Grep /var/log for hacker/script kiddy activity and e-mail?
- by Jason
CentOS 6
Apache Server version: Apache/2.2.15 (Unix)
Thinking about how to automatically, once a day, grep all the logs in /var/log/httpd for hacker, phishing, etc activity and e-mail it to myself so I can evaluate what I might need to do.
But what are the patterns I can look for?
IE, we dont run Wordpress and we see a lot of attempts to access Wordpress related content, obviously for an exploit. Same with PHPMyAdmin.
I could do something like repeatedly, matching common patterns we see.
# grep -r -i wp-content /var/log/httpd/
# grep -r -i php-my-admin /var/log/httpd/
How do I e-mail myself this the results of each grep command or better yet all Grep results in a single e-mail?
