I am using Analog with Report Magic on an IIS 6 system. I am having problems removing/excluding certain files and directories. I would like to remove all nimda requests, cmd.exe, /winnt/cmd.exe, and anything trying to get to the following directories:
/Winnt/system /Winnt/system32 /Windows/system /Windows/system32 /winnt/system32/cmd.exe /winnt/system32/root.exe /windows/system32/cmd.exe /windows/system32/root.exe /scripts/ /msadc/ Can someone help me out? The contents of my analog.cfg are listed below: # Configuration file for analog # See http://www.analog.cx/ # # Here are a couple of configuration commands to get you started. Add any more # you like from the Readme. # # Lines starting with # are comments. # # There is a much more extensive configuration file in examples/big.cfg # # If you need a LOGFORMAT command (most people don't -- try it without first!), # it must go here, above the LOGFILE commands. #LOGFILE logfile.log #CST (Winter) #LOGTIMEOFFSET -360 #CDT (Summer) #LOGTIMEOFFSET -300 # URL for the images directory IMAGEDIR images/ # # Whether to use PNG or GIF images PNGIMAGES ON # # URL and local directory for the pie charts # CHARTDIR /images/ # LOCALCHARTDIR /usr/local/apache/htdocs/images/ # # Style sheet for the output page STYLESHEET none CSSPREFIX none #BROWOUTPUTALIAS IWENG AOL LANGUAGE US-ENGLISH SEARCHENGINE http://*altavista.*/* q SEARCHENGINE http://*yahoo.*/* p SEARCHENGINE http://*google.*/* q SEARCHENGINE http://*lycos.*/* query SEARCHENGINE http://*aol.*/* query SEARCHENGINE http://*excite.*/* search SEARCHENGINE http://*go2net.*/* general SEARCHENGINE http://*metacrawler.*/* general SEARCHENGINE http://*msn.*/* MT SEARCHENGINE http://*hotbot.com/* MT SEARCHENGINE http://*netscape.*/* search SEARCHENGINE http://*looksmart.*/* key SEARCHENGINE http://*infoseek.*/* qt SEARCHENGINE http://*webcrawler.*/* search,searchText SEARCHENGINE http://*goto.*/* Keywords SEARCHENGINE http://*snap.*/* keyword SEARCHENGINE http://*dogpile.*/* q SEARCHENGINE http://*askjeeves.*/* ask SEARCHENGINE http://*ask.*/* ask SEARCHENGINE http://*aj.*/* ask SEARCHENGINE http://*directhit.*/* qry SEARCHENGINE http://*alltheweb.*/* query SEARCHENGINE http://*northernlight.*/* qr SEARCHENGINE http://*nlsearch.*/* qr SEARCHENGINE http://*dmoz.*/* search SEARCHENGINE http://*newhoo.*/* search SEARCHENGINE http://*netfind.*/* query,search,s SEARCHENGINE http://*/netfind* query SEARCHENGINE http://*/pursuit query ROBOTINCLUDE REGEXPI:robot ROBOTINCLUDE REGEXPI:spider ROBOTINCLUDE REGEXPI:crawler ROBOTINCLUDE Googlebot* ROBOTINCLUDE Infoseek* ROBOTINCLUDE Scooter* ROBOTINCLUDE Slurp* ROBOTINCLUDE Ultraseek* # Aliases: see docs/alias.html # I can't list all of them, but there are aliases for individual items, e.g. # FILEALIAS /football/* /soccer/* # and there are also aliases for each report, e.g. # REQALIAS /soccer/* "Football: /soccer/*" # You can also use regular expressions: # FILEALIAS REGEXP:^/(football|soccer)/(.