Re: [cobalt-users] Webalizer 2.01 stats skewed by Code Red

["MikeM" <MyRaQ@xxxxxxxxx>]

On 8/11/2001 at 1:03 PM Steve Werby wrote:

| "MikeM" <MyRaQ@xxxxxxxxx> wrote:
| > I inserted the following line in my /etc/webalizer.conf file to
| > have webalizer ignore the hits from Microsoft's Code Red fiasco:
| >
| > IgnoreAgent -
| >
| > Yes, that is a single "hyphen" after the tab.  The Code Red
| > worm uses the hyphen as its agent name.
| 
| In case a User Agent of "-" is used by others not related you might want
| to consider the IgnoreURL keyword instead.
| 
| 'IgnoreURL default.ida' should accomplish the same thing.  Which you use
| really depends on which you believe is more likely to result in false
| positives.
| 
==================


Code Red also uses a Referer URL of "-", so IgnoreReferrer (check for the proper spelling in the conf file) is another keyword that can be used.