Re: reviewing httpd access log

[Han Boetes <han@mijncomputer.nl>]

J Moore wrote:
> Reviewing my /var/www/logs/access_log file it seems there are a lot of
> "bogus" entries; i.e. people trying various hacks, looking for
> weaknesses, testing for win32, etc, etc.
>
> Is there a good technique for automatically identifying these trouble-
> makers? I'd like to be able to build a "deny" table for pf to halt
> repeat offendors, but I can't afford the time to review the logs
> "manually".

RedirectMatch ^.*\.(ida|exe|dll).* http://support.microsoft.com



# Han