Webserver log file forensics

[MichealC4]

I attempted to post this to the forensics list at securityfocus.com, but a moderator failed to properly read my email and denied my message.

I'm looking for a preferably Windows opensource C++ program to analyze the log files from various web servers, namely Apache and IIS. I need the progam to be able to do things such as decode unicode in the request string, filter out certain IP addresses, etc. Things that would make using the program appealing as opposed to the by hand forensics I am doing now.

----------------------------
"Will work for bandwidth" - Thinkgeek T-shirt

 

[pansophic]

I haven't used any of these, but ...

http://www.uu.se/Software/Analyzers/Access-analyzers.html

I typically just use Analog and Webalizer, but they don't analyze for details, just for trending.


pansophic

 

[Xemus]

Another really good tool that might work for ya is Awstats:

http://awstats.sourceforge.net/

Full demo here so you can see if it's what you need:

http://ns3744.ovh.net/awstats/awstats.pl?config=destailleur.fr

http://www.closedsocket.com

 

[MichealC4]

pansophic: Thanks, I looked but didn't see anything.

Xemus: As I mentioned in my post, that's not when I'm looking for. I'm looking for forensic tools, not trending tools.

----------------------------
"Will work for bandwidth" - Thinkgeek T-shirt

 

[pansophic]

It eluded me before, but something like samhain

http://la-samhna.de/samhain/

might be a good start to what you are looking to do. It is a host-based intrusion detection program based on log analysis. It certainly won't work out of the box, but you should be able to modify it to meet your needs.


pansophic

 

[MichealC4]

Thanks. My fault for not explaining everything.

What will happen is I am the Support Team Leader of phpBB, a popular bulletin board package. When users hand me their access logs of an attack (along with db backup and files), I've traditionally had to go through and check entries by hand. A long process staring at the black and white of Notepad or something. I'm looking for a nicer looking tool that will allow me to sort entries, exclude IP addresses, concentrate on IP addresses, follow conversations, decode unicode, etc. Basically like Ethereal except for access logs.

----------------------------
"Will work for bandwidth" - Thinkgeek T-shirt

 

[eyec]

contact someone in Guiadant(sp?) - makers of Encase, Sysinternals, or other forensics based business.