From 1b170b2aef828899ad6596ada0c379c6e07a620e Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Fri, 28 Jun 2013 09:34:12 -0400 Subject: [PATCH] BF: support apache 2.4 more detailed error log format. Close #268 --- ChangeLog | 2 ++ config/filter.d/apache-common.conf | 6 +++++- testcases/files/logs/apache-nohome | 4 ++++ 3 files changed, 11 insertions(+), 1 deletion(-) create mode 100644 testcases/files/logs/apache-nohome diff --git a/ChangeLog b/ChangeLog index 45c6f343..e5c38eb1 100644 --- a/ChangeLog +++ b/ChangeLog @@ -13,6 +13,8 @@ ver. 0.8.11 (2013/XX/XXX) - wanna-be-released - Fixes: Yaroslav Halchenko * filter.d/common.conf -- make colon after [daemon] optional. Closes gh-267 + * filter.d/apache-common.conf -- support apache 2.4 more detailed error + log format. Closes gh-268 - New Features: Daniel Black & ykimon * filter.d/3proxy.conf -- filter added diff --git a/config/filter.d/apache-common.conf b/config/filter.d/apache-common.conf index c3829e2f..cc35ae5f 100644 --- a/config/filter.d/apache-common.conf +++ b/config/filter.d/apache-common.conf @@ -14,4 +14,8 @@ after = apache-common.local [DEFAULT] # Common prefix for [error] apache messages which also would include -_apache_error_client = \[[^]]+\] \[error\] \[client \] +# Depending on the version it could be +# 2.2: [Sat Jun 01 11:23:08 2013] [error] [client 1.2.3.4] +# 2.4: [Thu Jun 27 11:55:44.569531 2013] [core:info] [pid 4101:tid 2992634688] [client 1.2.3.4:46652] +# Reference: https://github.com/fail2ban/fail2ban/issues/268 +_apache_error_client = \[[^]]+\] \[(error|core:\S+)\]( \[pid \d+:\S+ \d+\])? \[client (:\d{1,5})?\]( \S+:)? diff --git a/testcases/files/logs/apache-nohome b/testcases/files/logs/apache-nohome new file mode 100644 index 00000000..e8ef56bc --- /dev/null +++ b/testcases/files/logs/apache-nohome @@ -0,0 +1,4 @@ +# Apache 2.2 +[Sat Jun 01 11:23:08 2013] [error] [client 1.2.3.4] File does not exist: /xxx/~ +# Apache 2.4 +[Thu Jun 27 11:55:44.569531 2013] [core:info] [pid 4101:tid 2992634688] [client 192.0.2.12:46652] AH00128: File does not exist: /xxx/~