Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

What I need is a forensic log analyzer tool for apache to do the after math of a successful abuse of service attack which took place 2-3 month in the past. We are running a shared hosting service and one of our customers seems to have (or had) an exploitable script running. I suspect that I could find clues and hints in the logs but they are just too huge to browse through them manually or grep regexps from them.

Is there a tool which can do it and has predefined search patterns for known attacks and probably even heuristics to discover suspicious activities?

I do not look for a tool to do real-time blocking of such attempts because I need to analyze past logs and see if the exploit has been closed.

share|improve this question

2 Answers 2

up vote 2 down vote accepted

Probably, AWStats can help you. It is a free and open-source tool.

Edit/Update:
Check out Phpida and Scalp as well. They are security analyzers looking for HTTP attacks, SQL injection etc.
http://sourceforge.net/projects/phpida/
http://code.google.com/p/apache-scalp/

share|improve this answer
    
AWStats is just a statistical analyzer and graphing tool, isn't it? Not much different from webalizer. –  hurikhan77 Sep 6 '09 at 14:39
    
Yes, you're right. You can check Scalp and Phpida. –  swatkat Sep 6 '09 at 14:52
    
Scalp is probably the way to go and I will look into it. Thanks. –  hurikhan77 Sep 6 '09 at 14:54

Check out WebForensik

It's a PHPIDS-based script (released under GPL2) to scan your HTTPD logfiles for attacks against web applications.

Features:

  • supports standard log formats (common, combined)
  • allows user-defined (mod_log_config syntax) formats
  • automatically pipes your web logs through PHPIDS
  • categorizes all incidents by type, impact, date, host...
  • generates reports in CSV, HTML (sortable table), XML
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.