Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need a log file of penetration attempts to my server. Ideally, this log should contain all attempts including logins, HTTPD activities, FTP activities, NFS, and other conventional open ports. However, it is enough for me to have HTTPD, FTP, and NFS.

Is there such service (or log files) available in CentOS (built-in preferred)?

share|improve this question
up vote 3 down vote accepted

There is no single log file that included that logs all these things. You will need to go through all your logs and extract single lines. You can ofcourse facilitate this with a regex.

One thing you might want to opt for is using OSSEC on your machine. It's a host based intrusion detection system and it actually keeps logs of all malicious login attempts on your server. Even better: it blocks ip's when they try to bruteforce your machine.

share|improve this answer
Thanks. I am hacking around OSSEC and it seems this is my solution. It gathers various log files (stated by @Toqeer) and integrates them. – ahmad Sep 22 '12 at 9:51
Have a look at lfd too, csf bundles it in and it works well for what you've described. – Ben Lessani - Sonassi Sep 22 '12 at 11:31

Following are the logs files.


/var/log/httpd/access.log - All the information about who access your site.

/var/log/httpd/error.log - All the error logs of your web-site are stored there.

It also depends on virtualhost configurations what file you defined for logs, default files are above.


All security related logs stored in


Syslog: System wide messages stored in


Maillog: Maillog stored in


VSFTPD: ftp log file depends on your configuration. see the xferlog_file=/var/log/xferlog if you are using vsftpd and also enable xferlog_enable=YES

Better to configure fail2ban for log file monitoring.

share|improve this answer

What you (probably) want is called a "host intrusion detection system". Search for that term (and linux) to see what is available.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.