Beefy Boxes and Bandwidth Generously Provided by pair Networks
The stupid question is the question not asked
 
PerlMonks  

CodeRed Log analyser

by Brovnik (Hermit)
on Aug 08, 2001 at 18:18 UTC ( #103053=sourcecode: print w/ replies, xml ) Need Help??

Category: Misc
Author/Contact Info Brovnik
Description: Trawls through Apache Logs for likely CodeRed attack signatures and outputs statistics for the attacks by date, host and server.
#! /usr/local/bin/perl -w

use strict;

### Code Here

my @files = glob "/usr/local/apache/logs/*-access_log";
my %date;
my %host;
my %server;
my $lines = 0;
my $attacks = 0;

my %months = (Jan=>'01',
              Feb=>'02',
              Mar=>'03',
              Apr=>'04',
              May=>'05',
              Jun=>'06',
              Jul=>'07',
              Aug=>'08',
              Sep=>'09',
              Oct=>'10',
              Nov=>'11',
              Dec=>'12',
              );
foreach (@files)
{
   open(FH,$_) or die "Can't open $_";
   my $server = $_;
   while (<FH>)
   {
      $lines++;
      next unless /default\.ida/;
      $attacks++;
      my @fields = split;
      $server{$server}++;
      $host{$fields[0]}++;
      my $date = join('-','2001',
                          $months{substr($fields[3],4,3)},
                          substr($fields[3],1,2));
      $date{$date}++;
   }
   close(FH);
}

print "$lines log lines, $attacks attacks\n";

foreach (sort keys %date)
{
   print "$_ : $date{$_}\n";
}

print "\n";

foreach (keys %server)
{
   print "$_ : $server{$_}\n";
}

print "\n";

my $onecount = 0;

foreach (map  { $_->[0] }
         sort { $b->[1] <=> $a->[1] }
         map  { [$_,$host{$_}] }
         keys %host)
{
   ++$onecount and next if $host{$_} == 1;
   printf "%43s : $host{$_}\n", $_;
}

printf "%43s : $onecount\n","(Single attack)";

Comment on CodeRed Log analyser
Download Code

Back to Code Catacombs

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: sourcecode [id://103053]
help
Chatterbox?
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others drinking their drinks and smoking their pipes about the Monastery: (10)
As of 2014-12-26 07:22 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    Is guessing a good strategy for surviving in the IT business?





    Results (167 votes), past polls