Re: false positive http probe reports from routine 408

Thanks for pointing that out.  Unfortunately the "exploit list" is
severely broken - it is not maintained, it is out of date, it was never
complete or comprehensive, so its use is deprecated.  A variable called
HTTP_IGNORE_ERROR_HACKS was added so that it could be disabled from the
service configuration file.

I've chosen to remove the "null" entry from that list.  Let me know if
that does not fix your issue.



Bjorn



On 10/02/2018 10:25 AM, Gilles Detillieux wrote:
> Earlier, I wrote:
>> There's a long-standing false-positive in the http service script which 
>> I finally got around to looking into and patching. When Apache logs 408 
>> Request timeout errors, it logs these with a null request field (just a 
>> "-"). These are routine errors when the client keeps the socket open too 
>> long without a request, but they're reported as probes/known hack 
>> attempts. This patch quiets down that noise, just giving a count of 408 
>> errors at the end...
> 
> Unfortunately Thunderbird changed a bunch of the spaces in the patch to
> non-breaking spaces, which might make the patch hard to apply unless you
> hand-edit. Here's a cleaner version...
> 
> --- logwatch-7.4.3/scripts/services/http.orig	2016-03-30 16:32:34.000000000 -0500
> +++ logwatch-7.4.3/scripts/services/http	2018-10-02 10:55:19.000000000 -0500
> @@ -387,6 +387,8 @@ while (my $line = <STDIN>) {
>     ($field{method},$field{url},$field{protocol}) = split(/
> +/,$field{"request"});
>     if (! $field{url}) {
>        $field{url}='null';
> +#     don't count timeout errors as null requests...
> +      $field{url}='-' if $field{http_rc} == 408;
>     }
>     $field{lc_url} = lc $field{url};
>  
> 
>