CodeRed Log analyser

[Brovnik]

Category:

Misc

Description:

Trawls through Apache Logs for likely CodeRed attack signatures and outputs statistics for the attacks by date, host and server.

#! /usr/local/bin/perl -w

use strict;

### Code Here

my @files = glob "/usr/local/apache/logs/*-access_log";
my %date;
my %host;
my %server;
my $lines = 0;
my $attacks = 0;

my %months = (Jan=>'01',
              Feb=>'02',
              Mar=>'03',
              Apr=>'04',
              May=>'05',
              Jun=>'06',
              Jul=>'07',
              Aug=>'08',
              Sep=>'09',
              Oct=>'10',
              Nov=>'11',
              Dec=>'12',
              );
foreach (@files)
{
   open(FH,$_) or die "Can't open $_";
   my $server = $_;
   while (<FH>)
   {
      $lines++;
      next unless /default\.ida/;
      $attacks++;
      my @fields = split;
      $server{$server}++;
      $host{$fields[0]}++;
      my $date = join('-','2001',
                          $months{substr($fields[3],4,3)},
                          substr($fields[3],1,2));
      $date{$date}++;
   }
   close(FH);
}

print "$lines log lines, $attacks attacks\n";

foreach (sort keys %date)
{
   print "$_ : $date{$_}\n";
}

print "\n";

foreach (keys %server)
{
   print "$_ : $server{$_}\n";
}

print "\n";

my $onecount = 0;

foreach (map  { $_->[0] }
         sort { $b->[1] <=> $a->[1] }
         map  { [$_,$host{$_}] }
         keys %host)
{
   ++$onecount and next if $host{$_} == 1;
   printf "%43s : $host{$_}\n", $_;
}

printf "%43s : $onecount\n","(Single attack)";