-
Good evening, SERVICE 1
SERVICE 2
SERVICE 3
My actual filter.d is:
With this filter, it intercepts some proxies, but not others. GET - HOST - CLIENT - IP. Can you help me? |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 3 replies
-
It has nothing with proxies, but with response code - you trying to match 40x responses only, however "SERVICE 2" examples are 502 and "SERVICE 3" examples are 20x codes. Therefore they will never match (and should probably never did, at least 20x codes). By the way, your RE is a bit vulnerable... Here is an example of anchored RE without catch-alls (matching 40x and 50x codes): failregex = ^\s*(?:\[\] )?\S+ \S+ (?:[4-5]0\d) - \S+ \S+ \S+ "[^"]*" \[Client <ADDR>\] (?:\[\w+ [^\]]*\] )*\[Sent-to <F-CONTAINER>[^\]]*</F-CONTAINER>\] "<F-USERAGENT>[^"]*</F-USERAGENT>" Also you wouldn't really need - failregex = ^\s*(?:\[\] )?\S+ \S+ (?:[4-5]0\d) - \S+ \S+ \S+ "[^"]*" \[Client <ADDR>\] (?:\[\w+ [^\]]*\] )*\[Sent-to <F-CONTAINER>[^\]]*</F-CONTAINER>\] "<F-USERAGENT>[^"]*</F-USERAGENT>"
+ failregex = ^\s*(?:\[\] )?\S+ \S+ (?:(?P<nf>404)|[4-5]0(?!4)\d|504) - \S+ \S+ \S+ "(?(nf)/(?:[^/]*/)*[^\.]*(?!\.(?:png|txt|jpg|ico|js|css|ttf|woff|woff2)[^\."]*)|[^"]*)" \[Client <ADDR>\] (?:\[\w+ [^\]]*\] )*\[Sent-to <F-CONTAINER>[^\]]*</F-CONTAINER>\] "<F-USERAGENT>[^"]*</F-USERAGENT>" But better would be to "fix" 404-references on all pages. |
Beta Was this translation helpful? Give feedback.
It has nothing with proxies, but with response code - you trying to match 40x responses only, however "SERVICE 2" examples are 502 and "SERVICE 3" examples are 20x codes. Therefore they will never match (and should probably never did, at least 20x codes).
By the way, your RE is a bit vulnerable... Here is an example of anchored RE without catch-alls (matching 40x and 50x codes):
Also you wouldn't really need
ignoreregex
- you can rewrite thef…