*) /$2 TYPEALIAS .html ".html [Hypertext Markup Language]" TYPEALIAS .htm ".htm [Hypertext Markup Language]" TYPEALIAS .shtml ".shtml [Server-parsed HTML]" TYPEALIAS .ps ".ps [PostScript]" TYPEALIAS .gz ".gz [Gzip compressed files]" TYPEALIAS .tar.gz ".tar.gz [Compressed archives]" TYPEALIAS .jpg ".jpg [JPEG graphics]" TYPEALIAS .jpeg ".jpeg [JPEG graphics]" TYPEALIAS .gif ".gif [GIF graphics]" TYPEALIAS .png ".png [PNG graphics]" TYPEALIAS .txt ".txt [Plain text]" TYPEALIAS .cgi ".cgi [CGI scripts]" TYPEALIAS .pl ".pl [Perl scripts]" TYPEALIAS .css ".css [Cascading Style Sheets]" TYPEALIAS .class ".class [Java class files]" TYPEALIAS .pdf ".pdf [Adobe Portable Document Format]" TYPEALIAS .zip ".zip [Zip archives]" TYPEALIAS .hqx ".hqx [Macintosh BinHex files]" TYPEALIAS .exe ".exe [Executables]" TYPEALIAS .wav ".wav [WAV sound files]" TYPEALIAS .avi ".avi [AVI movies]" TYPEALIAS .arc ".arc [Compressed archives]" TYPEALIAS .mid ".mid [MIDI sound files]" TYPEALIAS .mp3 ".mp3 [MP3 sound files]" TYPEALIAS .doc ".doc [Microsoft Word document]" TYPEALIAS .rtf ".rtf [Rich Text Format]" TYPEALIAS .mov ".mov [Quick Time movie]" TYPEALIAS .mpg ".mpg [MPEG movie]" TYPEALIAS .mpeg ".mpeg [MPEG movie]" TYPEALIAS .asp ".asp [Active Server Pages]" TYPEALIAS .jsp ".jsp [Java Server Pages]" TYPEALIAS .cfm ".cfm [Cold Fusion]" TYPEALIAS .php ".php [PHP]" TYPEALIAS .js ".js [JavaScript code]" OSCHARTEXPAND Windows # Add whichever of these types of pages you have on your server, or others. # PAGEINCLUDE *.shtml PAGEINCLUDE *.asp # PAGEINCLUDE *.jsp # PAGEINCLUDE *.cfm # PAGEINCLUDE *.pl PAGEINCLUDE *.php # Controlling status codes: see docs/include.html # STATUSINCLUDE 200-299,304 # STATUSEXCLUDE 206 304ISSUCCESS ON # Which browsers count as robots in the Operating System Report ROBOTINCLUDE REGEXPI:robot ROBOTINCLUDE REGEXPI:spider ROBOTINCLUDE REGEXPI:crawler ROBOTINCLUDE Googlebot* ROBOTINCLUDE msnbot* ROBOTINCLUDE Infoseek* ROBOTINCLUDE Scooter* ROBOTINCLUDE *Slurp* ROBOTINCLUDE *Validator* ROBOTINCLUDE Ultraseek* #Exclude Exchange FILEEXCLUDE /Exchange FILEEXCLUDE /Exchange/* #Exclude Windows/System & Windows/System32 FILEEXCLUDE /winnt/system32/* FILEEXCLUDE /windows/system32/* FILEEXCLUDE /winnt/system/* FILEEXCLUDE /windows/system/* #Exclude /scripts/ FILEEXCLUDE /scripts/* FILEEXCLUDE /msadc/* FILEEXCLUDE /winnt/system32/cmd.exe FILEEXCLUDE /winnt/system32/root.exe FILEEXCLUDE /windows/system32/cmd.exe FILEEXCLUDE /windows/system32/root.exe #Exclude Front Page stuff FILEEXCLUDE /_vti_bin/* FILEEXCLUDE /_derived/* FILEEXCLUDE /_themes/* FILEEXCLUDE /_vti_inf.html # Whether each report is wanted: see docs/output.html GENERAL ON YEARLY OFF QUARTERLY OFF MONTHLY ON DAILYREP ON DAILYSUM ON WEEKLY ON HOURLYREP ON HOURLYSUM ON QUARTERREP ON QUARTERSUM ON FIVEREP ON FIVESUM ON DOMAIN ON ORGANISATION ON DIRECTORY ON FILETYPE ON REQUEST ON REDIR ON FAILURE ON SIZE ON PROCTIME ON HOST ON REDIRHOST ON FAILHOST ON REFERRER ON REFSITE ON REDIRREF ON FAILREF ON VHOST ON REDIRVHOST ON FAILVHOST ON USER ON REDIRUSER ON FAILUSER ON SEARCHQUERY ON SEARCHWORD ON INTSEARCHQUERY OFF INTSEARCHWORD OFF BROWSERREP ON BROWSERSUM ON OSREP ON STATUS ON # The columns in each report: see docs/timereps.html and docs/othreps.html