Geek Answers Handbook

Is it possible to exclude the specified GET parameters in apache access logs?

I need to exclude some secret data in my apache log, but I want to keep the log and uri in it. Is it possible to do the following in my access log:

127.0.0.1 - - [27/Feb/2012:13:18:12 +0100] "GET /api.php?param=secret HTTP/1.1" 200 7600 "http://localhost/api.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11"

I want to replace "secret" with "[FILTERED]" as follows:

 127.0.0.1 - - [27/Feb/2012:13:18:12 +0100] "GET /api.php?param=[FILTERED] HTTP/1.1" 200 7600 "http://localhost/api.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11"

I know that I probably should have used POST to send this variable, but the damage has already been done. I looked at http://httpd.apache.org/docs/2.4/logs.html and LogFormat, but could not find a way to use a regular expression or the like. Any suggestions?

[edit]

DO NOT send sensitive variables as GET parameters if you have a choice.

+4
source share
1 answer

I found one way to solve the problem. If I connect the output of the log to sed , I can replace the regular expression in the output before attaching it to the log file.

Example 1

 CustomLog "|/bin/sed -E s/'param=[^& \t\n]*'/'param=\[FILTERED\]'/g >> /your/path/access.log" combined

Example 2

You can also exclude several options:

exclude.sh

 #!/bin/bash while read x ; do result=$x for ARG in " $@ " do cleanArg=`echo $ARG | sed -E 's|([^0-9a-zA-Z_])|\\\\\1|g'` result=`echo $result | sed -E s/$cleanArg'=[^& \t\n]*'/$cleanArg'=\[FILTERED\]'/g` done echo $result done

Move the script above to the / opt / scripts / folder or somewhere else, give the script permission ( chmod +x exclude.sh ) and change the Apache configuration as follows:

 CustomLog "|/opt/scripts/exclude.sh param param1 param2 >> /your/path/access.log" combined

Documentation

http://httpd.apache.org/docs/2.4/logs.html#piped

http://www.gnu.org/software/sed/manual/sed.html

+8
source

More articles:


All Articles