Is there any open source project that logs all the failed login attempts over a period of time and gives me analysis of the same, the login failure is at windows or unix or mac user authentication over rdp,telnet or login screens or any other forms
If you want to do log analysis in general you can use Splunk or something alike and just introduce all logs. You just have to create a query for your different files (I suggest putting them in one index). After that you can just create a timegraph and and piecharts to see when, where and how much people have tried to log in. It's not opensource though. Only parts of it are opensource and it's not cheap if you have more than 500 MB of logs per day. There is a complete opensource alternative called logstash.
Splunk is great for digging through logs but one of the best tools there is for in-depth analysis is Microsoft's Log Parser tool. It basically lets you run SQL queries on many formats of log data. It's great for ad hoc queries but it is easy to script it to generate nicely formatted charts and reports.
The main thing about Log Parser is that with some creativity you can come up with some very cool stuff. For example:
- Show all users who had failed logins on more than one computer on the network within a one-hour period.
- List the users with the most failed login attempts
- List usernames and IP addresses for all users who have ever logged in to a specific server
- Show all users who have logged in at unusual times or from unusual places
Also I know I probably shouldn't be promoting my own stuff but I really do recommend the "Log Parser Toolkit" book I published which has chapters written by a number of industry experts (including the author of Log Parser) that is a great reference for this stuff. My own copy is very worn down and I still use it constantly.
Splunk is the best option for any security related analysis based on logs. Getting failed login attempts in very categorized and productive way in splunk is just one query hit.
Based on source type you can manage between different source type, and even can manage time period of log you want to look over. It also provides many good graphical stats which can be easily explained to concerned hire management.
You just need to put pressure on co-relation to get potential output.