TIMECOLS RPrpBb YEARCOLS RPrpBb QUARTERLYCOLS RPrpBb MONTHCOLS RPrpBb WEEKCOLS RPrpBb DAYREPCOLS RPrpBb DAYSUMCOLS RPrpBb HOURREPCOLS RPrpBb HOURSUMCOLS RPrpBb QUARTERREPCOLS RPrpBb QUARTERSUMCOLS RPrpBb FIVEREPCOLS RPrpBb FIVESUMCOLS RPrpBb DOMCOLS RPrpBbDN ORGCOLS RPrpBbDN HOSTCOLS RPrpBbDN REDIRHOSTCOLS RDN FAILHOSTCOLS RDN DIRCOLS RPrpBbDN TYPECOLS RrBbDN REQCOLS RrpBbDN REDIRCOLS RrDN FAILCOLS RrDN REFCOLS RrDN REFSITECOLS RrDN REDIRREFCOLS RrDN FAILREFCOLS RrDN BROWREPCOLS RPrpBbDN BROWSUMCOLS RPrpBbDN OSCOLS NRPrpBbDN SIZECOLS RPrpBbD PROCTIMECOLS RPrpBbD VHOSTCOLS RPrpBbDN REDIRVHOSTCOLS RrDN FAILVHOSTCOLS RrDN USERCOLS RrDN REDIRUSERCOLS RrDN FAILUSERCOLS RrDN SEARCHQUERYCOLS RPrpBbDN SEARCHWORDCOLS RPrpBbDN INTSEARCHQUERYCOLS RPrpBbDN INTSEARCHWORDCOLS RPrpBbDN STATUSCOLS RrD # How the graphs are plotted: see docs/timereps.html ALLGRAPH P YEARGRAPH P MONTHGRAPH P DAYREPGRAPH P DAYSUMGRAPH P HOURREPGRAPH P HOURSUMGRAPH P WEEKGRAPH P QUARTERREPGRAPH P QUARTERSUMGRAPH P FIVEREPGRAPH P FIVESUMGRAPH P # Whether the time reports run forwards or backwards: see docs/timereps.html ALLBACK OFF YEARBACK OFF QUARTERLYBACK OFF MONTHBACK OFF DAYREPBACK OFF HOURREPBACK OFF WEEKBACK OFF QUARTERREPBACK OFF FIVEREPBACK OFF # The number of rows to display in each time report: see docs/timereps.html YEARROWS 0 QUARTERLYROWS 0 MONTHROWS 0 WEEKROWS 0 DAYREPROWS 42 HOURREPROWS 72 QUARTERREPROWS 96 FIVEREPROWS 288 # The floors for each report: see docs/othreps.html and docs/hierreps.html REQFLOOR 20r REQARGSFLOOR 10r REDIRFLOOR -30r REDIRARGSFLOOR 10r FAILFLOOR -30r FAILARGSFLOOR 10r DOMFLOOR 0b SUBDOMFLOOR 0.5%b ORGFLOOR -20r SUBORGFLOOR 0.5%r DIRFLOOR 0.01%b SUBDIRFLOOR 0.01%b TYPEFLOOR 0.1%b SUBTYPEFLOOR 0.1%b HOSTFLOOR -50r REDIRHOSTFLOOR -20r FAILHOSTFLOOR -20r REFFLOOR 20r REFARGSFLOOR 10r REFSITEFLOOR -30r REFDIRFLOOR 50r REDIRREFFLOOR -30r REDIRREFARGSFLOOR 10r FAILREFFLOOR -30r FAILREFARGSFLOOR 10r BROWSUMFLOOR -20r SUBBROWFLOOR -20r BROWREPFLOOR -40r OSFLOOR 0p SUBOSFLOOR 0p VHOSTFLOOR -20b REDIRVHOSTFLOOR -20r FAILVHOSTFLOOR -20r USERFLOOR -50r REDIRUSERFLOOR -20r FAILUSERFLOOR -20r SEARCHQUERYFLOOR -30r SEARCHWORDFLOOR -30r INTSEARCHQUERYFLOOR -30r INTSEARCHWORDFLOOR -30r STATUSFLOOR 0r # How each report is sorted: see docs/othreps.html and docs/hierreps.html REQSORTBY REQUESTS REDIRSORTBY REQUESTS FAILSORTBY REQUESTS DOMSORTBY BYTES ORGSORTBY REQUESTS DIRSORTBY BYTES TYPESORTBY BYTES HOSTSORTBY ALPHABETICAL REDIRHOSTSORTBY REQUESTS FAILHOSTSORTBY REQUESTS REFSORTBY REQUESTS REFSITESORTBY REQUESTS REDIRREFSORTBY REQUESTS FAILREFSORTBY REQUESTS BROWREPSORTBY REQUESTS BROWSUMSORTBY REQUESTS OSSORTBY PAGES SUBOSSORTBY PAGES VHOSTSORTBY BYTES REDIRVHOSTSORTBY REQUESTS FAILVHOSTSORTBY REQUESTS USERSORTBY REQUESTS REDIRUSERSORTBY REQUESTS FAILUSERSORTBY REQUESTS SEARCHQUERYSORTBY REQUESTS SEARCHWORDSORTBY REQUESTS INTSEARCHQUERYSORTBY REQUESTS INTSEARCHWORDSORTBY REQUESTS STATUSSORTBY ALPHABETICAL # Whether and how pie charts are plotted: see docs/othreps.html REQCHART ON REDIRCHART ON FAILCHART ON TYPECHART ON SIZECHART ON PROCTIMECHART ON DIRCHART ON HOSTCHART