package My::parser::apache_parser; use strict; use warnings; sub new { my $class = shift; my $self = {}; bless ($self, $class); return $self; } sub parser { my $self = shift; my $string = shift; my ($reply,$hostile,$host) = ("No match for $string",0,''); my $re_host = qr/[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/; if($string =~ m/proxy_fcgi:error.*Got error 'Primary script unknown'/) { $_ = $string; $reply = 'Request for unknown fcgi-script'; $hostile = 1; PARSE: m/(\[client\ ($re_host)\:0\])/gcix && do { $host = $2; }; } elsif($string =~ m/script not found or unable to stat/) { $_ = $string; $reply = 'Script not found'; $hostile = 1; PARSE: m/(\[client\ ($re_host)\:0\])/gcix && do { $host = $2; }; } elsif($string =~ m/ap_pass_brigade failed in handle_request_ipc function/) { $_ = $string; $hostile = 1; $reply = 'Connection closed early'; PARSE: m/(\[client\ ($re_host)\:0\])/gcix && do { $host = $2; }; } elsif($string =~ m/Invalid URI in request/) { $_ = $string; $hostile = 1; $reply = 'Invalid URI'; PARSE: m/(\[client\ ($re_host)\:0\])/gcix && do { $host = $2; }; } elsif($string =~ m/invalid URI path /) { $_ = $string; $hostile = 1; $reply = 'Invalid URI'; PARSE: m/(\[client\ ($re_host)\:0\])/gcix && do { $host = $2; }; } elsif($string =~ m/\(63\)File name too long: /) { $_ = $string; $hostile = 1; $reply = 'File name too long'; PARSE: m/(\[client\ ($re_host)\:0\])/gcix && do { $host = $2; }; } elsif($string =~ m/ AH00135: Invalid method in request /) { $_ = $string; $hostile = 1; $reply = 'Invalid request method'; PARSE: m/(\[client\ ($re_host)\:0\])/gcix && do { $host = $2; }; } elsif($string =~ m/ client denied by server configuration/) { $_ = $string; $hostile = 1; $reply = 'Denied by server config'; PARSE: m/(\[client\ ($re_host)\:0\])/gcix && do { $host = $2; }; } elsif($string =~ m/mod_fcgid: cleanup zombie process/) { $reply = 'fcgi process killed'; } elsif($string =~ m/scoreboard already in used/) { $reply = 'Scoreboard already in use'; } return { retval => 1, retmsg => $reply, hostile => $hostile, host => $host, string => $string }; } return 1;