il s'agit juste d'un filtre a appliquer sur la gestion des logs :  
un extrait de ma config .
 
 
#
# The following directives define some format nicknames for use with
# a CustomLog directive (see below).
#
 
 
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%h %l %u %t \"%r\" %>s %b" common
LogFormat "%h %l %u %t %{User-Agent}i # %{Referer}i -> %U" referer
LogFormat "%{User-agent}i" agent
 
#
# The location and format of the access logfile (Common Logfile Format).
# If you do not define any access logfiles within a <VirtualHost>
# container, they will be logged here.  Contrariwise, if you *do*
# define per-<VirtualHost> access logfiles, transactions will be
# logged therein and *not* in this file.
#

SetEnvIf Request_URI "\.ida" ze_filtre
CustomLog /dev/null common env=ze_filtre
CustomLog /web/apache/logs/access_log common env=!ze_filtre
 
 
faudra peut etre adapter la regexp ( \.ida) en fonction de la situation .

[will@bastard will]$ grep default.ida /var/log/httpd/access_log | wc -l
    846
[will@bastard will]$ uptime  
  8:04pm  up 3 days,  2:17,  7 users,  load average: 0.87, 0.66, 0.43
 

vive le cable wanadoo. 846 attaques. Faut que je mette un firewall