@yarikoptic, I really saw these as authentication issues because the result in a 401 unauthorised response. I suspect like you I didn't totally look to see what causes each one.

I'm all for splits in filters where the cause is likely to be something that needs to be parameterised differently and provide benefits for users. I'm not keen on moving it somewhere else because we don't understand what the message means.

Now that I've looked, I can see the last error,"one-time-nonce mismatch" is to with client using a request counter and some attacker attempting to re-use this auth. Is this what you count as abuse? Or is this just a sneekier brute force attempt.

Second last error, "nonce expired", seems quite benign. While its an failure that seems to need to be generated to get the browser to authenticate again (there's no notification of their validity period in the protocol). A brute force attempt would trigger on the "hash is not" failures as it seems from the apache code that the nonce validity is checked last. As such this filter expressions can be removed with minimal impact.

"user attempted time travel" seems to indicate that the request occurred before the nonce was generated. I see this would occur if there is some predictability in the nonce value that an attacker is trying to exploit. So I'm ok in removing this one.

"received - length is not". As nonce length is a static for the server the length error is an attacker getting it wrong. Its never going to succeed but I'm not sure it counts as abuse. While it could be split off into a different category I don't see an overwhelming benefit. I'd consider dropping it if you don't thinks its worth while.

As for "invalid nonce .* received - hash is not..." this seems to be the basic denial of the digest auth being the equivalent of "wrong password". It doesn't report as this because the username, relm and password are hashed together by the digest algorithm. I'm hoping, because you have them in your logs, you can see the cause of them a little more to see whether they are accidental password entry or a very expired nonce. I don't want to be too quick to right this off as benign.