analyzing httpd-error.log

Charles Howse chowse at charter.net
Mon Mar 30 14:47:30 PDT 2009


On Mar 30, 2009, at 4:09 PM, Mel Flynn wrote:

> On Monday 30 March 2009 22:55:35 Charles Howse wrote:
>
>> grep "$date" httpd-error.log | grep -v 192.168.254.254 | grep -v
>> 192.168.254.3 > /root/err.log
>
> Using pcregrep, installed by devel/pcre, typically available on apache
> systems:
> pcregrep "$date.* \[client (?!192\.168\.254)" /var/log/httpd- 
> error.log | \
> 	mail -s"Error log for $date" charles
>
> Should work. As far as I know, look ahead assertions aren't  
> supported by re(7)
> or the extended version.

Sweet!  Look at the intrusion attempt by 130.79.37.213 (it's from the  
Universite de Strasbourg in France):

[Mon Mar 30 00:02:24 2009] [error] [client 72.14.199.109] File does  
not exist: /usr/local/www/apache22/data/blog.rss
[Mon Mar 30 00:13:26 2009] [error] [client 130.79.37.213] script not  
found or unable to stat: /usr/local/www/apache22/cgi-bin/awstats
[Mon Mar 30 00:13:26 2009] [error] [client 130.79.37.213] script not  
found or unable to stat: /usr/local/www/apache22/cgi-bin/awstats.pl
[Mon Mar 30 00:13:27 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/cgi
[Mon Mar 30 00:13:29 2009] [error] [client 130.79.37.213] script not  
found or unable to stat: /usr/local/www/apache22/cgi-bin/stats
[Mon Mar 30 00:13:29 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/stats
[Mon Mar 30 00:13:30 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/awstats.pl
[Mon Mar 30 00:13:30 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/cgi
[Mon Mar 30 00:13:30 2009] [error] [client 130.79.37.213] script not  
found or unable to stat: /usr/local/www/apache22/cgi-bin/awstats.pl
[Mon Mar 30 00:13:31 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/scgi-bin
[Mon Mar 30 00:13:31 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/scgi-bin
[Mon Mar 30 00:13:31 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/cgi
[Mon Mar 30 00:13:32 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/scgi
[Mon Mar 30 00:13:32 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/scripts
[Mon Mar 30 00:13:32 2009] [error] [client 130.79.37.213] script not  
found or unable to stat: /usr/local/www/apache22/cgi-bin/awstats
[Mon Mar 30 00:13:33 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/scgi-bin
[Mon Mar 30 00:13:33 2009] [error] [client 130.79.37.213] script not  
found or unable to stat: /usr/local/www/apache22/cgi-bin/stats
[Mon Mar 30 00:13:33 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/scgi-bin
[Mon Mar 30 00:13:34 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/stats
[Mon Mar 30 00:13:34 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/hints.pl
[Mon Mar 30 00:13:34 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/cgi
[Mon Mar 30 00:13:34 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/scgi
[Mon Mar 30 00:13:35 2009] [error] [client 130.79.37.213] script not  
found or unable to stat: /usr/local/www/apache22/cgi-bin/hints.pl
[Mon Mar 30 00:13:35 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/scgi-bin
[Mon Mar 30 00:13:35 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/hints
[Mon Mar 30 00:13:36 2009] [error] [client 130.79.37.213] script not  
found or unable to stat: /usr/local/www/apache22/cgi-bin/hints
[Mon Mar 30 00:13:36 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/scgi-bin
[Mon Mar 30 00:13:36 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/webhints
[Mon Mar 30 00:13:37 2009] [error] [client 130.79.37.213] script not  
found or unable to stat: /usr/local/www/apache22/cgi-bin/webhints
[Mon Mar 30 00:13:37 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/scgi-bin
[Mon Mar 30 00:13:37 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/hints.cgi
