[mod-security-users] Re: Log-parser
Brought to you by:
victorhora,
zimmerletw
|
From: Evert <eve...@ho...> - 2005-05-23 06:38:42
|
sure. but there's one little bug in it (this morning i noticed that 20:00 is put in the dbase as 2:00, don't know why yet...). when that one is out i'll post my code here. kind regards, Evert "Ryan Barnett" <rcb...@gm...> wrote in message news:cba...@ma...... Evert, That is a cool looking interface. Reminds me of the SnortSnarf output. I would be interested in the code if you could make it available. FYI - I am writing a book on Apache security/intrusion detection. I am currently writing a chapter on log monitoring/analysis. I would like to include this code if you don't mind. I would of course give you proper credit :) Additionally, I have a PERL script I call sgrep.pl that will parse through the audit_log and extract out an entire record that has the search text in it. Here is some example output - # ./sgrep.pl -f audit_log -s "passwd.txt" |less ======================================== Request: 62.103.182.12 - - [Fri Mar 12 03:55:49 2004] "HEAD http://www.abrianna.com/ccbill/password/htpasswd.txt HTTP/1.0" 404 0 Handler: proxy-server ---------------------------------------- HEAD http://www.abrianna.com/ccbill/password/htpasswd.txt HTTP/1.0 Cache-Control: no-cache Connection: close Host: www.abrianna.com Pragma: no-cache Proxy-Connection: keep-alive Referer: http://www.abrianna.com/ccbill/password/htpasswd.txt User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) HTTP/1.0 404 Not Found Content-Type: text/html; charset=iso-8859-1 X-Cache: MISS from www.testproxy.net Connection: close ======================================== Request: 217.160.165.173 - - [Fri Mar 12 22:41:17 2004] "GET /wwwboard/passwd.txt HTTP/1.1" 200 578 Handler: (null) --CUT-- Let me know if anyone is interested in the sgrep.pl script and I will post it to the list. Thanks, -- Ryan C. Barnett Web Application Security Consortium (WASC) Member SANS Instructor: Securing Apache GCIA, GCFA, GCIH, GCUX, GSEC On 5/10/05, Evert <ev...@di...> wrote: > since there were nog audit_log parsers around i wrote one myself. is somebody > interrested in the code? then i can put it online somewhere. > > the ouput is like this: http://evert.dyndns.org/modsec/ > > kind regards, > Evert Daman > > > > ------------------------------------------------------- > This SF.Net email is sponsored by Oracle Space Sweepstakes > Want to be the first software developer in space? > Enter now for the Oracle Space Sweepstakes! > http://ads.osdn.com/?ad_id=7412&alloc_id=16344&op=click > _______________________________________________ > mod-security-users mailing list > mod...@li... > https://lists.sourceforge.net/lists/listinfo/mod-security-users > -- Ryan C. Barnett Web Application Security Consortium (WASC) Member SANS Instructor: Securing Apache GCIA, GCFA, GCIH, GCUX, GSEC ------------------------------------------------------- This SF.Net email is sponsored by Oracle Space Sweepstakes Want to be the first software developer in space? Enter now for the Oracle Space Sweepstakes! http://ads.osdn.com/?ad_idt12&alloc_id344&op=ick |