[ClassifierSettings]
Available since Exponential 6.0.15 (in development, not in a release yet).
Summary
The group [ClassifierSettings] of settings/requestclassifier.ini.
File
settings/requestclassifier.ini; override it in settings/override/requestclassifier.ini.append.php, in a siteaccess or in an extension.
Settings
| Setting | Default | Description |
|---|---|---|
| Classification | enabled | enabled | disabled. With disabled no request is classified: probes are logged as the not-found answers they are (404.log) and security.log stays empty. |
| LogFile | security.log | The file the lines are written to, in the log directory of the installation (var/log, or var/<site>/log with site.ini [FileSettings] UseGlobalLogDir=disabled). It is rotated like the other logs (site.ini [FileSettings] LogMaxSize, LogMaxCount). |
| RuleSets[] | probes; traversal; injection; scanner; threshold | The rule sets, in the order they are tried; the first one that has a verdict wins, so a request is in one line with one rule. Each entry is an identifier; its class and its settings are in the group [RuleSet-<identifier>] below. Built in: probes category probe: things an Exponential site does not have and scanners look for traversal category traversal: ../ and its encodings, null bytes injection category injection: SQL, command, template and script injection in the URL scanner category scanner: the user agents of known attack tools threshold category threshold: more than [ThresholdSettings] Max404PerMinute not-found answers a minute An extension adds its own set with RuleSets[]=<identifier> and a group [RuleSet-<identifier>] with Class=<its class>, a class that implements expRequestRuleSetInterface (or extends expRequestPatternRuleSet) and is in the extension's autoload. A class that does not exist or does not implement the interface is skipped with a warning in the debug output. Leave a built-in set out of the list to switch it off. |
| Listeners[] | (empty array) | Classes told about every verdict after its line is written: classes that implement expRequestVerdictListenerInterface (onVerdict( $verdict, $context )), for example to feed a ban list or a notification. None by default. A listener runs at the end of the request; one that fails is skipped. |
| CompileCache | enabled | enabled | disabled. With enabled the compiled patterns are kept in a PHP file in the cache directory (and in APCu where it is available), so a worker that starts fresh (Velocity resets its state between requests) does not compile them again. With disabled they are compiled once per request. |
See also
Generated example: requestclassifier.ini [ClassifierSettings]
Added to the reference for Exponential 6.0.15: the 4.x reference had no page for this group. The descriptions are the comment lines of settings/requestclassifier.ini.
Contributors
- Graham Brookins Updated
Comments
Add a comment