#!/bin/bash
# run this every 10 mins
# if someone knocks at the apache server for a non-existing url, 3 times - then block

ERRORFILE='/tmp/badurls_apache2.log'
rm -f ${ERRORFILE}
touch ${ERRORFILE}

awk -vDate=`date -d'now-10 minutes' +[%d/%b/%Y:%H:%M:%S` '$4 > Date {print Date, $0}' /var/log/apache2/access.log | while read -r LINE; do
    STATUZ=$( echo ${LINE} | awk -F' ' '{print $10;}')

    if [[ "${STATUZ}" == '"-"' ]] || [[ ${STATUZ} -gt 399 ]]; then
        echo ${LINE} >>${ERRORFILE}
        # echo ${LINE}
        IP=$(echo ${LINE} | grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b")
        addEvent.sh "BLOCK,${IP},10,30,Fishing for URL in apache2"
    fi
done

cat ${ERRORFILE} | wc -l
