Grep /var/log for hacker/script kiddy activity and e-mail?
Posted
by
Jason
on Server Fault
See other posts from Server Fault
or by Jason
Published on 2012-09-06T02:44:26Z
Indexed on
2012/09/06
3:39 UTC
Read the original article
Hit count: 186
CentOS 6 Apache Server version: Apache/2.2.15 (Unix)
Thinking about how to automatically, once a day, grep all the logs in /var/log/httpd for hacker, phishing, etc activity and e-mail it to myself so I can evaluate what I might need to do.
But what are the patterns I can look for?
IE, we dont run Wordpress and we see a lot of attempts to access Wordpress related content, obviously for an exploit. Same with PHPMyAdmin.
I could do something like repeatedly, matching common patterns we see.
# grep -r -i wp-content /var/log/httpd/
# grep -r -i php-my-admin /var/log/httpd/
How do I e-mail myself this the results of each grep command or better yet all Grep results in a single e-mail?
© Server Fault or respective owner