Re: How to limit access rate by header?

It perfectly worked! I've just combined setenv:dontlog in all rules I
needed and that's it. This really helps me to keep an eye in the logs.

Thank you!

El mié., 12 de dic. de 2018 a la(s) 22:26, Manuel Spartan (
[email protected]) escribió:

> Try a modsec with ctl:setenv with pmf to the bot file for
> request_headers:user-agent. So if the header is in the file then set the
> nolog env.
> Having two update point is painful on the long run.
> Cheers!
>
> Sent from my iPhone
>
> On 12 Dec 2018, at 20:05, Luciano Guillermo Fantuzzi <
> [email protected]> wrote:
>
> Yes, I had to do it that way. Just in case:
>
> ---
> # Local messages
> SetEnvIf Remote_Addr "127\.0\.0\.1" dontlog
> SetEnvIf Remote_Addr "::1" dontlog
> SetEnvIfNoCase User-Agent "internal dummy connection" dontlog
>
> # Not interesting
> SetEnvIfNoCase Request_URI "^/robots\.txt$" dontlog
>
> # Only relevant for modsec log (it will output to error log eventually)
> # Note: Keep this list updated with /etc/modsecurity/data/*.data
> SetEnvIfNoCase User-Agent (Googlebot|bingbot\
>
>
>
> |AhrefsBot|MJ12bot|trovitBot|AwarioRssBot|Semrush|DotBot|BLEXBot|YandexBot|YandexMobileBot|PaperLiBot|Baidu|ZoominfoBot\
> |facebookexternalhit) dontlog
>
> CustomLog ${APACHE_LOG_DIR}/other_vhosts_access.log vhost_combined
> env=!dontlog
> ---
>
> The only thing that I don't like of this approach is that I can't pass
> SetEnvIf a file to read, so I'll have to keep both (*.data and .conf files)
> in sync.
>
>
> El mié., 12 de dic. de 2018 a la(s) 21:39, Manuel Spartan (
> [email protected]) escribió:
>
>> Hi Luciano, you can achieve that with environment variables and a custom
>> log format with an env condition in Apache.
>> Modsec writes error and audit log only, access log tricks can be useful
>> to prevent IP/personal/financial leaks.
>>
>> Cheers!
>>
>> Sent from my iPhone
>>
>> On 12 Dec 2018, at 18:16, Luciano Guillermo Fantuzzi <
>> [email protected]> wrote:
>>
>> Something I couldn't find in the docs. Is it possible to avoid logging in
>> the access log? With nolog action I can avoid logging it in error log (and
>> audit log, but it's turned off), but I couldn't find a way to avoid
>> displaying a message in the access log on every rule match. I find this
>> important because my idea was to sepparate logs and keep the access log as
>> clean as possible so I can analyze bots/crawlers not being catched in my
>> rules.
>>
>> Thanks.
>>
>> El mié., 12 de dic. de 2018 a la(s) 18:32, Christian Folini (
>> [email protected]) escribió:
>>
>>> On Wed, Dec 12, 2018 at 06:16:49PM -0300, Luciano Guillermo Fantuzzi
>>> wrote:
>>> > Oh, I didn't realize we were not anymore in the main mailing thread.
>>> I'm
>>> > re-joining it from here.
>>>
>>> Yes, I took it private after things turned sour following my comment.
>>>
>>> Glad it worked out for your in the end.
>>>
>>> Ahoj,
>>>
>>> Christian
>>>
>>> --
>>> If liberty means anything at all, it means the right to tell people
>>> what they do not want to hear.
>>> -- George Orwell
>>>
>>>
>>> _______________________________________________
>>> mod-security-users mailing list
>>> [email protected]
>>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>>> http://www.modsecurity.org/projects/commercial/rules/
>>> http://www.modsecurity.org/projects/commercial/support/
>>>
>> _______________________________________________
>> mod-security-users mailing list
>> [email protected]
>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>> http://www.modsecurity.org/projects/commercial/rules/
>> http://www.modsecurity.org/projects/commercial/support/
>>
>> _______________________________________________
>> mod-security-users mailing list
>> [email protected]
>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>> http://www.modsecurity.org/projects/commercial/rules/
>> http://www.modsecurity.org/projects/commercial/support/
>>
> _______________________________________________
> mod-security-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>
> _______________________________________________
> mod-security-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>

_______________________________________________
mod-security-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/