Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

This morning I discovered that my web-server was the subject of a brute force style attack. I only discovered this when I randomly checked my /var/log/auth.log file and saw the incoming requests. Has anyone got any advice on which log files I should be reading on my Apache web-server? along with this is it worth emailing myself the logs to read at my leisure and if so what are the easiest methods for doing this?

share|improve this question

5 Answers 5

up vote 5 down vote accepted

Tools like OSSEC really help you to catch these kinds of things while they're happening, instead of discovering them the next day.

Beyond that, I continue to use logwatch just for the sake of an archived digest I can search through quickly via my mail client.

share|improve this answer

Just use logcheck or logwatch (I prefer logcheck, myself) to filter out all the stuff you don't want to see, and then the rest will be e-mailed to you. Massively useful, should be running on every server.

share|improve this answer

Logwatch will scan and mail out details of the logs. Very useful for archiving purposes should you even need to review older states. Larger production machines tend to need the output filtered somewhat.

Also, install denyhosts or similar to block the attempts.

share|improve this answer

Depending on how many boxes you want to monitor, you might want to look into a centralised log monitoring system. I personally use it even for small deployments simply because its much more convenient to have all my logs (not just apache) accessible and searchable centrally.

Tools like Splunk make that very easy and quite pleasant to use.

share|improve this answer

Check the bottom of /etc/aliases and add your email address at the bottom:

 Person who should get root's mail
   root:		you@email.com

Make sure sendmail or postfix is working so you actually get the email.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.