en en en en en en en en en en en hbs_lat en fr en en it en en en en en en es en en en en en en en en fr en en en pt en en en en en en en en en en en en en en en en en en en en en en en en en en de de en en az en en
This entry was posted in Security and tagged apache core-rules modsecurity on 14.10.2016 by Christian Folini
Extending and Analyzing the Access Log
“What’s the big deal?” I hear you say. I admit, it may sound a bit boring, but log files are primordial. Configuring the right logfile makes the difference between ignorance and insight into you server. There are quite a few tutorials around that tell you how you can reconfigure Apache to write all sorts of funny information into the access log. But nobody tells you what information is actually important and what is bogus. Of course, it depends on your local setup, but in this tutorial, I present you a selection of fields which I find useful without logging everything and the kitchen sink. The format has evolved over the course of ten years and after two years without an update, it has matured in a way that makes it ready publication.
We stick to the standard “combined” format and extend it to the right.
The legacy and empty “logname” field next to the IP address has been replaced by the Country GeoIP code (strictly speaking, this is no longer combined format, but the format itself does not change)
If you paid close attention in the 2nd tutorial, you saw that the Apache error log and the access log are configured to share the same timestamp format. This is a surprisingly new feature of Apache.
The Unique ID of the request is being logged. This is the primary key that keeps various log files together.
IO In and IO Out
Deflate Ratio in percent
So that’s a good chunk of useful information. I am sure you can build great dashboards based on this. We will stick to the basics, though, and I will show you how to extract information on the fly with the help of a handy set of aliases like this:
Did I convince you? Here is the link to the tutorial again:
Extending and Analyzing the Access Log
The overview over all the published Apache Tutorials can be found here so you have the right foundation for this advanced tutorial. Follow me on twitter (@ChrFolini) to make sure you are informed when the next guide hits the shelf.
Christian Folini Follow @ChrFolini Tweet
← Introducing a Series of Apache/ModSecurity Tutorials
Using Ansible to Fetch Information from IOS Devices →
Phone +41 31 974 08 08
Ansible apache automation Cisco core-rules Core Rule Set CRS CRS3 DDoS Django drupal enigma enigma2017 firewall ModRewrite modsecurity NCS nervecenter netdisco nftables NMS OIN OpenSource OWASP Top10 PostgreSQL Proxmox Python 3 QoS Risks Sampling Mode security ssl SSL/TLS Swiss Cyber Experts Switzerland syslog tcpdump tls tshark typo3 ubuntu wireshark zenoss