Ignore Web Events

	Forums Register Login My Profile Inbox Address Book My Subscription My Forums Member List Search FAQ Ticket List Log Out

Ignore Web Events

Logged in as: Guest

Users viewing this topic: none

Printable Version

All Forums >> [Networking & Security] >> GFI EventsManager >> Ignore Web Events

Page: [1]

Message

<< Older Topic Newer Topic >>

Ignore Web Events - 21.Sep.2009 10:25:02 AM

richlich

Posts: 8
Score: 0
Joined: 1.Sep.2009
Status: offline

First of all, I'm an EventsManager newbie.

We have a lot of Internal Server Error events generated when various "standard" search engine bots hit our web servers. We can tell from the message both in EventsManager and from the W3SVC log which transactions to include because they will have the name of the URL/User Agent (e.g. msnbot/1.1+(+http://search.msn.com/msnbot.htm) ) in the message. What is the best way to craft a rule to ignore these (bypass, but not delete/archive)?

I've tried going through the manual to figure out how to identify these events and process them through the rule set; however, I'm not quite sure how to craft the screening to properly detect them.

Many thanks in advice for your help with this!

Post #: 1

RE: Ignore Web Events - 21.Sep.2009 10:43:00 AM

DrewE

Posts: 1246
Score: 0
Joined: 28.Apr.2008
From: Cary, NC
Status: offline

You can filter these if you:

Go to Configuration -> Event Processing Rules.
Change "Log Type" to W3C Logs.
Expand HTTP Protocol Logs, Under HTTP- Client Requests accepted click "Create new rule..."
Call this rule "MSNBOT"
Select which W3C Files this rule applies to (that is what file are you seeing the MSNBOT logs in)
For the Filter Restrictions add: CS(User-Agent) "Does not contain the text" : bot

This should filter all any type of search engine crawling your site, such as msnbot, googlebot, etc.
Click Next until you see the "The following actions will be taken" option - Once you see this, change this to "Ignore the event"

This will filter all NEW events, previous events already archived will not be removed from the database.

_____________________________

Drew Easley
GFI Software
Talk Tech To Me (GFI Blog) � Follow Us (Twitter) - Watch Us (YouTube) - Join us (Facebook)

(in reply to richlich)

Post #: 2

RE: Ignore Web Events - 21.Sep.2009 10:48:29 AM

richlich

Posts: 8
Score: 0
Joined: 1.Sep.2009
Status: offline

Drew,

Many thanks, especially for the quick reply!

(in reply to DrewE)

Post #: 3