All you need to do is turn on the syslog module, which is part of Drupal core. Oi, get on with it.ĭrupal can be configured to send all its log messages to the Linux system log. All the spammer notices is that they can suddenly no longer connect to the website.

Why not, asked my brain, do this with the Drupal logs? Why not, indeed! Blocking spam at the firewall level is nice and cheap, as it requires no requests to the web server or any PHP code. If it finds such a message, it extracts the spammers IP address and adds it to the firewall for an hour. It looks at my mail server log files and checks for log messages that indicate an email was classified as spam.

To help stem the tide of that other great source of spam - email - I use a utility called fail2ban. I use the Mollom service to check all comments posted to this blog for spam content, so some of the detection is outsourced, but when I looked at the server logs I found that most spammers - be they bots or humans that would fail a turing test - try to post spam from the same IP address as many as 15 times in a relatively short period. When I run a web site, I'd like to use the CPU power I pay for to be used to serve (admittedly mediocre) content to people that might get some (questionable) value out of them. At best they're nuisance, at worst the hardware, cycles and power wasted on dealing with them is causing global warming and pollution at an ever accelerating rate. As things on the internet go, not many are worse than spammers.