Re: [cobalt-users] Webalizer 2.01 stats skewed by Code Red

[Ted Behling <TBehling@xxxxxxxxxxxxx>]

At 07:39 PM 8/11/01 -0400, MikeM wrote:
>On 8/11/2001 at 1:03 PM Steve Werby wrote:
>
>| "MikeM" <MyRaQ@xxxxxxxxx> wrote:
>| > Yes, that is a single "hyphen" after the tab.  The Code Red
>| > worm uses the hyphen as its agent name.
>| 
>| In case a User Agent of "-" is used by others not related you might want
>| to consider the IgnoreURL keyword instead.
>
>Code Red also uses a Referer URL of "-", so IgnoreReferrer (check for the
proper spelling in the conf 
>file) is another keyword that can be used.

Minor correction.  Code Red doesn't specify a Referer or User Agent at all.
Apache puts a hyphen in your log if the client doesn't specify either
header.  Test this by telnetting to port 80 whlie you tail -f your access log.

(BTW, Steve, could you please set your mailer to use > instead of | when
quoting?

--------------------------------------------------------------------------
Ted Behling, Web Application Developer - Monarch Information Systems, Inc.

43 Folly Field Road, Unit 4, Hilton Head Island, SC 29928-5434
E-mail: mailto:TBehling@xxxxxxxxxxxxx
Phone/Fax: 1-800-842-7894    Local or Outside the USA: 1-843-842-7894
Cell Phone (urgent issues): 843-816-7895
Cell Phone E-mail: mailto:TedPhone@xxxxxxxxxxxxx (116 letter limit)
Web site: http://www.MonarchIS.net
--------------------------------------------------------------------------