[Mon Mar 30 00:13:38 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/cgi
[Mon Mar 30 00:13:38 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/scgi
[Mon Mar 30 00:13:38 2009] [error] [client 130.79.37.213] script not  
found or unable to stat: /usr/local/www/apache22/cgi-bin/hints.cgi
[Mon Mar 30 00:13:39 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/scgi-bin
[Mon Mar 30 00:13:39 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/hints
[Mon Mar 30 00:13:39 2009] [error] [client 130.79.37.213] script not  
found or unable to stat: /usr/local/www/apache22/cgi-bin/hints
[Mon Mar 30 00:13:40 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/scgi-bin
[Mon Mar 30 00:13:40 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/webhints
[Mon Mar 30 00:13:40 2009] [error] [client 130.79.37.213] script not  
found or unable to stat: /usr/local/www/apache22/cgi-bin/webhints
[Mon Mar 30 00:13:41 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/scgi-bin
[Mon Mar 30 00:13:41 2009] [error] [client 130.79.37.213] script not  
found or unable to stat: /usr/local/www/apache22/cgi-bin/includer.cgi
[Mon Mar 30 00:13:41 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/scgi-bin
[Mon Mar 30 00:13:42 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/includer.cgi
[Mon Mar 30 00:13:42 2009] [error] [client 130.79.37.213] script not  
found or unable to stat: /usr/local/www/apache22/cgi-bin/include
[Mon Mar 30 00:13:42 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/scgi-bin
[Mon Mar 30 00:13:42 2009] [error] [client 130.79.37.213] script not  
found or unable to stat: /usr/local/www/apache22/cgi-bin/inc
[Mon Mar 30 00:13:43 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/scgi-bin
[Mon Mar 30 00:13:43 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/cgi-local
[Mon Mar 30 00:13:43 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/scgi-local
[Mon Mar 30 00:13:44 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/cgi
[Mon Mar 30 00:13:44 2009] [error] [client 130.79.37.213] File does  
not exist: /usr/local/www/apache22/data/scgi
[Mon Mar 30 00:15:36 2009] [error] [client 72.14.199.109] File does  
not exist: /usr/local/www/apache22/data/adsense.rss
[Mon Mar 30 03:02:24 2009] [error] [client 72.14.199.109] File does  
not exist: /usr/local/www/apache22/data/blog.rss
[Mon Mar 30 03:15:58 2009] [error] [client 72.14.199.109] File does  
not exist: /usr/local/www/apache22/data/adsense.rss
[Mon Mar 30 06:02:29 2009] [error] [client 72.14.199.109] File does  
not exist: /usr/local/www/apache22/data/blog.rss
[Mon Mar 30 06:15:58 2009] [error] [client 72.14.199.109] File does  
not exist: /usr/local/www/apache22/data/adsense.rss
[Mon Mar 30 06:20:12 2009] [error] [client 74.6.18.230] File does not  
exist: /usr/local/www/apache22/data/webmaster/chickencook
[Mon Mar 30 08:13:40 2009] [error] [client 61.160.217.15] File does  
not exist: /usr/local/www/apache22/data/azenv.php
[Mon Mar 30 09:02:39 2009] [error] [client 72.14.199.109] File does  
not exist: /usr/local/www/apache22/data/blog.rss
[Mon Mar 30 09:15:59 2009] [error] [client 72.14.199.109] File does  
not exist: /usr/local/www/apache22/data/adsense.rss
[Mon Mar 30 12:08:59 2009] [error] [client 72.14.199.90] File does not  
exist: /usr/local/www/apache22/data/blog.rss
[Mon Mar 30 13:02:25 2009] [error] [client 72.14.199.90] File does not  
exist: /usr/local/www/apache22/data/adsense.rss
[Mon Mar 30 16:02:25 2009] [error] [client 72.14.199.90] File does not  
exist: /usr/local/www/apache22/data/adsense.rss
[Mon Mar 30 16:20:40 2009] [error] [client 72.14.199.90] File does not  
exist: /usr/local/www/apache22/data/blog.rss


More information about the freebsd-questions mailing list