Re: false positive http probe reports from routine 408

Earlier, I wrote:
> There's a long-standing false-positive in the http service script which 
> I finally got around to looking into and patching. When Apache logs 408 
> Request timeout errors, it logs these with a null request field (just a 
> "-"). These are routine errors when the client keeps the socket open too 
> long without a request, but they're reported as probes/known hack 
> attempts. This patch quiets down that noise, just giving a count of 408 
> errors at the end...

Unfortunately Thunderbird changed a bunch of the spaces in the patch to
non-breaking spaces, which might make the patch hard to apply unless you
hand-edit. Here's a cleaner version...

--- logwatch-7.4.3/scripts/services/http.orig	2016-03-30 16:32:34.000000000 -0500
+++ logwatch-7.4.3/scripts/services/http	2018-10-02 10:55:19.000000000 -0500
@@ -387,6 +387,8 @@ while (my $line = <STDIN>) {
    ($field{method},$field{url},$field{protocol}) = split(/
+/,$field{"request"});
    if (! $field{url}) {
       $field{url}='null';
+#     don't count timeout errors as null requests...
+      $field{url}='-' if $field{http_rc} == 408;
    }
    $field{lc_url} = lc $field{url};
 


-- 
Gilles R. Detillieux              E-mail: <grdetil-b3I9/Z444iDkHagxZOarhfd9D2ou9A/[email protected]>
Spinal Cord Research Centre       WWW:    http://www.scrc.umanitoba.ca/
Dept. of Physiology and Pathophysiology, Rady Faculty of Health Sciences,
Univ. of Manitoba  Winnipeg, MB  R3E 0J9  (Canada)