Hot answers tagged analysis
What exactly do you need? wireshark - network sniffer/analyzer iftop - bandwidth usage darkstat - traffic analyzer nmap - network port scanner nessus - vulnerability scanner metasploit - penetration testing
In depsite of people got used to netstat for such kind of operations, it's good to know, that Linux has another great (and, actually superior) networking tool — ss. For e. g., to find out which process has opened port 80 you run it so: sudo ss -pt state listening 'sport = :80' so there's no need to pipe through external filters. Surely it has lots more ...
When the computer bluescreens it'll most likely create a dump of the memory. The content from memory is written to the Pagefile as the system is going down. It uses the Pagefile as placeholder for the data since it is too dangerous to try to create a new file on disk. When the machine starts up again it'll detect the dump, and move the data into a separate ...
In terms of analysis, there's nothing wrong with Wireshark. In fact, many enterprise products make use of Wireshark's code. I think where things change are how captures are done in larger environments. Whereas in smaller shops, if you need to run packet captures, a laptop running Wireshark is fine. However, once you get to larger environments with higher ...
In the log files analyzer domain, these are the most widely used: AWStats Webalizer Analog W3Perl Analog and Webalizer are written in C and are the faster (10000-20000 lines per second). As mentioned earlier by @MadHatter Analog has been developed by an ex-Cambridge statistician, that makes Analog a really precise and technical tool, but since the ...
I've been fairly happy with AWStats They've got a demo page set up here for a quick example.
Mark Russinovich (of SysInternals fame) has an excellent blog entry where he describes how one can use the debugging tools to track down the module name and even the stack frame (i.e. function call) during which the blue screen occurred. It's illustrated, well written, and has helped me get my feet under me when I started learning how to debug Blue Screen ...
How about this? grep 'on line' /var/log/httpd/error_log | cut -d' ' -f6- | sort | uniq -c | sort -nr I.e. Get the right lines from the logfile Chop the date off the front Sort them Aggregate and count the duplicates Sort by number of duplicates
I'm not sure but the following changes in operating_systems.pm seem to work for us. Only the iPod didn't work in the OS section, it should be incl. under iPhone ...(not sure) in @OSSearchIDOrder add '[_+ ]cpu[_+ ]os', #iPad 'iphone[_+ ]os', before 'mac[_+ ]os[_+ ]x', in %OSHashID add '[_+ ]cpu[_+ ]os','maciosipad', 'iphone[_+ ]os','maciosiphone', ...
cat file_with_ips | sort -nr | uniq -c | sort -nr -k 1 will sort desc by ip counts, showing the counters on first column e.g. root@pinkpony:~# cat /tmp/xx 18.104.22.168 22.214.171.124 126.96.36.199 188.8.131.52 184.108.40.206 220.127.116.11 root@pinkpony:~# cat /tmp/xx | sort -nr | uniq -c | sort -nr -k1 3 18.104.22.168 2 22.214.171.124 1 ...
I am very satisfied with piwik. I just miss the possibility to adjust the widgets dependent on the website. I use it to check my drupal sites and there is a module for drupal too.
Sure. It looks like it's a log from the European Conferences on Machine Learning and European Conferences on Principles and Practice of Knowledge Discovery in Databases Discovery Challenge 2005 competition. They've got a page describing the data format and a FAQ about the data on the site. (I could tell those were some old unix timestamps just by eyeballing ...
Can't believe nobody mentioned tcpdump. Click on the link to see the list of features
The error code in the top left. By googling that, you can often narrow it down to whether it's a hardware or software issue. Proceed from there (the Google results).
For completenesss, I'll also throw in a suggestion of Webalizer, although it's been a while since I used it last. (My more recent experience has been with the already-mentioned AWStats.
ntop is a solution that has been around for a while, can be extended with plugins. Here is a short how-to.
Doesn't look like there's any analytics code on there, so that's most likely the problem. :-) Copy and paste your code from the analytics site to your website and paste it down near the BOTTOM of the page before the ending </body> tag. Also, I don't think you're going to see any reporting right away. I think it takes 12-24 hours before you start ...
For basic crash dump analysis no particular skills are needed. If you can follow the instructions and open a dump with crash then you can do some basic diagnostics without any in depth knowledge of the kernel. However, for anything beyond the basics you're going to need to know how to debug code using gdb, develop a good knowledge of kernel structure and ...
To expand on Niall's answer, you might try tshark -r <capture file> -q -z conv,ip The -q disables normal output and -z conv,ip dumps the IP conversation data. More information can be found in the man page and in Sake Blok's Sharkfest presentation.
Address already in use means that another process is already listening on port 80. Only one process can listen on a given port at a time. To find the process, run as root: netstat -tnlp | grep -w 80 The offending process will be listed.
Have you tried Wireshark's own "statistics" tools. You have some pretty nice tools to do endpoint conversation analysis (somehow similar to netflow), IO graphs, per protocol statistics, protocols hierarchies, flow graphs, packet length distributions plus several others. Also, many of these tools accepts Wireshark's filter syntaxis so the drill down you can ...
Another option with fewer keystrokes is lsof: lsof -i :80
Find which partition the sector is in by running fdisk -lu /dev/sdb. Suppose it is "sdb2" which starts at sector 45612307. Subtract that from 95891008 to get 50278701. Next determine how many sectors per block: tune2fs -l /dev/sdb2 | grep Block. Suppose it is 4096. Calculate the block / sector ratio: 512 bytes/sector / 4096 bytes/block = 0.125 ...
Give this a shot: http://munin-monitoring.org/
I appreciate that it doesn't always suit to have mod_status available and on all of the time, but it and apachetop are the best ways to diagnose these problems. However there are many ways to skin a cat. This trick is useful in a number of circumstances and isn't just Apache specific. It does depend on a number of factors however, and you need to know what ...
You haven't found any metrics because they don't exist. There is no such thing as a "typical" LAMP setup, given the variances in database schema, data quantity, code quality, and a million other things. That being said, unless your 5000 UV/day are each doing a lot of page views, a shared hosting plan should do the trick nicely. I wouldn't necessarily be ...
Source ports and destination ports are normally going to be different. This is normal. When you connect to web site as a client to destination port 80, the OS will likely give the packet a high number source port that is maybe random. Go read about Ephemeral Ports. This aids in the OS keeping track of which session is which.
You might check out crm114. It's commonly used for spam, but can be directed at other stuff as well, like information firewalling. It's installable in Debian: Description: versatile classifier for e-mail and other data CRM114, the Controllable Regex Mutilator, is a system to examine incoming e-mail, system log streams, data files, or other data streams, ...
Wireshark (formerly ethereal) is my favorite.
Only top voted, non community-wiki answers of a minimum length are eligible