Scalp processes zero lines

GoogleCodeExporter commented 9 years ago

What steps will reproduce the problem?
1../scalp.py -e -l ./access_log -f ./default_filter.xml -o ./scalp-output --html

What is the expected output? What do you see instead?
AFAIK, expected output would be that the script processed n number of lines

What is see instead is
Processing the file 'access_log'...
Scalp results:
    Processed 0 lines over 0
    Found 0 attack patterns in 0.524253 s

What version of the product are you using? On what operating system?
Version Used: scalp-0.4
OS: RHEL 5.7

Please provide any additional information below.
If I grep for directory traversing, the log file shows the grep parameters. But 
the same is not reflected in scalp through the directory traversing patterns 
are listed in the default_filter.xml file

--Syd

Original issue reported on code.google.com by iconix2...@gmail.com on 26 Aug 2011 at 6:08

GoogleCodeExporter commented 9 years ago

I've the same issue on some of our servers and I think is due to the LogFormat 
we use (not standard one).

One solution could be to create an additional log file, for example this format 
should work:

LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" 
combined

Original comment by anten...@gmail.com on 11 Sep 2012 at 3:34

GoogleCodeExporter commented 9 years ago

hi ive tested with the look like string with the same results Processed 0

./scalp-0.4.py -e -l ncsaformat -f ./default_filter.xml -o ./scalp-output --html

Combined Log Format
Another commonly used format string is called the Combined Log Format. It can 
be used as follows.

LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" 
combined
CustomLog log/access_log combined
This format is exactly the same as the Common Log Format, with the addition of 
two more fields. Each of the additional fields uses the percent-directive 
%{header}i, where header can be any HTTP request header. The access log under 
this format will look like:

127.0.0.1 - frank [10/Oct/2000:13:55:36 -0700] "GET /apache_pb.gif HTTP/1.0" 
200 2326 "http://www.example.com/start.html" "Mozilla/4.08 [en] (Win98; I ;Nav)"

taken from 
http://httpd.apache.org/docs/2.2/logs.html

any ideas?

Original comment by ricse...@gmail.com on 9 Apr 2013 at 5:52

GoogleCodeExporter commented 9 years ago

nvm got it working missing  sys.exit(0) line

Original comment by ricse...@gmail.com on 9 Apr 2013 at 8:05

wreiske / apache-scalp

Scalp processes zero lines #9