Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Since some weeks i manage my first Webserver, a Seaside application behind an Apache proxy on Linode, and i installed logwatch to send me daily logs.

Where can i get information on when i have to act as a consequence of what i read in these logwatch reports?

For example i read that all kinds of people try to login on funny nonexisting accounts or all kinds of webcrawlers test for nonexisting cms login pages, some ip adresses get banned and unbanned by fail2ban...

I assume that's normal? Is it? But how do i know that i probably have to do something? What do i look for in the logs?

share|improve this question
add comment

3 Answers

  1. google
  2. Yep that's called internet background noise, hackers trying to get into your machine. It's pretty normal. Anyway what you can do is install a host based intrusion detection system like OSSEC. The benefit is that you this will block attacks so you can sleep better at night.
share|improve this answer
    
You mean google for each of the messages that appear in a logwatch mail? I do/did this of course. I hoped there would be something like "common things that appear on logwatch mails and how to act when you see them" as examples to see what it's like. I know that might not cover things that might happen - it's more to get a general idea. –  Helene Bilbo Oct 4 '12 at 9:38
add comment

You must learn your logs and know them by heart. Even if you don't understand the exact meaning of some particular message. But then, when you suddenly see something out of order you will know that you got some problems. This is obvious to you that if you hear that your HD started to make some strange sounds that you never used to hear then something wrong is going with it even if you do not know why it sounds at all, right? The same with logs.

The consequences of being hacked may be very painful. Just imagine that your VPS will be involved into a complex scheme of hacking a financial institution. You have rented this virtual entity and you have a full control. Thus you are fully responsible.

Life is life...

share|improve this answer
add comment

Immediate thought is to use a log analyzer, such as the free version Splunk. Manually reading logs is a good way to learn, but requires time & increases likelihood of human error by overlooking things. Log analyzers can be a crutch to help get one's knowledge increased.

It is limited with the free version, but can quickly show what is possible and if such features are things to pursue. To get logs into Splunk:

Another open source option would be syslong-NG:

share|improve this answer
    
Your answer lists alternative ways to process logs but completely fails to address what was asked. –  John Gardeniers Sep 24 '12 at 5:55
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.