Re: reviewing httpd access log

[Artur Grabowski <art@blahonga.org>]

J Moore <jaymo@cullmail.com> writes:

> Reviewing my /var/www/logs/access_log file it seems there are a lot of 
> "bogus" entries; i.e. people trying various hacks, looking for 
> weaknesses, testing for win32, etc, etc.
> 
> Is there a good technique for automatically identifying these 
> trouble-makers? I'd like to be able to build a "deny" table for pf to 
> halt repeat offendors, but I can't afford the time to review the logs 
> "manually".

What problem are you trying to solve?

//art