Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to automatically monitor my apache logs and recognize if someone is doing a vulnerability scan on my web server.

The point of this will be to then route the source IP to a honeypot server instead where I will log all packets coming in.

I have looked around, but haven't been able to find a good answer.

Thanks in advance.

share|improve this question

migrated from Feb 14 '11 at 21:27

This question came from our site for professional and enthusiast programmers.

up vote 0 down vote accepted

I think the best solution is a Web Application Firewall like Mod_Security. This can be setup to log vulnerability scans, but its better to block them.

share|improve this answer
Mod_Security looks like it will work for what we are wanting. – Scone Feb 14 '11 at 21:23

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.