We're trying to clean up one of our systems as much as possible & have found that despite our attempts to block, users are accessing a certain part of our system through a HTTP GET with their password in the URL. This results in our Apache logs recording their password in plain text on the server.
Is there an Apache directive or module that can filter out (or replace) certain patterns in its logs?
Create a LogFormat that has the details you want and then apply it to that virtual host, or the entire web server as desired.
If you need to filter out even more information, then use Apaches ability to write its logs to a pipe instead of a file. Hack yourself up some quick script that applies some regex or whatever to filter out whatever you like.