Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to learn more about forensic analysis, and I'm trying to do the challenges from Project Honeynet. I need to check the logfiles and find the IP's that connected remotely to the computer. I have a dd made image of the harddrive. I think the only service that was running was apache. Besides Apache's logs, what other log files should I check? Where are they located?

share|improve this question

You could look at /var/log/wtmp using the command who. This will show you who has logged on to the system. I think it shows Ip's but not completely sure. This of course would only apply to *nix machines.

Edit: After re-reading the post I suspect you were looking more for a log of who made connections to your webserver? This won't show you anything like that, just who accessed a shell I think.

share|improve this answer
Yes. I'm searching for connections made to the system. – Geo Nov 7 '09 at 21:57

You didn't specify what system you're running, but I'll guess a recent Linux: there's a whole plethora of logs awaiting your inspection under /var/log. Other systems may have put them elsewhere. Nearly all of these could have useful connect information.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.