30 00:02:24 2009] [error] [client 72.14.199.109] File does not exist: /usr/local/www/apache22/data/blog.rss [Mon Mar 30 00:13:26 2009] [error] [client 130.79.37.213] script not found or unable to stat: /usr/local/www/apache22/cgi-bin/awstats [Mon Mar 30 00:13:26 2009] [error] [client 130.79.37.213] script not found or unable to stat: /usr/local/www/apache22/cgi-bin/awstats.pl [Mon Mar 30 00:13:27 2009] [error] [client 130.79.37.213] File does not exist: /usr/local/www/apache22/data/cgi [Mon Mar 30 00:13:29 2009] [error] [client 130.79.37.213] script not found or unable to stat: /usr/local/www/apache22/cgi-bin/stats [Mon Mar 30 00:13:29 2009] [error] [client 130.79.37.213] File does not exist: /usr/local/www/apache22/data/stats [Mon Mar 30 00:13:30 2009] [error] [client 130.79.37.213] File does not exist: /usr/local/www/apache22/data/awstats.pl [Mon Mar 30 00:13:30 2009] [error] [client 130.79.37.213] File does not exist: /usr/local/www/apache22/data/cgi [Mon Mar 30 00:13:30 2009] [error] [client 130.79.37.213] script not found or unable to stat: /usr/local/www/apache22/cgi-bin/awstats.pl [Mon Mar 30 00:13:31 2009] [error] [client 130.79.37.213] File does not exist: /usr/local/www/apache22/data/scgi-bin [Mon Mar 30 00:13:31 2009] [error] [client 130.79.37.213] File does not exist: /usr/local/www/apache22/data/scgi-bin [Mon Mar 30 00:13:31 2009] [error] [client 130.79.37.213] File does not exist: /usr/local/www/apache22/data/cgi [Mon Mar 30 00:13:32 2009] [error] [client 130.79.37.213] File does not exist: /usr/local/www/apache22/data/scgi [Mon Mar 30 00:13:32 2009] [error] [client 130.79.37.213] File does not exist: /usr/local/www/apache22/data/scripts [Mon Mar 30 00:13:32 2009] [error] [client 130.79.37.213] script not found or unable to stat: /usr/local/www/apache22/cgi-bin/awstats [Mon Mar 30 00:13:33 2009] [error] [client 130.79.37.213] File does not exist: /usr/local/www/apache22/data/scgi-bin [Mon Mar 30 00:13:33 2009] [error] [client 130.79.37.213] script not found or unable to stat: /usr/local/www/apache22/cgi-bin/stats [Mon Mar 30 00:13:33 2009] [error] [client 130.79.37.213] File does not exist: /usr/local/www/apache22/data/scgi-bin [Mon Mar 30 00:13:34 2009] [error] [client 130.79.37.213] File does not exist: /usr/local/www/apache22/data/stats [Mon Mar 30 00:13:34 2009] [error] [client 130.79.37.213] File does not exist: /usr/local/www/apache22/data/hints.pl [Mon Mar 30 00:13:34 2009] [error] [client 130.79.37.213] File does not exist: /usr/local/www/apache22/data/cgi [Mon Mar 30 00:13:34 2009] [error] [client 130.79.37.213] File does not exist: /usr/local/www/apache22/data/scgi [Mon Mar 30 00:13:35 2009] [error] [client 130.79.37.213] script not found or unable to stat: /usr/local/www/apache22/cgi-bin/hints.pl [Mon Mar 30 00:13:35 2009] [error] [client 130.79.37.213] File does not exist: /usr/local/www/apache22/data/scgi-bin [Mon Mar 30 00:13:35 2009] [error] [client 130.79.37.213] File does not exist: /usr/local/www/apache22/data/hints [Mon Mar 30 00:13:36 2009] [error] [client 130.79.37.213] script not found or unable to stat: /usr/local/www/apache22/cgi-bin/hints [Mon Mar 30 00:13:36 2009] [error] [client 130.79.37.213] File does not exist: /usr/local/www/apache22/data/scgi-bin [Mon Mar 30 00:13:36 2009] [error] [client 130.79.37.213] File does not exist: /usr/local/www/apache22/data/webhints [Mon Mar 30 00:13:37 2009] [error] [client 130.79.37.213] script not found or unable to stat: /usr/local/www/apache22/cgi-bin/webhints [Mon Mar 30 00:13:37 2009] [error] [client 130.79.37.213] File does not exist: /usr/local/www/apache22/data/scgi-bin [Mon Mar 30 00:13:37 2009] [error] [client 130.79.37.213] File does not exist: /usr/local/www/apache22/data/hints.cgi [Mon Mar 30 00:13:38 2009] [error] [client 130.79.37.213] File does not exist: /usr/local/www/apache22/data/cgi [Mon Mar 30 00:13:38 2009] [error] [client 130.79.37.213] File