Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 3 down vote favorite
1

Is there any open source project that logs all the failed login attempts over a period of time and gives me analysis of the same, the login failure is at windows or unix or mac user authentication over rdp,telnet or login screens or any other forms

share|improve this question
Generally you'd look for a separate logging solution for each platform (note: on Linux any failed SSH logins or root escalations should already be logged anyway) and then have those logs coallesced by some sort of log manager. I wrote my own scripts for this, but other users should be able to suggest existing solutions. – Polynomial May 29 '12 at 5:45

2 Answers

up vote 4 down vote accepted

If you want to do log analysis in general you can use Splunk or something alike and just introduce all logs. You just have to create a query for your different files (I suggest putting them in one index). After that you can just create a timegraph and and piecharts to see when, where and how much people have tried to log in. It's not opensource though. Only parts of it are opensource and it's not cheap if you have more than 500 MB of logs per day. There is a complete opensource alternative called logstash.

share|improve this answer
+1 Splunk is what I use for this very situation. There are ways to cut down the data Splunk indexes to stay under the 500MB limit and keep it free. – schroeder May 29 '12 at 20:54
up vote 1 down vote

Splunk is great for digging through logs but one of the best tools there is for in-depth analysis is Microsoft's Log Parser tool. It basically lets you run SQL queries on many formats of log data. It's great for ad hoc queries but it is easy to script it to generate nicely formatted charts and reports.

The main thing about Log Parser is that with some creativity you can come up with some very cool stuff. For example:

  1. Show all users who had failed logins on more than one computer on the network within a one-hour period.
  2. List the users with the most failed login attempts
  3. List usernames and IP addresses for all users who have ever logged in to a specific server
  4. Show all users who have logged in at unusual times or from unusual places

Also I know I probably shouldn't be promoting my own stuff but I really do recommend the "Log Parser Toolkit" book I published which has chapters written by a number of industry experts (including the author of Log Parser) that is a great reference for this stuff. My own copy is very worn down and I still use it constantly.

share|improve this answer
The MS page says it is compatible with Win 2k3 but not anything more recent. How does it handle on Win 2k8R2? And btw, Splunk also does all the things you list :) – schroeder May 31 '12 at 1:18
I use it with 2k8R2 just fine. Good to know splunk does that, I have it set up collecting some logs but haven't spent enough time really playing with it. – Mark Burnett May 31 '12 at 8:04

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.