Prevent logging of 400 errors in Apache httpd

Question

Somebody is sending a bunch of garbage data to port 80 on my Apache server, causing tons of 400 Bad Request errors. There's nothing I can really do about it, unfortunately, but can I at least prevent it from filling up my logs? I can't find a way to filter based on status code in If, SetEnvIf, or mod_rewrite.

Answer 1

In your case, you are wanting to conditional logging based on the response of a query. Most conditional logging, such as by IP or URL path, operates on the request.

Prior to httpd 2.4, you might do something like the following to not log certain requests based on data in the request.

eg.

SetEnvIf Request_URI "^/wpad.dat(.*)$" noise
SetEnvIf Request_URI "^/favicon.ico$" noise

CustomLog access_log combined env=!noise

However, using SetEnvIf is only useful for filtering based on requests. We would need an environment variable (in the Apache httpd sence) that gives us the response code, as CustomLog gets processed at the end of the request.

In httpd 2.4, we also have the more flexible construct of the 'expression', so CustomLog might have either an 'env=xxx', or 'expr=xxx'

From http://httpd.apache.org/docs/current/mod/mod_log_config.html

"The third argument is optional and controls whether or not to log a particular request. The condition can be the presence or absence (in the case of a 'env=!name' clause) of a particular variable in the server environment."

So your question really boils down to: "is there an httpd environment variable that gives me the response code that was generated for a request"

See: Apache environment variables list? and: https://httpd.apache.org/docs/2.4/expr.html#vars

From the documentation itself:

# Conditional logging
CustomLog logs/access-errors.log common "expr=%{REQUEST_STATUS} >= 400"
CustomLog logs/access-errors-specific.log common "expr=%{REQUEST_STATUS} -in {'405','410'}"

Answer 2

LogLevel will allow you to set what severity of issues you are on the error log. CustomLog will allow you to edit what content is shown in the access log.

See https://httpd.apache.org/docs/1.3/logs.html#errorlog and links therein to find a solution for your exact issue as it's unclear which log you're talking about currently

Conditional Logging There are times when it is convenient to exclude certain entries from the access logs based on characteristics of the client request. This is easily accomplished with the help of environment variables. First, an environment variable must be set to indicate that the request meets certain conditions. This is usually accomplished with SetEnvIf. Then the env= clause of the CustomLog directive is used to include or exclude requests where the environment variable is set. Some examples:

# Mark requests from the loop-back interface:
SetEnvIf Remote_Addr "127\.0\.0\.1" dontlog
# Mark requests for the robots.txt file:
SetEnvIf Request_URI "^/robots\.txt$" dontlog
# Log what remains:
CustomLog logs/access_log common env=!dontlog

As another example, consider logging requests from english-speakers to one log file, and non-english speakers to a different log file.

SetEnvIf Accept-Language "en" english
CustomLog logs/english_log common env=english
CustomLog logs/non_english_log common env=!english

Although we have just shown that conditional logging is very powerful and flexibly, it is not the only way to control the contents of the logs. Log files are more useful when they contain a complete record of server activity. It is often easier to simply post-process the log files to remove requests that you do not want to consider.

Answer 3

Try temporarily add a rule in your iptables to drop any requests incoming from that IP address. Maybe its some script kiddie playing around. But would strongly recommend using firewalls for preventing such things before they reaching your webserver, something like ufw or intrusion detection systems like snort.