Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm just wondering is it there some module which can detect certain event in access/error log and if it matches it, to send an email with information.

example: I want to detect when someone makes requests like this : www.mysite.com/../../../etc/passwd or similar. I want to be informed via email when it happens.

Thanks in advance.

share|improve this question
1  
Take a look at ossec –  adaptr Jan 11 '13 at 9:36
    
That's a lot of email. –  Michael Hampton Jan 11 '13 at 17:27

3 Answers 3

It's not impossible, but I wouldn't recommend doing it with a module.

Instead, use something like apache-scalp to continuously parse the logfile and generate alarm mails.

(If you do want to do it with an apache module, you'd need to redirect those requests to an error page consisting of a script which will send the mail. Look for the Redirect and Location directives. But it'd be a big hassle to keep it up to date.)

share|improve this answer

Usually such things not needed. On one of my LAMP, I've configured fail2ban to detect a lot of 404\503\etc and ban httpd access from user ip for a 10 minutes. I've made this caused old hardware to prevent overloading server due a lot of simultaneous requests.

Next idea, you could write a parser for logs :)

share|improve this answer
    
fail2ban - Hmm interesting. I will check this if it is going to fit my needs . Thanks. –  Daniel Stoinov Jan 11 '13 at 12:07
    
+1 fail2ban -- you can use it to check for any regular expression in the logs, so you could block on HTTP status codes as mentioned, or on specific strings e.g. /etc/passwd/ or /../ –  xofer Jan 12 '13 at 22:14
    
But what if I don't want to automatically ban but only to mark them as potential security threat. –  Daniel Stoinov Feb 4 '13 at 9:36
    
I have an "experimental" rules :) 1. For create a log with "potential security threat" 2. For parse this log and ban a repeating threats –  dr-evil Feb 4 '13 at 12:43

Create a script called log_monitor.sh:

#!/usr/bin/perl -w

use strict;

my $cachefile="/var/cache/lastpos-apache2-scan4maxclntOrSigKill";
my $logfile="/var/log/httpd/error_log";
my $searchstr="sigkill|reached maxclients|apply process slot|read data timeout|Premature end of script headers";

my $lastpos=0;
if (-f $cachefile) {
    open FH,"<".$cachefile;
    $lastpos=<FH>;
    close FH;
};

my $newpos=(stat $logfile)[7];

open FH,"<".$logfile;
seek FH,$lastpos,0;
while (<FH>) {
    print if m/$searchstr/i;
};
close FH;

open FH,">".$cachefile;
print FH $newpos;
close FH;

modify $searchstr as needed.

configure the script to run every X minutes via cron. the greater the value of X, the less emails you will get (only 1 email every X minutes for all the errors that match the strings you supply). the results of the cron job will get emailed to you automatically (if cron is setup properly)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.