I have a couple of questions from one of the IT people dealing with CR
incidents on and around ASU.  I now have a little script that send them
CR attempts grepped from my access and error logs on a daily basis.

One of the people there was asing for more info to make sure they are
intrepreting them correctly.  I am writing something rather simple up. 
If anyone knows of more detailed HOW-TO interpretation of CR access
logs, etc. please let me know...

Now for my question:

  is the "XXXXX....." in the access log an indication of a CR 1 or 2
infection?  The other IIRC has a "NNNNN...." in it.

  EBo --