Beefy Boxes and Bandwidth Generously Provided by pair Networks
Clear questions and runnable code
get the best and fastest answer
 
PerlMonks  

CodeRed Log analyser

by Brovnik (Hermit)
on Aug 08, 2001 at 18:18 UTC ( #103053=sourcecode: print w/ replies, xml ) Need Help??

Category: Misc
Author/Contact Info Brovnik
Description: Trawls through Apache Logs for likely CodeRed attack signatures and outputs statistics for the attacks by date, host and server.
#! /usr/local/bin/perl -w

use strict;

### Code Here

my @files = glob "/usr/local/apache/logs/*-access_log";
my %date;
my %host;
my %server;
my $lines = 0;
my $attacks = 0;

my %months = (Jan=>'01',
              Feb=>'02',
              Mar=>'03',
              Apr=>'04',
              May=>'05',
              Jun=>'06',
              Jul=>'07',
              Aug=>'08',
              Sep=>'09',
              Oct=>'10',
              Nov=>'11',
              Dec=>'12',
              );
foreach (@files)
{
   open(FH,$_) or die "Can't open $_";
   my $server = $_;
   while (<FH>)
   {
      $lines++;
      next unless /default\.ida/;
      $attacks++;
      my @fields = split;
      $server{$server}++;
      $host{$fields[0]}++;
      my $date = join('-','2001',
                          $months{substr($fields[3],4,3)},
                          substr($fields[3],1,2));
      $date{$date}++;
   }
   close(FH);
}

print "$lines log lines, $attacks attacks\n";

foreach (sort keys %date)
{
   print "$_ : $date{$_}\n";
}

print "\n";

foreach (keys %server)
{
   print "$_ : $server{$_}\n";
}

print "\n";

my $onecount = 0;

foreach (map  { $_->[0] }
         sort { $b->[1] <=> $a->[1] }
         map  { [$_,$host{$_}] }
         keys %host)
{
   ++$onecount and next if $host{$_} == 1;
   printf "%43s : $host{$_}\n", $_;
}

printf "%43s : $onecount\n","(Single attack)";

Comment on CodeRed Log analyser
Download Code

Back to Code Catacombs

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: sourcecode [id://103053]
help
Chatterbox?
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others meditating upon the Monastery: (6)
As of 2014-12-28 10:09 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    Is guessing a good strategy for surviving in the IT business?





    Results (180 votes), past polls