Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have some linux server with iptables and I'm looking for an offline tool that allow log analysis to detect suspicious activity .

I dont think that installing a web tool is a good choice beacause it's another possible hole in the system so I'm looking for an offline one that generate human-readable summary.


share|improve this question

closed as not constructive by mgorven, Ward, MikeyB, voretaq7 Aug 2 '12 at 21:18

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

This is really a shopping question, but might be salvageable. The bigger problem is you haven't really defined your requirements well enough for us to give you an answer -- Immediate questions that spring to mind: Are you looking for a command-line tool (what it sounds like)? What kind of "suspicious activity" do you want to look for? What kinds of logs do you want to crunch? -- If you can clarify your question I'll reopen it and see if we can get you some answers... – voretaq7 Aug 2 '12 at 21:18