log file auditing

capricorn80 · 02-21-2008, 11:26 AM

Hi !
I got a webserver log saved in text file and i want to audit to get different answers like different attacks , hacking attacks , scripting attacks , worm attacks etc.
Pls advice me some open soure tool that can help me

Regards

frndrfoe · 02-21-2008, 02:17 PM

I make use of the built in "logwatch" that comes with redhat/centos. It has varying levels of verbosity and can spot some hack attempts and probes.
http://www2.logwatch.org:81/

capricorn80 · 02-22-2008, 09:38 AM

I tried it but it didnt give me help in customize way. As i am just looking to have scan on one log file containing webserver log.

frndrfoe · 02-22-2008, 10:00 AM

I think the detecting intrusion attempts would be better suited for something like snort rather than a log analyzer.

unSpawn · 02-23-2008, 08:22 AM

I agree auditing is best done on live requests using the firewall, mod_security, Snort or Prelude and such. You could still run the old log through Logwatch or Webalizer. This won't audit your logs but summarise and group entries which makes it easier to find patterns and the amount of requests. If you post the top 10 different or the 10 most interesting requests here I'm sure we can help finding out what's it about.

capricorn80 · 02-24-2008, 07:46 AM

yea but i am looking to get hacking attacks , worm attacks from log file. Is there any python script like that . i have searched some but didnt get any one which deteremines the worm and other attacks.

Regards.

unSpawn · 02-24-2008, 06:32 PM

On second glance Logwatch (domain no longer registered?) does have http 'sploit tests (albeit rudimentary) else maybe try CodeBlue (Sourceforge) which is kinda stale (2003) but it advertises it uses Nikto sigs which is a good thing. Another way, if you confine searches to sites that have or archive mailing lists like SecurityFocus, theaimsgroup, insecure.org and such, could be to use a script to query your favourite searchengine to find clues. Other than that I've no ideas.

unixfool · 02-27-2008, 07:35 AM

Quote:

Originally Posted by unSpawn

I agree auditing is best done on live requests using the firewall, mod_security, Snort or Prelude and such. You could still run the old log through Logwatch or Webalizer. This won't audit your logs but summarise and group entries which makes it easier to find patterns and the amount of requests. If you post the top 10 different or the 10 most interesting requests here I'm sure we can help finding out what's it about.

Mod_security will help a ton here. Mod_security also has this script that converts snort rules into mod_security rules...that way, you can have the application itself looking for the same things Snort would, but at the application level. Logging is also enhanced (on both Snort and mod_security). Just my .02 though.