requestclassifier.ini [ClassifierSettings] #

The block [ClassifierSettings] of settings/requestclassifier.ini, with 5 setting(s).

Never edit settings/requestclassifier.ini itself: an update replaces it. Put the settings you change in an override, which wins over the shipped file:

• settings/override/requestclassifier.ini.append.php for every siteaccess,
• settings/siteaccess/<siteaccess>/requestclassifier.ini.append.php for one siteaccess,
• extension/<extension>/settings/requestclassifier.ini.append.php in an extension (read when the extension is active).

Classification #

enabled | disabled. With disabled no request is classified: probes are logged as the not-found answers they
are (404.log) and security.log stays empty.

Default: enabled.

<?php /* #?ini charset="utf-8"?
# settings/override/requestclassifier.ini.append.php
[ClassifierSettings]
Classification=enabled
*/ ?>

LogFile #

The file the lines are written to, in the log directory of the installation (var/log, or var/<site>/log with
site.ini [FileSettings] UseGlobalLogDir=disabled). It is rotated like the other logs (site.ini [FileSettings]
LogMaxSize, LogMaxCount).

Default: security.log.

<?php /* #?ini charset="utf-8"?
# settings/override/requestclassifier.ini.append.php
[ClassifierSettings]
LogFile=security.log
*/ ?>

RuleSets #

The rule sets, in the order they are tried; the first one that has a verdict wins, so a request is in one line
with one rule. Each entry is an identifier; its class and its settings are in the group [RuleSet-<identifier>]
below. Built in:
probes category probe: things an Exponential site does not have and scanners look for
traversal category traversal: ../ and its encodings, null bytes
injection category injection: SQL, command, template and script injection in the URL
scanner category scanner: the user agents of known attack tools
threshold category threshold: more than [ThresholdSettings] Max404PerMinute not-found answers a minute
An extension adds its own set with RuleSets[]=<identifier> and a group [RuleSet-<identifier>] with
Class=<its class>, a class that implements expRequestRuleSetInterface (or extends expRequestPatternRuleSet) and
is in the extension's autoload. A class that does not exist or does not implement the interface is skipped with
a warning in the debug output. Leave a built-in set out of the list to switch it off.

Default: a list of 5: probes, traversal, injection, scanner, threshold.

<?php /* #?ini charset="utf-8"?
# settings/override/requestclassifier.ini.append.php
[ClassifierSettings]
# an empty "RuleSets[]" first replaces the shipped list; without it the items are added
RuleSets[]
RuleSets[]=probes
RuleSets[]=traversal
RuleSets[]=injection
RuleSets[]=scanner
RuleSets[]=threshold
*/ ?>

Listeners #

Classes told about every verdict after its line is written: classes that implement
expRequestVerdictListenerInterface (onVerdict( $verdict, $context )), for example to feed a ban list or a
notification. None by default. A listener runs at the end of the request; one that fails is skipped.

Default: an empty list.

<?php /* #?ini charset="utf-8"?
# settings/override/requestclassifier.ini.append.php
[ClassifierSettings]
# an empty "Listeners[]" first replaces the shipped list; without it the items are added
Listeners[]
*/ ?>

CompileCache #

enabled | disabled. With enabled the compiled patterns are kept in a PHP file in the cache directory (and in
APCu where it is available), so a worker that starts fresh (Velocity resets its state between requests) does not
compile them again. With disabled they are compiled once per request.

Default: enabled.

<?php /* #?ini charset="utf-8"?
# settings/override/requestclassifier.ini.append.php
[ClassifierSettings]
CompileCache=enabled
*/ ?>

Related #

• All blocks of requestclassifier.ini
• All INI files
• The settings page

Generated by ./console exp:help:examples from settings/requestclassifier.ini. Do not edit this page: change the source and generate again (how). Free documentation: GFDL 1.3 or later.