Re: mod_reqtimeout logging

2011-02-12 Thread Stefan Fritsch
On Thursday 10 February 2011, Daniel Ruggeri wrote: On 2/10/2011 2:21 AM, Nick Gearls wrote: Probably not, but as we specify the time-outs to allow all normal requests (we hope), I'd like to be warned when an attack occurs, but also if one of my genuine customers is blocked (to possibly

Re: mod_reqtimeout logging

2011-02-10 Thread Nick Gearls
Probably not, but as we specify the time-outs to allow all normal requests (we hope), I'd like to be warned when an attack occurs, but also if one of my genuine customers is blocked (to possibly fine-tunes the time-outs). Another option would be to set an environment variable, so I could

Re: mod_reqtimeout logging

2011-02-10 Thread Daniel Ruggeri
On 2/10/2011 2:21 AM, Nick Gearls wrote: Probably not, but as we specify the time-outs to allow all normal requests (we hope), I'd like to be warned when an attack occurs, but also if one of my genuine customers is blocked (to possibly fine-tunes the time-outs). We should figure out what the

Re: mod_reqtimeout logging

2011-02-10 Thread Jeff Trawick
On Wed, Feb 9, 2011 at 10:28 AM, Nick Gearls nickgea...@gmail.com wrote: Hello, When an attack (timeout) is detected, it is logged at the info level. Shouldn't this be considered as a warning? Counters would be nice for this since you want to know something about the big picture before

RE: mod_reqtimeout logging

2011-02-10 Thread Plüm, Rüdiger, VF-Group
I am as well. WARN sounds good. Regards Rüdiger -Original Message- From: Jim Jagielski Sent: Mittwoch, 9. Februar 2011 16:40 To: dev@httpd.apache.org Subject: Re: mod_reqtimeout logging I'd be +1 on moving it higher... On Feb 9, 2011, at 10:28 AM, Nick Gearls wrote

mod_reqtimeout logging

2011-02-09 Thread Nick Gearls
Hello, When an attack (timeout) is detected, it is logged at the info level. Shouldn't this be considered as a warning? Regards, Nick

Re: mod_reqtimeout logging

2011-02-09 Thread Jim Jagielski
I'd be +1 on moving it higher... On Feb 9, 2011, at 10:28 AM, Nick Gearls wrote: Hello, When an attack (timeout) is detected, it is logged at the info level. Shouldn't this be considered as a warning? Regards, Nick

Re: mod_reqtimeout logging

2011-02-09 Thread Eric Covener
On Wed, Feb 9, 2011 at 10:28 AM, Nick Gearls nickgea...@gmail.com wrote: Hello, When an attack (timeout) is detected, it is logged at the info level. Shouldn't this be considered as a warning? Can it know when one of the timeouts looks malicious vs. just being delayed? -- Eric Covener