LogWatch

Descripción

Logwatch es un servicio de monitorización y detección de intrusiones basado en el análisis de logs. Con una frecuencia determinada analiza los logs del sistema y realiza un Report que es enviado de inmediato al administrador.

Consumo de Ancho de Banda

Un dato interesante que seguramente nos interese recoger es el consumo diario de ancho de banda con las peticiones httpd.

Para ello debemos recoger en el formato de nuestros logs el consumo de cada petición

manolobeach.favshare.com 91.117.48.149 - - [03/Feb/2008:19:46:59 +0100] "GET /previews.php/FA..jpg.jpeg HTTP/1.1" 200 26340 "http://foro.loquo.com/viewtopic.php?t=97183&start=345" "Mozilla/5.0 (Windows; U; Windows NT 6.0; es-ES; rv:1.8.1.11) Gecko/20071127 Firefox/2.0.0.11"

y añadir este formato a la configuración de logwatch, para recoger un informe detallado solo nos hace falta ejecturar

logwatch --service http --range yesterday --detail high --print --archives

A continuación los resultados de un análisis detallado

--------------------- httpd Begin ------------------------

8777.38 MB transferred in 431008 responses (1xx 0, 2xx 295658, 3xx 124124, 4xx 11226, 5xx 0)
339229 Images (8274.81 MB),
397 Documents (3.86 MB),
1 Movies files (0.00 MB),
12 Windows executable files (0.00 MB),
90304 Content pages (472.40 MB),
5 Redirects (0.00 MB),
1060 Other (26.31 MB)

A total of 22 ROBOTS were logged
Mozilla/5.0 (compatible; Ask Jeeves/Teoma; +http://about.ask.com/en/docs/about/webmasters.shtml) 12 Time(s)
Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) 251 Time(s)
ia_archiver 11 Time(s)
Mozilla/2.0 (compatible; Ask Jeeves/Teoma) 171 Time(s)
ia_archiver-web.archive.org 2 Time(s)
Yahoo-MMCrawler/3.x (mms dash mmcrawler dash support at yahoo dash inc dot com) 103 Time(s)
msnbot/1.0 (+http://search.msn.com/msnbot.htm) 61 Time(s)
Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.8.1.11) Gecko/20071127 Firefox/2.0.0.11 317 Time(s)
Mozilla/5.0 (Windows; U; Windows NT 5.1; es-ES; rv:1.8.1.11) Gecko/20071127 Firefox/2.0.0.11 715 Time(s)
Speedy Spider (http://www.entireweb.com/about/search_tech/speedy_spider/) 22 Time(s)
Mozilla/5.0 (Twiceler-0.9 http://www.cuill.com/twiceler/robot.html) 95 Time(s)
Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp) 1509 Time(s)
WebAlta Crawler/2.0 (http://www.webalta.net/ru/about_webmaster.html) (Windows; U; Windows NT 5.1; ru-RU) 1 Time(s)
Mozilla/5.0 (compatible; discobot/1.0; +http://discoveryengine.com/robot.html) 1 Time(s)
holmes/3.12.2 (http://morfeo.centrum.cz/bot) 1 Time(s)
Baiduspider+(+http://www.baidu.com/search/spider_jp.html) 6 Time(s)
Gigabot/3.0 (http://www.gigablast.com/spider.html) 17 Time(s)
Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.8.1) VoilaBot BETA 1.2 (http://www.voila.com/) 2 Time(s)
Mozilla/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.8.1.11) Gecko/20071127 Firefox/2.0.0.11 2 Time(s)
VisBot/2.0 (Visvo.com Crawler; http://www.visvo.com/bot.html; bot@visvo.com) 1 Time(s)
msnbot-media/1.0 (+http://search.msn.com/msnbot.htm) 17 Time(s)
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.11) Gecko/20071127 Firefox/2.0.0.11 68 Time(s)

---------------------- httpd End -------------------------

Referencias

http://www2.logwatch.org:81/tabs/docs/HOWTO-Customize-LogWatch.html

Leave a Comment

You must be logged in to post a comment.

Additional comments powered by BackType