Access forbidden by rule - Nginx Logging

Question

We are keep getting spammed and receive these error messages:

[error] 1414#1414: *1327 access forbidden by rule, client: 2a23:4722:3:1::2e, server: ourname.com, request: "POST /xmlrpc.php HTTP/1.1", host: "www.ourname.com"

These shouldn't be logged as we have defined:

location = /xmlrpc.php {deny all;access_log off;log_not_found off;}

Why are these messages still logged?

You could try return 403; instead of the deny all;, which gives the response, but may eliminate the error message. — Richard Smith
– Richard Smith, Commented Dec 8, 2020 at 16:00
I have a similar problem. Is it possible to just add "error_log off;" to the location rule? Should I just be using a tool to filter out these errors and not be concerned about them in the log? I don't really see the point in them being there, if they're nothing to worry about. — Kirk Johnston
– Kirk Johnston, Commented Feb 19, 2021 at 3:44

YuriB. · Accepted Answer · 2020-12-08 17:23:43Z

2

All directives such "access_log" and "log_not_found" refer to access_log. But your log is error_log. I think better use something like that

location = /xmlrpc.php {
  return 403;
  access_log off;
}

bots will receive "Forbidden" or

location = /xmlrpc.php {
  return 404; 
  access_log off;
}

bots will receive "Not Found"

or maybe return 444 (hard way)

answered Dec 8, 2020 at 17:23

YuriB.

462 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Access forbidden by rule - Nginx Logging

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related