World: r3wp

(self modifying parse rules which adapt while parsing the file... 
a lot of fun :-)

the kind of stuff I'will never understand.. 8P

hehe... its taken me years of practice to get at this point.  I'm 
not a "natural" parse guy.

I wonder if this scenario makes sense.

Instead of having a complicated cheyenne/rugby hybrid ... we just 
use the rsp engine.   When the first client starts up, it uploads 
all the necessary sources for the functions it needs.  cheyenne then 
makes all these functions available to its worker processes ( perhaps 
storing the sources in its virtual disk cache ...

Subsquent clients can then use these functions via rsp ..

that lead to a enormous security problem no ?

Not if you secure the client.

Getting an error trying to get php running with cheyenne.


Works fine on xp pro but on mt win server 2003 box I get a dialog 
saying "apppication is configed incorrectly. Reinstall may fix..."

(I get this when I try to run php from the php icon. In xp pro I 
would get the dos box indicating that is was running) 


I know its nothing to do with cheyenne but has anyone seen this...
php is not installed

and if you run php from the command line?

same dialog error

I tried a differnent version...teh "thread safe" The previos was 
"Non thread safe". Neither worked...

Some security thing going on?

Got it...I guess 5.3 does not run on win server 2003...Had to use 
5.2.11

Thanks Graham..

Has anyone made any tool yet that would process cheyennes logs and 
create some usage statistics? even if very simple ones (I removed 
statcounter because I have full https now, but now after I released 
it I would want to see more detailed and realtime stats (basically 
to just see who came in and visited what pages) than google analytics

hm.. maybe I will need to solve that on nginx level because cheyenne 
will show me localhost as IP for each request

Right, in your case nginx logs are more appropriate if you need IP 
stats. Cheyenne logs are in Common Log Format, so you can use any 
tool that works with Apache's logs.

I am making tool to parse them .. I need just some realtime overview 
, nothing fancy ...

would it be possible to log POST data (truncated if too long) on 
cheyenne maybe .. I would like to make a parser that would warn me 
of common hacking attempts by looking at log

like xss, sql, command line ..

( I need this for cebelca.bit where security is extra important )

It's possible, but you need to add code for that in mod-static/logging 
handler. Also note that writting data on disk is a performance killer, 
so you need to implement some form of memory buffering to keep good 
server performances.

If security is a big concern, I would rather use a C-based filter 
proxy or an IDS tool like Snort (requires careful configuration to 
avoid too much false alarms).

I know for snort but I don't know exactly what it does, I imagined 
it's detects intrusion on many ports (or is it http specific??) so 
it seemed like an owerkill and too complex for what I need ... the 
only port open is 433 , and which only 80 redirects to 433 . Everything 
else is closed by iptables, (on both, 80 and 443 is nginx and behind 
it cehyenne)

(I am using AIDE for detecting file changes btw)

It's more that I want to observer the http traffic for things I set-up 
.. but a lot of data is in the POST-s ... could I use your regular 
logging and just add the post string ... if it would be longer than 
X chars I would truncate it.

but I don't want to nag you too much , because again I am not sure 
if I shouldn't try to do this on nginx side for this specific website

ha basically format is the same between nginx and cheyenne so the 
same parser parses cheyenne too (only cheyenne doesn't have referrer)

this is good then I can really make it a little more usefull and 
use it on all my projects .. if you need something like it tell me, 
(it's still very simple)

It produces this for now (but I will turn it to JSON and then I can 
render it with javascript/html in many ways) days / ip / requests

DAY: 19-Oct-2009
 ....
 VISITOR: 90.157.177.123
   20:22:37 ; GET ; /manage/invoices-sent.rsp ; -
   20:22:37 ; GET ; /manage/sign-in.rsp ; -

   20:22:39 ; POST ; /manage/sign-in.rsp ; https://www.cebelca.biz/manage/sign-in.rsp

   20:22:39 ; GET ; /manage/invoices-sent.rsp ; https://www.cebelca.biz/manage/sign-in.rsp
 VISITOR: 64.233.172.17
   22:11:19 ; GET ; / ; -
 VISITOR: 216.239.50.136
   22:11:21 ; GET ; / ; -
 VISITOR: 74.6.22.173
   23:21:23 ; GET ; /contact.rsp ; -
   23:21:25 ; GET ; /contact.rsp ; -
DAY: 20-Oct-2009
 VISITOR: 93.186.20.135
   00:20:52 ; GET ; / ; -
   00:20:54 ; GET ; / ; -
   ....

Btw, you can also set an iptable rule to log those POST requests.

I didn't know that, but I was thinking if I could set loging at firewall 
level, thanks!

is there any way I could get pretty url-s with cheyenne?

like with rewrite module in apache .. I would need to map www.url.com/country/city/place 
to get params for example, or somehow get that directly so that some 
rsp would be called for all such folders and I could parse the url 
to get the data

if this is not possible (or complicated) I will place nginx infront 
of cheyenne

Try with ALIAS keyword. See ChangeLog file for more info (search 
for ALIAS).

thanks

alias "/path/to/target" %script  -- I found this  .. can I use regex 
or something else to do 

AliasMatch ^/some-(.*) /script.rsp?a=$1

No, only basic mapping is possible currently.

Btw, alias "/path" %script, should work for whole /path/*.

hm... then I would just need to parse url in the script instead of 
using request/content

much less mess than using another server infront and whole that mess

I will try it this way

could I do something like alias all except some pattern: for example 
all except /static/

will the script that get's called see the original url in request/parsed 
or will that be changed too? (I couldn't make it work yet otherwise)

alias "/show/" %www/mobispots.net/show.rsp -- gives me normal 404 
of cheyenne  (or any nonexistent file) 
<html><body><h1>404 Page not found</h1></body></html>

alias "/show/" %show.rsp -- gives me 
#[object! [
    code: 502
    type: access
    id: cannot-open

    arg1: %/D/devel/cheyenne0919/www/mobispots.net/www/mobispots.net/
    arg2: #[none]
    arg3: #[none]
    near: [change-dir first splitted: split-path file]
    where: #[none]
]]

There no exceptions support in Alias. The rewrited url should be 
available in request/headers/location.

I suspect %show.rsp is the correct one (which gives that error) , 
because for any nonexistent file likse %show.rspaaa I get 404 so 
I suspect %www/mobispots.net/show.rsp is also not correct to use

do you have any idea why this error? %/D/devel/cheyenne0919/www/mobispots.net/www/mobispots.net/ 
doesn't exist, webapp is in %/D/devel/cheyenne0919/www/mobispots.net/