does not exist: /usr/local/www/apache22/data/scgi [Mon Mar 30 00:13:38 2009] [error] [client 130.79.37.213] script not found or unable to stat: /usr/local/www/apache22/cgi-bin/hints.cgi [Mon Mar 30 00:13:39 2009] [error] [client 130.79.37.213] File does not exist: /usr/local/www/apache22/data/scgi-bin [Mon Mar 30 00:13:39 2009] [error] [client 130.79.37.213] File does not exist: /usr/local/www/apache22/data/hints [Mon Mar 30 00:13:39 2009] [error] [client 130.79.37.213] script not found or unable to stat: /usr/local/www/apache22/cgi-bin/hints [Mon Mar 30 00:13:40 2009] [error] [client 130.79.37.213] File does not exist: /usr/local/www/apache22/data/scgi-bin [Mon Mar 30 00:13:40 2009] [error] [client 130.79.37.213] File does not exist: /usr/local/www/apache22/data/webhints [Mon Mar 30 00:13:40 2009] [error] [client 130.79.37.213] script not found or unable to stat: /usr/local/www/apache22/cgi-bin/webhints [Mon Mar 30 00:13:41 2009] [error] [client 130.79.37.213] File does not exist: /usr/local/www/apache22/data/scgi-bin [Mon Mar 30 00:13:41 2009] [error] [client 130.79.37.213] script not found or unable to stat: /usr/local/www/apache22/cgi-bin/includer.cgi [Mon Mar 30 00:13:41 2009] [error] [client 130.79.37.213] File does not exist: /usr/local/www/apache22/data/scgi-bin [Mon Mar 30 00:13:42 2009] [error] [client 130.79.37.213] File does not exist: /usr/local/www/apache22/data/includer.cgi [Mon Mar 30 00:13:42 2009] [error] [client 130.79.37.213] script not found or unable to stat: /usr/local/www/apache22/cgi-bin/include [Mon Mar 30 00:13:42 2009] [error] [client 130.79.37.213] File does not exist: /usr/local/www/apache22/data/scgi-bin [Mon Mar 30 00:13:42 2009] [error] [client 130.79.37.213] script not found or unable to stat: /usr/local/www/apache22/cgi-bin/inc [Mon Mar 30 00:13:43 2009] [error] [client 130.79.37.213] File does not exist: /usr/local/www/apache22/data/scgi-bin [Mon Mar 30 00:13:43 2009] [error] [client 130.79.37.213] File does not exist: /usr/local/www/apache22/data/cgi-local [Mon Mar 30 00:13:43 2009] [error] [client 130.79.37.213] File does not exist: /usr/local/www/apache22/data/scgi-local [Mon Mar 30 00:13:44 2009] [error] [client 130.79.37.213] File does not exist: /usr/local/www/apache22/data/cgi [Mon Mar 30 00:13:44 2009] [error] [client 130.79.37.213] File does not exist: /usr/local/www/apache22/data/scgi [Mon Mar 30 00:15:36 2009] [error] [client 72.14.199.109] File does not exist: /usr/local/www/apache22/data/adsense.rss [Mon Mar 30 03:02:24 2009] [error] [client 72.14.199.109] File does not exist: /usr/local/www/apache22/data/blog.rss [Mon Mar 30 03:15:58 2009] [error] [client 72.14.199.109] File does not exist: /usr/local/www/apache22/data/adsense.rss [Mon Mar 30 06:02:29 2009] [error] [client 72.14.199.109] File does not exist: /usr/local/www/apache22/data/blog.rss [Mon Mar 30 06:15:58 2009] [error] [client 72.14.199.109] File does not exist: /usr/local/www/apache22/data/adsense.rss [Mon Mar 30 06:20:12 2009] [error] [client 74.6.18.230] File does not exist: /usr/local/www/apache22/data/webmaster/chickencook [Mon Mar 30 08:13:40 2009] [error] [client 61.160.217.15] File does not exist: /usr/local/www/apache22/data/azenv.php [Mon Mar 30 09:02:39 2009] [error] [client 72.14.199.109] File does not exist: /usr/local/www/apache22/data/blog.rss [Mon Mar 30 09:15:59 2009] [error] [client 72.14.199.109] File does not exist: /usr/local/www/apache22/data/adsense.rss [Mon Mar 30 12:08:59 2009] [error] [client 72.14.199.90] File does not exist: /usr/local/www/apache22/data/blog.rss [Mon Mar 30 13:02:25 2009] [error] [client 72.14.199.90] File does not exist: /usr/local/www/apache22/data/adsense.rss [Mon Mar 30 16:02:25 2009] [error] [client 72.14.199.90] File does not exist: /usr/local/www/apache22/data/adsense.rss [Mon Mar 30 16:20:40 2009] [error] [client 72.14.199.90] File does not exist: /usr/local/www/apache22/data/blog.rss