1

Good day everyone, we have a web based POS PHP program hosted on a VPS. One of the users has his/her account username and password acquired by an unknown person and encoded data to the database through the program. Our program has a function that records date and time but not the IP used by the user to login to the program.

I have access to our Linux server which is running Centos 5 OS, is there a way to get the history of IP addresses that connected to our server through http or our web based program on the specific date and time the data was encoded through netstat command or any software/tools?

I already contacted the tech support of our VPS and they replied that it is the responsibility of the administrator to install software/tools to monitor server activity and logs. Aside from updating our program to include a function that will record the IP of a user whenever he/she logs in, can you guys recommend any Linux software/tools that can monitor daily server activity, specifically one that can record IP address, date and time whenever a user accesses our server via http or our web program?

I read a thread on ipclog & constat, would this tool provide the details I need for daily server activity and logs monitor?

I'm fairly new to the Linux environment and my knowledge in Linux administration is limited. I hope you guys can help me, thank you very much.

1

Since you're looking to process your Apache access logs, filebeat is something you may want to look into to connect to Logstash (should you want to go with the ELK solution previously suggested), example of file here. You can customize filebeat for Apache, with your filebeat.yml looking like:

 -
      paths:
        - /path_to_your_access_log/access.log
      document_type: apache-access

In your logstash configuation, /etc/logstash/conf.d/12-apache.conf you can add the following filter:

filter {
  if [type] == "apache-access" {
    grok {
      match => { "message" => "%{COMBINEDAPACHELOG}" }
    }
  }
}
0

You can use ELK ( Elasticsearch, Logstash and Kibana ) log monitoring process to monitor your server logs. You can add any log file which needs to be monitored like apache access and error logs, /var/log/messages, /var/log/secure etc.

You can use following doc for reference.

http://www.tecmint.com/install-elasticsearch-logstash-and-kibana-elk-stack-on-centos-rhel-7/

Thanks, Shelendra Singh

0

Processing the logs of your server is the easiest way. Apache, Nginx, IIS should write the IP of the user who access to the web.

  • Yes our Apache server has access logs and I'm now looking into on how to extract the logs. Thank you very much. – peterparker Oct 26 '16 at 11:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.