Re: reviewing httpd access log

[marius <anarcap@gmail.com>]

On Sun, 1 Aug 2004 12:42:34 -0500, J Moore <jaymo@cullmail.com> wrote:
> Reviewing my /var/www/logs/access_log file it seems there are a lot of
> "bogus" entries; i.e. people trying various hacks, looking for
> weaknesses, testing for win32, etc, etc.
> 
> Is there a good technique for automatically identifying these
> trouble-makers? I'd like to be able to build a "deny" table for pf to
> halt repeat offendors, but I can't afford the time to review the logs
> "manually".
> 
> Thanks,
> Jay
> 
> 

Check out Snort... http://www.snort.org/