Tag Info

Hot answers tagged

16

We use awstats. http://awstats.sourceforge.net/


15

Logs of interest: /var/log/apache2/* - apache2 logs :) /var/log/auth.log - authentication attempts /var/log/daemon.log - system processes log here /var/log/syslog - everything logs here I use the logwatch package for monitoring SMTP traffic and SSH logins, and authentication attempts. It is available from most Linux distributions, including Ubuntu by ...


12

You could use something like LogWatch. Or even a simple script like this (it's pseudo code you'll need to modify it for your enviroment): #!/bin/bash GREP_STRING=`grep -c <error string> <acpid log location>` if [ $GREP_STRING -ne 0 ] then <send email notification> fi Put that in cron to run every hour or so and you should get ...


9

Analog: http://www.analog.cx/ Also, check out this blog entry: http://weblogs.asp.net/steveschofield/archive/2007/09/04/log-analsyis-software-for-iis.aspx


9

The Microsoft IIS resource kit has a log parser that lets your run SQL like queries on IIS Logs. I also rate awstats if your dont know what your looking for & would just like some stock reports. I believe google analytics is probably the best value you'll get for free, you dont even need your log then :) What are you looking for by analyzing logs?


7

You can use OSSEC HIDS to set up rules on log files and, at the same time, get security information from your host. Setting it up is very easy: Download the source Uncompress it and run ./install.sh Choose local install Answer the questions (email, checks, etc.) Edit /var/ossec/rules/local_rules.xml as specified below Start OSSEC with ...


5

There are a number of logfile analyzer packages that exist - two of which are Webalizer (written in C) and AWStats (written in Perl). Both should also be available through the Ubuntu repositories. These will parse your logfiles and generate reports for you to view (typically through a web browser, although, they can generate text reports as well). ...


5

Like HopelessNOOb, I'd recomend getting some professional help with this. When you know that a system has been compromised you can't rely on any data stored on it. Further, if the compromise was via HTTP, then there's probably not enough information in the standard logs to be able to isolate what hapenned. This is why people who are serious about webserver ...


4

In addition to the guidance here, these topics are discussed in depth over on the security stack exchange. Have a read of the question on Apache hardening: http://security.stackexchange.com/questions/77/485


4

1) You can have a look at these links for some software to help you, though I've not used most of them myself. But given that you've got timestamps on the files that were altered, start by looking at the log files for those dates and time. Grep for the filename of one of the files altered; that should give you the ip address of the malefactor, and then you ...


4

You got a good answer from JennyD, but I'd suggest a different approach. Hire an expert. There are security experts who actually do this for a living and will do a far better, far quicker job of determining how you were hacked and where you're still vulnerable. Check out the local security market, and I'd be surprised if you can't find a decent price on a ...


4

AWStats - http://awstats.sourceforge.net/.


4

I would suggest Nagios its what we run where I work for monitoring multiple machines with are network. Its very good i've not used it specifically for what your doing but you can certainly set it up to email you when errors occur. There is a guide here for installing it on Ubuntu http://beginlinux.com/blog/2008/11/install-nagios-3-on-ubuntu-810/ and one ...


4

I suggest using OSSEC to monitor your logs. It will auto-detect the important log files and monitor all of them in real time by default. If you are using Ubuntu, it will look at all authentication logs, apache logs, apt-get logs (to see when new apps are installed), etc. It is open source, has an active development team and is simple to use. We migrated to ...


4

The three log analysers you list (Analog, Awstats & Webalizer) don't do much with Apache Error logs. I've used ScanErrLog to summarise the Apache error_log file for several years now. I run it from Cron once or twice a day, and it remembers where it finished, to be able to pick up and add to the output. Usually, I have it produce a HTML page with counts ...


3

You could use LambdaProbe : http://www.lambdaprobe.org/d/index.htm It's a nice webapps that only require that you relaunch Java. It provides nice features like live thread listing, and also parses log file (catalina.out) There is some nice monitoring (Session, threads, memory) and gives connector's load. At last (not least) it provides an interface to ...


3

And you can send it with something like this: EMAILMSG="/tmp/logreport.$$" echo "Something to put in the email" >> $EMAILMSG cat $EMAILMSG | mail -s "Whatever Subject You Like" user@domain.com rm -f $EMAILMGS


3

Download and install Splunk (www.splunk.com) on the server. It's similar to logwatch, but provides you with a search engine for your logs. You can configure it to index your logs, you can then search the logs and find patterns, find the errors, and then look at what other logs are doing at that specific point of failure. It can also be set to send alerts ...


3

The best solution to your problem (as clarified in your comment) is NOT to analyze the logfile at all. Use Google Analytics. It will give you all the details about traffic you're likely to need and even some customizations (via the API, that is a simple javascript call) necessary to track stuff that's typically un-trackable via log parsing anyway ...


3

Snort is a lightweight network intrusion detection system. It monitors network traffic and analyzes it against a rule set defined by the user. Fail2ban scans log files. It supports SSH, HTTP, VOIP, MTA, and user definition rules.


3

I don't want to sound too rude (just a little). Don't take it as a personal attack, the "you" here is ofr everyone that asks this question - I did it too, sometimes I was too lazy to do something, sometimes I took the stuff and maintain it in a way that "works for me" - I didn't have the guts up until know to do that in any official way. All of the below ...


3

For Postfix logs, how about isoqlog? It's a bit dusty and old, but generates nice HTML summaries. If you want a command line tool, pflogsumm is excellent. I don't know about Dovecot statistics, I'm more familiar with Cyrus.


2

Well, this misses one of your requirements (not FLOSS), but try Splunk. It's free (as in beer) for up to 500 MB of data indexed per day. It makes it trivially easy to get the kind of data you're looking for; statistical reporting on the response time drilled down to a certain URL, or aggregate reports of what the fast and slow URLs are, would be a breeze.


2

In addition to Fail2Ban look at DenyHosts. They work a little differently, so one might fit better in your environment than the other. The two lightest weight log monitoring tools I've used have been LogWatch and logsentry. LogWatch is a fairly standard tool these days. It normally runs nightly, parses through a bunch of logs and will email a nice report ...


2

Try Apache Logs Viewer. Should display graphical reports and filter based on specific criteria. http://www.apacheviewer.com


2

Splunk http://www.splunk.com/ Up to 500m data is free, any more requires a license key. It will analyze many different kinds of log files, and has plugins for reading other kinds of log files outside of the standard (syslog and apache, and a few others I believe). It has a very nice interface, and is very fast.


2

google Yep that's called internet background noise, hackers trying to get into your machine. It's pretty normal. Anyway what you can do is install a host based intrusion detection system like OSSEC. The benefit is that you this will block attacks so you can sleep better at night.


2

I'm using Zabbix with IPMI tools to restart faulty servers on demand. Also, I think OSSEC is a good choice too, but you really need to experiment and debug before put it in prod...


2

My Thoughts would be: Use petit (http://opensource.eyemg.com/Petit) to analyze instead of uniq. Logs could be stored in .gz format so the following may achieve your first 3 goals and it is GPL. There is no graphical interface or notion of exporting. zcat logfile.gz | petit --hash Or zcat logfile.gz | petit --dgraph



Only top voted, non community-wiki answers of a minimum length are eligible