Custom error codes and access logging

#1
I use mod_security to return a custom error code 6xx on some requests, so I can later work them with crowdsec actions.
However any request with non conventional error codes is not logged at all in the webserver access_log.
For example if I have a rule in mod_security that uses deny:403 I get it in the logs. If I change the return code to something like 6xx it doesn't.
Is this expected behaviour or a bug? Maybe a config flag somewhere that can be changed?
 
#3
Any status code smaller 100 and higher 599 is invalid. Using status codes outside this range causes error 500, so this is not a OLS bug or malfunction.

https://www.rfc-editor.org/rfc/rfc9110.html
I see, I read in RFC 2616 it says:
HTTP status codes are extensible. HTTP applications are not required
to understand the meaning of all registered status codes, though such
understanding is obviously desirable. However, applications MUST
understand the class of any status code, as indicated by the first
digit, and treat any unrecognized response as being equivalent to the
x00 status code of that class, with the exception that an
unrecognized response MUST NOT be cached.
I supposed it would work. Well I'll just use 418.
Anyway logging, even an unknown response, should always be done. In the logs there isn't even a 500 error in place of my 6xx (or a 600 like RFC says). Not being able to understand the response code doesn't mean it shouldn't be logged, just not honored.
 
#4
OLS is not Apache. If OLS doesn't use status code 500 if a status code outside the valid range is used this is just an undefined case in OLS. You can complain about this, but before you do, you should first familiarize yourself with RFC.

btw. Blocking requests by IP address is extremely ineffective. You might as well try tilting at windmills.
 
#5
OLS is not Apache. If OLS doesn't use status code 500 if a status code outside the valid range is used this is just an undefined case in OLS. You can complain about this, but before you do, you should first familiarize yourself with RFC.

btw. Blocking requests by IP address is extremely ineffective. You might as well try tilting at windmills.
I forgot to say I use LSE not OLS. I expect a correct logging nonetheless. No matter what response code is there. Logging should not have anything to do with following up a request or not. It's just that, logging.
About the blocking, this is just one of the solutions in place. These are block rules for specific requests we know are made by scrapers and\or malware and not yet in blocking lists (mod_sec known bad behaviours rules, crowdsec paid lists, etc). We just picked the 666 code for fun, but could just use any regular one like the 418 we ended up using (and was made for fun too, 418 = "I'm a teapot").
We focus on a specific CMS, for which we provide professional hosting, and we have our own set of custom rules created by experience.
Anyway I just wanted to know if it was normal to not have anything logged at all.

Anyway talking about RFC, it's clearly stated that:
Values outside the range 100..599 are invalid. Implementations often use three-digit integer values outside of that range (i.e., 600..999) for internal communication of non-HTTP status (e.g., library errors). A client that receives a response with an invalid status code SHOULD process the response as if it had a 5xx (Server Error) status code.
So it should at least respond and log a 500 error. LSWS replies my status code 666 actually. that's not the problem. The problem is that the relative logs don't happen. So this is clearly a bug or at least a not compliancy of RFC you quoted.
 
Last edited:
#7
Yeah I know. Anyway the RFC you quoted should be applied regardless of the version. So it applies to both. Even OLS replies correctly with my 666 code. it's just that the logging of such request is bugged and doesn't happen.
having a correct 666 reply and nothing logged it's clearly a bug. if ols\lsws replies to that request it SHOULD log it nonetheless. if you don't want to honor that request is ok, but then RFC says you should answer 500, not 666. and be logged nonetheless.
the problem is not the handling of the request, that again happens correctly with my error code 666, it's the not logging of anything.
 
#8
I appreciate your efforts to block scrapers and other unwanted requests. However, be aware that this isn't possible with conventional methods. The challenge lies in identifying these unwanted requests, but you only have known HTTP parameters at your disposal, which are very easy to mask. So you're fighting an enemy you don't know! So rethink the way you want to block!

FYI: Logging doesn't help!
 
#9
I appreciate your efforts to block scrapers and other unwanted requests. However, be aware that this isn't possible with conventional methods. The challenge lies in identifying these unwanted requests, but you only have known HTTP parameters at your disposal, which are very easy to mask. So you're fighting an enemy you don't know! So rethink the way you want to block!

FYI: Logging doesn't help!
You clearly didn't understand anything of what I'm doing. I said I already know how to recognize the ones I need to, because we are expert sysadmins who works vertically on this CMS by years. I don't need any help about it.

My only need is that ANY request, bots or not, HAS TO be logged, REGARDLESS of what return code I may set on them. Logging has nothing to do with process the request, you can always discard it, but you MUST log what you do either way. This is BY RFC as I quoted from YOUR RFC link. And both OLS and LSWS don't respect this rule. End of story.
 
#11
That's a given, but don't try to apply your "personal logic" to how something should work.
No, it's not my personal logic. It's RFC. Quoted from RFC:
A client that receives a response with an invalid status code SHOULD process the response as if it had a 5xx (Server Error) status code.
"SHOULD process the response as if it had a 5xx" means it HAS to be logged as one too. Process includes logging, if a normal 5xx request is logged by the webserver. Since LS logs them, it should logs invalid statuses too.
 
Top