0

Is there any open source framework or libraries which can provide security monitoring capabilities for Web application by analyzing Web application access logs. Basically i need to monitor and analyze Apache/IIS logs and want to compute general statistic like Request analysis, bot hits etc

  • Have a look at phpids.org - this is an intrusion detection system which writes suspicious behaviour into logs. – alexclooze Sep 20 '12 at 11:01
  • From your question, it sounds like you want the application itself to monitor it's own logs. The usual practice is to have a separate IDS watching the logs - is there a reason you don't want to take this approach? – Graham Hill Sep 20 '12 at 11:11
  • No i need to find or develop a separate tool to view and analyze Apache/IIS logs with more ease the closest thing i found was Apache log viewer apacheviewer.com – Ali Ahmad Sep 21 '12 at 7:55
  • Typically requests for tools or recommendations for tools are not really a great fit for SE sites, partly because at best this would only generate a list of tools, and partly because it would only be current for the immediate future. – AviD Sep 23 '12 at 16:10
  • In the meantime, I will suggest you check out some of the OWASP tools, e.g. ESAPI and AppSensor. Might be what you're looking for. – AviD Sep 23 '12 at 16:11
1

Check out http://code.google.com/p/apache-scalp/ (uses PHP IDS)

Scalp! is a log analyzer for the Apache web server that aims to look for security problems. The main idea is to look through huge log files and extract the possible attacks that have been sent through HTTP/GET (By default, Apache does not log the HTTP/POST variable).

| improve this answer | |
1

Use OSSEC (http://www.ossec.net/) for log analysis & real-time alerting, use logwatch (http://sourceforge.net/projects/logwatch/) for log analysis & report creation OR combine those two approaches: http://www.chrisbrenton.org/2010/02/combining-logwatch-and-ossec/

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.