detect_http_attack.conf

#
# Detect HTTP Attack
#
# Configuration file
#
#=========================


#=========================
# Exclueded access targets 
#==========================
#
# Excluded hosts (comma-separated)
exc_hosts=127.0.0.1

# Excluded User-Agent (regular expression with ignored case)
exc_ua_match=bot|google

# Excluded path (regular expression)
exc_path_match=\.(js|css|jpg|gif|png|ico)$


#==================
# Output Template
#==================
#
# Template consists of three lines 'head', 'body' and 'foot'.
# Attack log treats sequential accesses from each host as BLOCK.
# 'head' is a first line of BLOCK.
# 'body' is a line for each access.
# 'foot' is a last line of BLOCK.
#
# If '-n' flag is specified,
# attack access is printed as 'serr' line to STDERR
# whenever they are detected.
#
# Each line is specified escape sequences and fields.
# Field name begins with '$'.
#
#
# == Field List ==
#
#  = Apache, Nginx Combined Log Format =
#
#  > $host $ident $user [$time] "$req" $status $size $referer "$ua"
#  > 66.249.XX.XX - - [10/Feb/2013:10:27:45 +0900] "GET / HTTP/1.1" 200 1500 "-" "Searchbot/2.1"
#  
#   host    = 66.249.XX.XX
#   ident   = -
#   user    = -
#   time    = 10/Feb/2013:10:27:45 +0900
#   req     = GET / HTTP/1.1
#   status  = 200
#   size    = 1500
#   referer = -
#   ua      = Searchbot/2.1
# 
#  And futhermore, req is broken down into method, path and version.
# 
#   method  = GET
#   path    = /
#   version = HTTP/1.1
#
#
#  = LTSV Format =
#
#  Field name is applied to each label.
#  And futhermore, req is broken down into method, path and version.
#

#
# == Formats ==
#
#  = Terminal View Format for "tail -f access_log | " =
# 
#  head is host, count, ua.
#    host that is IP address or Hostname is cyan bold.
#    count that is the number of sequential access is magenta.
#    ua that is User-Agent is green.
# 
#  body is date, status, path, size.
#    date is access date time by Ruby standard output.
#    status is HTTP status code.
#    path is the request path of URL.
#    referer is HTTP Referer.
#      
#  foot is empty line.
# 
#  serr is red host, count, ua, date, status, path and referer at two lines.
# 
head=\e[36m\e[1m$host\e[0m\t\e[35m$count\e[0m\t\e[32m$ua\e[0m\n
body=$date\t$status\t$path\t$referer\n
foot=\n
serr=\e[31m\e[1m$host\e[0m\t\e[33m\e[1m$count\e[0m\t$ua\n$date\t$status\t$path\t$referer\n\n

#
# = Terminal View Format without color sequences =
#
#head=$host\t$count\t$ua\n
#body=$date\t$status\t$path\t$referer\n
#foot=\n
#serr=$host\t$count\t$ua\n$date\t$status\t$path\t$referer\n\n

#
# = LTSV format =
#
#  head and foot aren't output.
#  body is time, host and req.
#
##head=
#body=time:[$time]\thost:$host\treq:$req\n
##foot=
#serr=time:[$time]\thost:$host\treq:$req\n


# == Date Format ==
#
# Specify output format of 'date' field 
#
# The default is ISO 8601 format. ex. 2001-02-03T04:05:06-07:00
# For detail of definition, refer to
# http://www.ruby-doc.org/stdlib-1.9.3/libdoc/date/rdoc/DateTime.html#method-i-strftime
#
#
# ISO 8601 format without Time zone offset
# ex) 2001-02-03T04:05:06
#date_format=%Y-%m-%dT%H:%M:%S