A
A
Anton B2016-07-06 16:49:11
Nginx
Anton B, 2016-07-06 16:49:11

How to highlight bots in access.log and send them to fail2ban?

Hello!
There are robots that frankly parse the project, and there are conscientious users who generate a large number of requests. limit_req is not suitable, because more than one user can have one IP, and even one user at some single moments of time can be overactive. There are also addresses to which many requests are allowed.
Robots tend to iterate over IDs, such as /page/1, ..., /page/1000.
Also, a normal person will not request index.php 1000 times per minute.
Of course, robots can be detected manually, but I would like to automate this.
Share your experience. Thank you!

Answer the question

In order to leave comments, you need to log in

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question