fail2ban/config/filter.d/apache-common.conf

# Generic configuration items (to be used as interpolations) in other
# apache filters.

[INCLUDES]

before = common.conf
# Load customizations if any available
after = apache-common.local

[DEFAULT]

# Apache logging mode:
#   all - universal prefix (logfile, syslog)
#   logfile - logfile only
#   syslog - syslog only
# Use `filter = apache-auth[logging=syslog]` to get more precise regex if apache logs into syslog (ErrorLog syslog).
# Use `filter = apache-auth[logging=all]` to get universal regex matches both logging variants.
logging = logfile

# Apache logging prefixes (date-pattern prefix, server, process etc.):
apache-prefix-syslog = %(__prefix_line)s
apache-prefix-logfile = \[\]\s
apache-prefix-all = (?:%(apache-prefix-logfile)s|%(apache-prefix-syslog)s)?

# Setting for __prefix_line (only `logging=syslog`):
_daemon = (?:apache\d*|httpd(?:/\w+)?)

apache-prefix = <apache-prefix-<logging>>

apache-pref-ignore =

_apache_error_client = <apache-prefix>\[(:?error|<apache-pref-ignore>\S+:\S+)\]( \[pid \d+(:\S+ \d+)?\])? \[(?:client|remote) <HOST>(:\d{1,5})?\]

datepattern = {^LN-BEG}

# Common prefix for [error] apache messages which also would include <HOST>
# Depending on the version it could be
# 2.2: [Sat Jun 01 11:23:08 2013] [error] [client 1.2.3.4]
# 2.4: [Thu Jun 27 11:55:44.569531 2013] [core:info] [pid 4101:tid 2992634688] [client 1.2.3.4:46652]
# 2.4 (perfork): [Mon Dec 23 07:49:01.981912 2013] [:error] [pid 3790] [client 204.232.202.107:46301] script '/var/www/timthumb.php' not found or unable to 
#
# Reference: https://github.com/fail2ban/fail2ban/issues/268
#
# Author: Yaroslav Halchenko
BF: anchor apache- filters. Close #248 See https://vndh.net/note:fail2ban-089-denial-service for more information 2013-06-11 18:56:25 +00:00			`# Generic configuration items (to be used as interpolations) in other`
DOC: in filters, put user relevant doc at top, and developer info at bottom, and remove all the repetative blindly copied stuff that appears in the jail man page 2013-10-30 13:02:59 +00:00			`# apache filters.`
BF: anchor apache- filters. Close #248 See https://vndh.net/note:fail2ban-089-denial-service for more information 2013-06-11 18:56:25 +00:00
			`[INCLUDES]`

apache-common.conf: introduced parameter `logging` for possibility to match lines, if apache logs into syslog/systemd journal; added test cases to cover `apache-auth[logging=syslog]`. 2017-07-12 09:25:58 +00:00			`before = common.conf`
BF: anchor apache- filters. Close #248 See https://vndh.net/note:fail2ban-089-denial-service for more information 2013-06-11 18:56:25 +00:00			`# Load customizations if any available`
			`after = apache-common.local`

			`[DEFAULT]`

apache-common.conf: introduced parameter `logging` for possibility to match lines, if apache logs into syslog/systemd journal; added test cases to cover `apache-auth[logging=syslog]`. 2017-07-12 09:25:58 +00:00			`# Apache logging mode:`
			`# all - universal prefix (logfile, syslog)`
			`# logfile - logfile only`
			`# syslog - syslog only`
			# Use `filter = apache-auth[logging=syslog]` to get more precise regex if apache logs into syslog (ErrorLog syslog).
			# Use `filter = apache-auth[logging=all]` to get universal regex matches both logging variants.
			`logging = logfile`

			`# Apache logging prefixes (date-pattern prefix, server, process etc.):`
			`apache-prefix-syslog = %(__prefix_line)s`
			`apache-prefix-logfile = \[\]\s`
			`apache-prefix-all = (?:%(apache-prefix-logfile)s\|%(apache-prefix-syslog)s)?`

be more precise using common `__prefix_line` expression (set `_daemon` to recognize apache and httpd only) 2017-07-12 09:59:02 +00:00			# Setting for __prefix_line (only `logging=syslog`):
			`_daemon = (?:apache\d*\|httpd(?:/\w+)?)`

apache-common.conf: introduced parameter `logging` for possibility to match lines, if apache logs into syslog/systemd journal; added test cases to cover `apache-auth[logging=syslog]`. 2017-07-12 09:25:58 +00:00			`apache-prefix = <apache-prefix-<logging>>`
Apache, detect syslog prefix, simple example 2017-02-17 07:11:33 +00:00
filter.d/apache-auth.conf: - ignore errors from mod_evasive in `normal` mode (mode-controlled now) (gh-2548); - extended with option `mode` - `normal` (default) and `aggressive` close gh-2548 2019-10-18 09:18:34 +00:00			`apache-pref-ignore =`

filter.d/apache-common.conf: remote besides client, gh-3622 2024-03-15 21:36:40 +00:00			`_apache_error_client = <apache-prefix>\[(:?error\|<apache-pref-ignore>\S+:\S+)\]( \[pid \d+(:\S+ \d+)?\])? \[(?:client\|remote) <HOST>(:\d{1,5})?\]`
DOC: in filters, put user relevant doc at top, and developer info at bottom, and remove all the repetative blindly copied stuff that appears in the jail man page 2013-10-30 13:02:59 +00:00
added possibility to specify more precise default date pattern: - `datepattern = {^LN-BEG}` - only line-begin anchored default patterns (matches date only at begin of line, or with max distance up to 2 non-alphanumeric characters from line-begin); - `datepattern = {*WD-BEG}` - only word-begin anchored default patterns; - `datepattern = ^prefix{DATE}suffix` - exact specified default patterns (using prefix and suffix); common filter configs gets a more precise, line-begin anchored (datepattern = {^LN-BEG}) resp. custom anchoring default date-patterns; 2016-10-05 17:34:21 +00:00			`datepattern = {^LN-BEG}`

BF: anchor apache- filters. Close #248 See https://vndh.net/note:fail2ban-089-denial-service for more information 2013-06-11 18:56:25 +00:00			`# Common prefix for [error] apache messages which also would include <HOST>`
BF: support apache 2.4 more detailed error log format. Close #268 2013-06-28 13:34:12 +00:00			`# Depending on the version it could be`
			`# 2.2: [Sat Jun 01 11:23:08 2013] [error] [client 1.2.3.4]`
			`# 2.4: [Thu Jun 27 11:55:44.569531 2013] [core:info] [pid 4101:tid 2992634688] [client 1.2.3.4:46652]`
TST: more test of filters 2013-12-29 05:29:59 +00:00			`# 2.4 (perfork): [Mon Dec 23 07:49:01.981912 2013] [:error] [pid 3790] [client 204.232.202.107:46301] script '/var/www/timthumb.php' not found or unable to`
DOC: in filters, put user relevant doc at top, and developer info at bottom, and remove all the repetative blindly copied stuff that appears in the jail man page 2013-10-30 13:02:59 +00:00			`#`
BF: support apache 2.4 more detailed error log format. Close #268 2013-06-28 13:34:12 +00:00			`# Reference: https://github.com/fail2ban/fail2ban/issues/268`
DOC: in filters, put user relevant doc at top, and developer info at bottom, and remove all the repetative blindly copied stuff that appears in the jail man page 2013-10-30 13:02:59 +00:00			`#`
			`# Author: Yaroslav Halchenko`