Is it possible to add IP address for 404 status in Request Log?

Questions
#1

I understand that this may be a stale old question and that it may not be possible for various reasons.

However, I have noticed so many 404 statuses in the request logs that it would be useful to see where they come from. It’s obvious that they are attempts to force a way in to the host server.

The referrer field isn’t really helpful, I mostly see " There were no detected referrers to this URL.".

I suppose my question is, can I extend the Request Log to include the request IP address?

Thanks All.

#2

Hey @Call2call

The feature is aimed to see if you have broken links in your website.

The records show a cumulative version of the event, so it increases a counter and tracks the referrers as an array. So there isn’t 1 record per 404 to associate the IP address to.

If you extended it, it would have to store an array with the IP addresses too. However , this array would get quite large over time.

I’m open to ideas on this. There are some security tools from this author: Wobqqq - October CMS

I wonder if they might have some features that tackle this, or if they are open to hearing about it

#3

Hey @daftspunk

It sounds like extending the request logs is possible without being broken by updates?

I understand the bit about checking broken links however servers get pounded by bots sending random URI requests (I know this has been a thing since the beginning of time!).

The request logs go in to the thousands before I clear on a regular basis. Not a big deal really.

I wonder if it would be possible to just take the last IP for a particular request in the array and store that?

I suppose it depends if the request URI can be used as a key?

I had a look at Wobqqq and there’s some great stuff there however it looks more useful if you don’t have server access.

#4

Yes, this is totally possible!

#5

Bots can be quite persistent, and simply blocking an IP address is often not an effective long-term solution, as they can use VPNs or other methods to change their IP addresses easily.

Have you considered moving your domain’s DNS zone to Cloudflare and enabling their proxied connection? Cloudflare also offers several options within its Web Application Firewall (WAF) to identify and block this type of unwanted traffic more effectively.

If you need any assistance setting this up or configuring the appropriate rules, I’d be happy to help.

@daftspunk I’m not sure whether it’s appropriate to mention Cloudflare here. If not, I’ll adjust my answer accordingly.

1 Like
#6

This is a good idea and common. There is a RainLab CloudFlare plugin for use with Rocket Loader:

#7

Hey @hello-vernok, @daftspunk

I’ve been looking at CloudFlare however I’m not sure the other guys here would be open to using a third party.

I might have a look at routes and try to trap bot attempts. Wish me luck gulp!

I have access to our server and can see IP addresses in logs but it’s a Tsunami!

1 Like
#8

Sounds less like bot traffic and more like you need a surfboard :smile:

If it really is a tsunami, I’d try to stop as much of it as possible at the server level before it reaches October/PHP. The logs should at least help you spot the biggest waves.

Good luck!

1 Like
#9

Hey @hello-vernok,

You’re right, We need a solid surfboard to ride the bot tsunami… I wish that was a thing :smile:

We’re doing stuff at the switch end to try to mitigate however the way things are at the moment it’s constent attrition.

The logs are helping to spot the biggest waves so that does help.

Thanks for the good luck wishes :+1:t4:

1 Like