Cyberstudy
PDF p.368 In progress

Web Server Logs

Open PDF at p.368 7 flashcards

Summary

PDF p.368

Web server logs capture HTTP traffic that encounters errors or matches predefined rules, preserving indicators of replay, forgery, and injection attacks. These logs include status codes and HTTP header information, providing insights into client requests and server responses.

Detailed explanation

PDF p.368
  • Logging Configuration
    • Purpose: Logs HTTP traffic with errors or matching specific rules.
    • Indicators: Preserves evidence of replay, forgery, and injection attacks.
  • Status Codes
    • 400 Range: Client-based errors.
      • Example: 403 ("Forbidden") indicates unauthorized access attempts.
    • 500 Range: Server-based errors.
      • Example: 502 ("Bad Gateway") indicates issues between the target server and its upstream server.
  • HTTP Header Information
    • Requests and Responses: Logs can include detailed header information.
    • Details: Provides insights into the makeup of each request or response, such as cookie information.

Important terms

taken from the text above
400 Range
Client-based errors.
500 Range
Server-based errors.
Requests and Responses
Logs can include detailed header information.

What I should remember

Key Points PDF p.368
  • Logging Configuration
    • Purpose: Capture HTTP traffic with errors or specific rules.
    • Indicators: Evidence of attacks.
  • Status Codes
    • 400 Range: Client errors (e.g., 403 - Forbidden).
    • 500 Range: Server errors (e.g., 502 - Bad Gateway).
  • HTTP Header Information
    • Requests and Responses: Detailed logs.
    • Details: Insights into requests and responses.