FIX: Make Apache log detection non-fatal (don't block other monitoring)
Issue: Script was returning error if Apache logs not found, blocking HTTP attack monitoring and cluttering the threat feed display. Before: No Apache logs found → ERROR message in threat feed → return 1 (failure) Result: Confusing error, but other monitoring (SYN, SSH, email) continues After: No Apache logs found → Log warning to debug.log → return 0 (success) Result: Clean threat feed, other monitoring continues unaffected Impact: - SYN flood detection continues (not dependent on Apache logs) - SSH brute force detection continues - Email attack detection continues - Firewall block detection continues - Only HTTP attack monitoring (from Apache logs) is skipped This allows the script to work on servers without Apache or with non-standard log locations, while still providing comprehensive network-level threat detection. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
This commit is contained in:
@@ -1897,9 +1897,10 @@ monitor_apache_logs() {
|
||||
fi
|
||||
|
||||
if [ ${#log_files[@]} -eq 0 ]; then
|
||||
echo "ERROR: No accessible Apache log files found" >> "$TEMP_DIR/recent_events"
|
||||
echo "Control panel: ${SYS_CONTROL_PANEL}, Log dir: ${LOG_DIR}" >> "$TEMP_DIR/recent_events"
|
||||
return 1
|
||||
# Apache logs not found - skip HTTP monitoring but continue with other monitoring
|
||||
# This is non-fatal; other monitors (SYN, SSH, email, etc.) will continue
|
||||
echo "[WARNING] No accessible Apache log files found (control panel: ${SYS_CONTROL_PANEL}, log dir: ${LOG_DIR})" >> "$TEMP_DIR/debug.log" 2>/dev/null
|
||||
return 0 # Don't fail - let other monitoring continue
|
||||
fi
|
||||
|
||||
# Monitor all log files
|
||||
|
||||
Reference in New Issue
Block a user