Details of webserver log analysis

From MyWiki
Revision as of 09:33, 21 May 2014 by George2 (Talk | contribs)

Jump to: navigation, search

The script to create this web page is run from roots cron on backup.gold.ac.uk using the following crontab entry
0,20,40 * * * * /usr/local/bin/security.sh > /var/tmp/cron_log 2>&1
The contents of the script are shown below:


 <HTML>
 <BODY  bgcolor="#E6E6FA"   >

Gold Webservers log file analysis. Updated every 20 minutes


" >> /var/tmp/secure.html echo "</BODY>" >> /var/tmp/secure.html echo "</HTML>" >> /var/tmp/secure.html mv /var/tmp/secure.html /var/www/html/webteam echo `date`
The top users of www.gold.ac.uk as taken from the last 2000 enries of the access_log files on both webservers
END while read INP do echo $INP | gawk '{ print "" }' >> /var/tmp/secure.html
 done < /var/tmp/jupiter_all
echo "
Jupiter between `head -1 /var/tmp/jupiter_tail.log | gawk '{ print $4}'|sed -e 's/^\[//' ` and `tail -1 /var/tmp/jupiter_tail.log | gawk '{ print $4}' |sed -e 's/^\[//' `
Recent hits IP Address DNS Entry if available
",$1,"",$2,"",$3,"
" >> /var/tmp/secure.html


 cat <<END >>/var/tmp/secure.html
END while read INP do echo $INP | gawk '{ print "" }' >> /var/tmp/secure.html
 done < /var/tmp/uranus_all
echo "
Uranus between `head -1 /var/tmp/uranus_tail.log | gawk '{ print $4}'|sed -e 's/^\[//' ` and `tail -1 /var/tmp/uranus_tail.log | gawk '{ print $4}' |sed -e 's/^\[//' `
Recent hits IP Address DNS Entry if available
",$1,"",$2,"",$3,"
" >> /var/tmp/secure.html echo "