Is there any open source framework or libraries which can provide security monitoring capabilities for Web application by analyzing Web application access logs. Basically i need to monitor and analyze Apache/IIS logs and want to compute general statistic like Request analysis, bot hits etc

closed as not constructive by Polynomial, Ayrx, Iszi, AviD Sep 23 '12 at 16:11

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Have a look at phpids.org - this is an intrusion detection system which writes suspicious behaviour into logs. – akluth Sep 20 '12 at 11:01
  • From your question, it sounds like you want the application itself to monitor it's own logs. The usual practice is to have a separate IDS watching the logs - is there a reason you don't want to take this approach? – Graham Hill Sep 20 '12 at 11:11
  • No i need to find or develop a separate tool to view and analyze Apache/IIS logs with more ease the closest thing i found was Apache log viewer apacheviewer.com – Ali Ahmad Sep 21 '12 at 7:55
  • Typically requests for tools or recommendations for tools are not really a great fit for SE sites, partly because at best this would only generate a list of tools, and partly because it would only be current for the immediate future. – AviD Sep 23 '12 at 16:10
  • In the meantime, I will suggest you check out some of the OWASP tools, e.g. ESAPI and AppSensor. Might be what you're looking for. – AviD Sep 23 '12 at 16:11

Check out http://code.google.com/p/apache-scalp/ (uses PHP IDS)

Scalp! is a log analyzer for the Apache web server that aims to look for security problems. The main idea is to look through huge log files and extract the possible attacks that have been sent through HTTP/GET (By default, Apache does not log the HTTP/POST variable).


Use OSSEC (http://www.ossec.net/) for log analysis & real-time alerting, use logwatch (http://sourceforge.net/projects/logwatch/) for log analysis & report creation OR combine those two approaches: http://www.chrisbrenton.org/2010/02/combining-logwatch-and-ossec/

Not the answer you're looking for? Browse other questions tagged or ask your own question.