ON REDIRHOSTCHART ON FAILHOSTCHART ON DOMCHART ON ORGCHART ON REFCHART ON REFSITECHART ON REDIRREFCHART ON FAILREFCHART ON BROWREPCHART ON BROWSUMCHART ON OSCHART ON VHOSTCHART ON REDIRVHOSTCHART ON FAILVHOSTCHART ON USERCHART ON REDIRUSERCHART ON FAILUSERCHART ON SEARCHQUERYCHART ON SEARCHWORDCHART ON INTSEARCHQUERYCHART ON INTSEARCHWORDCHART ON STATUSCHART ON # Zoom in on some wedges using CHARTEXPAND # OSCHARTEXPAND Windows # What to link to in the reports REQLINKINCLUDE pages REDIRLINKEXCLUDE * FAILLINKEXCLUDE * REFLINKINCLUDE * REDIRREFLINKINCLUDE * FAILREFLINKINCLUDE * # BASEURL http://my.server.com # Cosmetic commands: mostly in docs/output.html OUTPUT COMPUTER LANGUAGE ENGLISH # LANGFILE uk.lng # DOMAINSFILE ukdom.tab # DESCFILE ukdesc.txt HEADERFILE none FOOTERFILE none REPORTORDER x1QmWDdHwh4657oZSlLujJkKfsNnBbpvRMcPztiEIYyr GENSUMLINES ALL GOTOS ON RUNTIME ON DESCRIPTIONS ON REPORTSPAN OFF REPORTSPANTHRESHOLD 60 WEEKBEGINSON SUNDAY LASTSEVEN ON MARKCHAR + # SEPCHAR and DECPOINT are usually taken from the language file # SEPCHAR , # DECPOINT . REPSEPCHAR none COMPSEP " " RAWBYTES OFF BYTESDP 2 NOROBOTS ON SEARCHCHARCONVERT ON BARSTYLE b HTMLPAGEWIDTH 65 ASCIIPAGEWIDTH 76 MINGRAPHWIDTH 15 # The following commands are only available on some systems: see docs/dns.html DNSFILE dnscache DNS WRITE # DNSLOCKFILE dnslock # DNSGOODHOURS 100000 # DNSBADHOURS 336 # DNSTIMEOUT 10 # Sub-item commands: see docs/hierreps.html. Examples are # SUBDOM *.com # SUBDIR /*/*/ SUBTYPE *.gz,*.Z # A list of search engines. More SEARCHENGINE commands can be found at # http://www.analog.cx/helpers/#conffiles SEARCHENGINE http://*google.*/* q,as_q,as_epq,as_oq SEARCHENGINE http://*altavista.*/* q SEARCHENGINE http://*yahoo.*/* p SEARCHENGINE http://*lycos.*/* query,wfq SEARCHENGINE http://*aol.*/* query SEARCHENGINE http://*excite.*/* search SEARCHENGINE http://*go2net.*/* general SEARCHENGINE http://*metacrawler.*/* general SEARCHENGINE http://*msn.*/* q,MT SEARCHENGINE http://*netscape.*/* search SEARCHENGINE http://*looksmart.*/* key SEARCHENGINE http://*webcrawler.*/* qkw,search,searchText SEARCHENGINE http://*overture.*/* Keywords SEARCHENGINE http://*teoma.*/* q SEARCHENGINE http://*infospace.*/* qkw SEARCHENGINE http://*alltheweb.*/* q SEARCHENGINE http://*dogpile.*/* q SEARCHENGINE http://*ask.*/* q,ask SEARCHENGINE http://*alltheweb.*/* query SEARCHENGINE http://*northernlight.*/* qr SEARCHENGINE http://*nlsearch.*/* qr SEARCHENGINE http://*dmoz.*/* search SEARCHENGINE http://*/netfind* query SEARCHENGINE http://*/pursuit query # Search engines on your own site # INTSEARCHENGINE /cgi-bin/my.cgi q # Use one of these if you are short of memory: see docs/lowmem.html FILELOWMEM 0 HOSTLOWMEM 0 BROWLOWMEM 0 +------------------------------------------------------------------------ | TO UNSUBSCRIBE from this list: | http://lists.meer.net/mailman/listinfo/analog-help | | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general | List archives: http://www.analog.cx/docs/mailing.html#listarchives +------------------------------------------------------------------------
