Home / server / Questions / 227579
Accepted
Cakemox
Asked: 2011-01-28 04:48:12 +0800 CST

Apache logging to different files by response code

  • 772

I have an apache web server which is configured to allow access via client certificate to only a few people. I cannot lock down by IP because the certificate holders could potentially connect from anywhere.

Apache currently returns 403 to anyone not presenting a valid certificate or trying to access an invalid URL, but since the machine has no ACL restrictions it is frequently scanned for vulnerabilities. These scans cause quite a lot of noise in the logs.

Is there a way to log to a different file based on the response code? Is it possible to send all logging for requests which result in a 403 to a different file?

logging apache-2.2

1 Answers

  1. Best Answer

    You can get Apache to pipe the custom log to a script. So for example, change the CustomLog entry in the vhost to:

    CustomLog "|/path/to/script"

    The you can have a script that does something like:

    #!/usr/bin/perl
while ($log = <STDIN>) {
    if ($log =~ /403/) {
        open(LOG, '>>/path/to/403log');
        print LOG $log;
        close(LOG);
    } else {
        open(LOG, '>>/path/to/mainlog');
        print $log LOG;
        close(LOG);
    }
}

    The above script is untested, but it should give you an idea of what you can do.

    • 7