Grep /var/log for hacker/script kiddy activity and e-mail?

Posted by Jason on Server Fault See other posts from Server Fault or by Jason
Published on 2012-09-06T02:44:26Z Indexed on 2012/09/06 3:39 UTC
Read the original article Hit count: 186

Filed under:
|
|
|

CentOS 6 Apache Server version: Apache/2.2.15 (Unix)

Thinking about how to automatically, once a day, grep all the logs in /var/log/httpd for hacker, phishing, etc activity and e-mail it to myself so I can evaluate what I might need to do.

But what are the patterns I can look for?

IE, we dont run Wordpress and we see a lot of attempts to access Wordpress related content, obviously for an exploit. Same with PHPMyAdmin.

I could do something like repeatedly, matching common patterns we see.

# grep -r -i wp-content /var/log/httpd/

# grep -r -i php-my-admin /var/log/httpd/

How do I e-mail myself this the results of each grep command or better yet all Grep results in a single e-mail?

© Server Fault or respective owner

Related posts about apache2

Related posts about httpd