Annoying windoze problems in my Apache server logs
 

Hello! I've got this really annoying problem in my apache server logs, in both "/var/log/apache/access_log and in /var/log/apache/error_log

I don't know if this is much of a security problem (although if I were running another OS it might be ;) ) but I am more wondering how to have these not even show up in my logs, or filter them into another log such as /dev/null or something. I've taken some exerpts from both log files so you can get a feel for what I am talking about:

From /var/log/apache/access_log:
And more from /var/log/apache/access_log:

From /var/log/apache/error_log:

I am guessing it's some sort of virus for winbloze.

Anyway, anyone got any ideas on how to rid my logs of the flaws of others ;)

Cool

Yup. Nimda or CodeRed virus. I asked this question before and nobody had an answer on how to get these out of the log file. I wanted to get rid of those log entries for so long but now I kind of like them because they remind me why I don't use M$.

By the way: I wonder how many Linux server were effected by the "SQL Slammer" worm. Oh yeah thats right. none

Thanks :) How about a reverse IP lookup then? So I can send an email or something to this IP to let them know how annoying it is, or rather that this is happening.

:)

Cool

In your logrotate script add something like:
prerotate
grep /var/log/apache/access_log -ve "cmd.exe" > /var/tmp/apache/access_log
mv -f /var/tmp/apache/access_log /var/log/apache/access_log
endscript

IMO email notification is an applaudable thing but in these cases usually won't do more than easy your mind you've done "everything". Find their upstream ISP's (Verizon) abuse address and mail them.

Re: Annoying windoze problems in my Apache server logs
 

Apache's conditional logging could be used stop you logging any mention of cmd.exe. For example (in httpd.conf)...HTH - that RegExp is probably better as /cmd\.exe/ as I think the original would match cmd then any character followed by exe.

Jamie...

Re: Re: Annoying windoze problems in my Apache server logs
 

Ok, I tried this one first (Just randomly picked it) however, it doesn't seem to work. I've tried both of these entries for at least a day per entry:
And I've also used variations like (currently):
But still no dice. So now for the next week, I'll try to figure out how to implement your suggest UnSpawn since I don't know where my logrotate script is (or maybe I've got to set one up). :) I'll post back with the results. Thanks for the replies so far.

Cool