Re: [cobalt-users] Webalizer 2.01 stats skewed by Code Red

["Steve Werby" <steve-lists@xxxxxxxxxxxx>]

"Ted Behling" <TBehling@xxxxxxxxxxxxx> wrote:
> At 07:39 PM 8/11/01 -0400, MikeM wrote:
> >On 8/11/2001 at 1:03 PM Steve Werby wrote:
> >
> >| "MikeM" <MyRaQ@xxxxxxxxx> wrote:
> >| > Yes, that is a single "hyphen" after the tab.  The Code Red
> >| > worm uses the hyphen as its agent name.
> >|
> >| In case a User Agent of "-" is used by others not related you might
want
> >| to consider the IgnoreURL keyword instead.
> >
> >Code Red also uses a Referer URL of "-", so IgnoreReferrer (check for the
> proper spelling in the conf
> >file) is another keyword that can be used.
>
> Minor correction.  Code Red doesn't specify a Referer or User Agent at
all.
> Apache puts a hyphen in your log if the client doesn't specify either
> header.  Test this by telnetting to port 80 whlie you tail -f your access
log.
>
> (BTW, Steve, could you please set your mailer to use > instead of | when
> quoting?

I think you meant to ask Mike that, not me.  I use ">" to quote in all of my
mail programs (The Bat, Pine and OE I'm currently replying with that
occasionally forces me to add the ">" manually).

--
Steve Werby
President, Befriend Internet Services LLC
http://www.befriend.com/