Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'd like to learn more about forensic analysis, and I'm trying to do the challenges from Project Honeynet. I need to check the logfiles and find the IP's that connected remotely to the computer. I have a dd made image of the harddrive. I think the only service that was running was apache. Besides Apache's logs, what other log files should I check? Where are they located?

share|improve this question

2 Answers 2

You could look at /var/log/wtmp using the command who. This will show you who has logged on to the system. I think it shows Ip's but not completely sure. This of course would only apply to *nix machines.

Edit: After re-reading the post I suspect you were looking more for a log of who made connections to your webserver? This won't show you anything like that, just who accessed a shell I think.

share|improve this answer
    
Yes. I'm searching for connections made to the system. –  Geo Nov 7 '09 at 21:57

You didn't specify what system you're running, but I'll guess a recent Linux: there's a whole plethora of logs awaiting your inspection under /var/log. Other systems may have put them elsewhere. Nearly all of these could have useful connect information.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.