• Post Reply Bookmark Topic Watch Topic
  • New Topic
programming forums Java Mobile Certification Databases Caching Books Engineering Micro Controllers OS Languages Paradigms IDEs Build Tools Frameworks Application Servers Open Source This Site Careers Other all forums
this forum made possible by our volunteer staff, including ...
Marshals:
  • Campbell Ritchie
  • Liutauras Vilda
  • Junilu Lacar
  • Jeanne Boyarsky
  • Bear Bibeault
Sheriffs:
  • Knute Snortum
  • Tim Cooke
  • Devaka Cooray
Saloon Keepers:
  • Ron McLeod
  • Stephan van Hulst
  • Tim Moores
  • Tim Holloway
  • Carey Brown
Bartenders:
  • Piet Souris
  • Frits Walraven
  • Ganesh Patekar

IP/host filtering in log files?

 
Ranch Hand
Posts: 184
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
Hello All,

I am trying to find repeated IP hits to the server in the log file or how to find which IP has the highest number of hits to the server or has done the most damaged? This is not only for IP's but also for any host name or any user having the highest entry in the server log?

Thanks,
 
Author
Posts: 836
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
You're welcome. Despite the question marks though, there isn't a question here, just a set of statements about what you want to do. So what have you thought about or tried, and what problems have you been having? Then we'll go from there...
 
Saloon Keeper
Posts: 21133
134
Android Eclipse IDE Tomcat Server Redhat Java Linux
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
Ah well, I'm not exactly fluent in malayam, tamil or urdu. I think I can see the question in there, even if it doesn't match the question marks.

First, the number of attacks isn't related to the amount of damage done. I have typically 10,000 attempts made on one of my FTP servers every day. So far they have all bounced. But it would take only one successful attack on any IP or port to get my machine owned.

On the Fedora/Red Hat architecture, there's a package called logwatch that will scan your logfiles every day and email a summary of this and other things as well. By default it gets sent to the root account on the local machine, but you can override that and send it to whomever and wherever you prefer.

Here's a small typical excerpt:


You can see that after all these years, the SQL Slammer is still alive and well!
 
girl power ... turns out to be about a hundred watts. But they seriuosly don't like being connected to the grid. Tiny ad:
Building a Better World in your Backyard by Paul Wheaton and Shawn Klassen-Koop
https://coderanch.com/wiki/718759/books/Building-World-Backyard-Paul-Wheaton
  • Post Reply Bookmark Topic Watch Topic
  • New Topic
Boost this thread!