Is there any open source project that logs all the failed login attempts over a period of time and gives me analysis of the same, the login failure is at windows or unix or mac user authentication over rdp,telnet or login screens or any other forms

  • Generally you'd look for a separate logging solution for each platform (note: on Linux any failed SSH logins or root escalations should already be logged anyway) and then have those logs coallesced by some sort of log manager. I wrote my own scripts for this, but other users should be able to suggest existing solutions.
    – Polynomial
    Commented May 29, 2012 at 5:45

3 Answers 3


If you want to do log analysis in general you can use Splunk or something alike and just introduce all logs. You just have to create a query for your different files (I suggest putting them in one index). After that you can just create a timegraph and and piecharts to see when, where and how much people have tried to log in. It's not opensource though. Only parts of it are opensource and it's not cheap if you have more than 500 MB of logs per day. There is a complete opensource alternative called logstash.

  • +1 Splunk is what I use for this very situation. There are ways to cut down the data Splunk indexes to stay under the 500MB limit and keep it free.
    – schroeder
    Commented May 29, 2012 at 20:54

Splunk is great for digging through logs but one of the best tools there is for in-depth analysis is Microsoft's Log Parser tool. It basically lets you run SQL queries on many formats of log data. It's great for ad hoc queries but it is easy to script it to generate nicely formatted charts and reports.

The main thing about Log Parser is that with some creativity you can come up with some very cool stuff. For example:

  1. Show all users who had failed logins on more than one computer on the network within a one-hour period.
  2. List the users with the most failed login attempts
  3. List usernames and IP addresses for all users who have ever logged in to a specific server
  4. Show all users who have logged in at unusual times or from unusual places

Also I know I probably shouldn't be promoting my own stuff but I really do recommend the "Log Parser Toolkit" book I published which has chapters written by a number of industry experts (including the author of Log Parser) that is a great reference for this stuff. My own copy is very worn down and I still use it constantly.

  • The MS page says it is compatible with Win 2k3 but not anything more recent. How does it handle on Win 2k8R2? And btw, Splunk also does all the things you list :)
    – schroeder
    Commented May 31, 2012 at 1:18
  • I use it with 2k8R2 just fine. Good to know splunk does that, I have it set up collecting some logs but haven't spent enough time really playing with it. Commented May 31, 2012 at 8:04

Splunk is the best option for any security related analysis based on logs. Getting failed login attempts in very categorized and productive way in splunk is just one query hit.

Based on source type you can manage between different source type, and even can manage time period of log you want to look over. It also provides many good graphical stats which can be easily explained to concerned hire management.

You just need to put pressure on co-relation to get potential output.

  • 1
    "best" is a very relative term. Splunk is helpful, yes. Splunk is not open source, though.
    – schroeder
    Commented Nov 1, 2015 at 1:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .