[mod-security-users] statistics

[Justin G. <web...@sw...>]

hi,

I've asked here before and kept googling but can't find any piece of script
that can parse the audit log(s) and provide a picture of what's going on.

I'd like to know for example top attacking IP's, top attacked sites, top signatures used.

Also I'm thinking about email notification of possible intrussions, anyone has a sane logic
and possible script for notifications? Maybe email for one IP getting x errors in y seconds?

Such script could also help detect false positives, I'm always having troubles detecting them
before my clients :(

thanks,
	Justin