There is a OpenBSD (64bit; 5.5) server having nginx (HTTP/HTTPS) and SMTP (OpenSMTP).

Question: What are the best practices to detect suspicious activity? Are there any scripts that shows interesting activity from the logs or somewhere? Attacks, DDOS, any abnormal activity?

Example for detecting IP addresses that connected too many times: dos.awk

function max(arr, big) {
    big = 0;
    for (i in cat) {
    if (cat[i] > big) { big=cat[i]; }
    return big

NF > 0 {
    maxm = max(cat);
    for (i in cat) {
    scaled = 60 * cat[i] / maxm;
    printf "%-25.25s  [%8d]:", i, cat[i]
    for (i=0; i<scaled; i++) {
        printf "#";
    printf "\n";

How to use it:

tail -n 1000 /var/www/logs/access.log | awk -f dos.awk | sort -nrk3 | less
  • 2
    The problem with detecting attacks based on log files after the fact is that a potential attacker who manages to root the system could manipulate the logs to cover their tracks. Commented Aug 23, 2014 at 2:17
  • In the situation as you explain @Jeff-InventorChromeOS if the root is compromised does elastic.co/products/x-pack/monitoring that works with log (if I have well understood) could be compromised too?
    – aurelien
    Commented Nov 27, 2016 at 11:34

3 Answers 3


There are a number of ways you could approach this, but the most direct would probably be to set up an intrusion detection system, such as Snort. It monitors all traffic to the server and can warn you of suspicious activity.


I would suggest using a logging server, such as Splunk. It will take in your access logs ( or virtually any data) and index it for searches and queries. You would have the ability to search, build graphs, stats charts, etc. it's also good for driving deep into your data and find trends or anomalies. You can also create alerts so you can be notified if something's happens. There is a lot of support in the community as well, so it's easy to get your solution customized if needed. Hope this helps.


For log file based attack detection be sure to give the OSSEC HIDS a try: https://ossec.github.io/

  • Whoever downvoted my answer, I'd appreciate to learn why
    – Peter O.
    Commented Aug 2, 2017 at 7:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .