requestclassifier.ini

Available since Exponential 6.0.15 (in development, not in a release yet).

Summary

The request classifier: tells a probe (/wp-login.php, /.env, /backup.zip), a path traversal (../), an injection (union select, {{7*7}}, <script>), a known attack tool and a burst of not-found answers from an ordinary request, and writes one line for each such request to var/log/security.log instead ...

Description

The request classifier: tells a probe (/wp-login.php, /.env, /backup.zip), a path traversal (../), an injection (union select, {{7*7}}, <script>), a known attack tool and a burst of not-found answers from an ordinary request, and writes one line for each such request to var/log/security.log instead of 404.log, notice.log or error.log. Guide: doc/eng-us/features/6.0/request-logs.md

Do not edit this file: override it in settings/override/requestclassifier.ini.append.php, in a siteaccess's requestclassifier.ini.append.php or in an extension's settings.

Classification only. Nothing is blocked, slowed down or answered differently because of a verdict: the request gets the answer it would get anyway, and its log line goes to security.log. Blocking and rate limiting are left to listeners (Listeners[] below) and to the web server in front (request-shield under Velocity re

Groups

Location

settings/requestclassifier.ini; override it in settings/override/requestclassifier.ini.append.php, in a siteaccess or in an extension.

See also

Help: features/6.0/request-logs.md

Generated examples: the settings of requestclassifier.ini

Added to the reference for Exponential 6.0.15: the 4.x reference had no page for this file. The groups are listed from the file; their settings are described in its comments.