Re: reviewing httpd access log

["Johan M:son Lindman" <tybollt@solace.mh.se>]

On Sunday 01 August 2004 18.30, Chuck Yerkes wrote:
> Quoting J Moore (jaymo@cullmail.com):
> > Reviewing my /var/www/logs/access_log file it seems there are a lot of
> > "bogus" entries; i.e. people trying various hacks, looking for
> > weaknesses, testing for win32, etc, etc.
> >
> > Is there a good technique for automatically identifying these
> > trouble-makers? I'd like to be able to build a "deny" table for pf to
> > halt repeat offendors, but I can't afford the time to review the logs
> > "manually".
>
> On the other hand, the biggest defense is to not run IIS or
> software with holes.

Right there was never a hole in or a security issue with apache, right...


Regards
Johan