At 18:53 1-7-2002 -0400, you wrote: >Hi: > >I'm wondering whether I could (or should) exclude these types of 'hack' >attempts from my web stats: > >[Sun Jun 30 11:00:25 2002] [error] [client ***.***.***.***] File does not >exist: /usr/local/apache/2.0.39/htdocs/_vti_bin >... >[Sun Jun 30 05:16:46 2002] [error] [client ***.***.***.***] File does not >exist: /usr/local/apache/2.0.39/htdocs/MSADC >... >[Tue Jun 25 17:49:42 2002] [error] [client ***.***.***.***] File does not >exist: /usr/local/apache/2.0.39/htdocs/scripts >...
>I'm getting hundreds of such requests every week (in various other forms >like calls to 'cmd.exe', whatever that is!). They show up as 404 >errors in my web stats. I think I should exclude them as they're not >really valid requests for files that can't be found. I'm wondering if I >can do a REQEXCLUDE or similar directive in combination with a regex. My >attempts so far have not been successful. > >TIA - >Jeff You already got an answer from J Wadseck about how to deal with avoiding the 'hacker' stuff from your analog analyses. Still it may take some time from analog in 'not dealing' with it. So if you are worried about all that hacker dirt in your log file, if you have seen enough of it and it is no longer of importance to you (after a few months you know how much dirt there is :=), you can decrease the size of your logfiles considerably (probably you may have noticed the big increase in logfiles size since april 2001 !) by not having that hacker dirt in your logfiles at all. If you have access to the logdefinition of your webserver, leave the hacker dirt out there, then you dont have to worry about it in further analysis and it saves on the size of your logfiles, and most likely on the speed of your analysis. Henk Schrik tel. (31)(0)6 53612294 e-mail: [EMAIL PROTECTED] website: http://henk.schrik.nl or http://henk.schrik.org +------------------------------------------------------------------------ | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to | http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at | http://www.mail-archive.com/analog-help@lists.isite.net/ | http://lists.isite.net/listgate/analog-help/archives/ | http://www.tallylist.com/archives/index.cfm/mlist.7 +------------------------------------------------------------------------
