I need a bash script to traverse a filesystem from a server, and look for suspicious activity. This is mainly suspicious activity in the messages log, such as port probing from the same ip address, repeated failed login attempts etc.
Ive managed to traverse the filesystem but could do with a hand on looking for suspicious activity as I am not used to checking server logs.
Any help with the script or how to identify indicators of suspicious activity would be gratefully received.
NOTICE: developerWorks Community will be offline May 29-30, 2015 while we upgrade to the latest version of IBM Connections. For more information, read our upgrade FAQ.
This topic has been locked.
2 replies Latest Post - 2008-03-12T12:34:30Z by SystemAdmin
Pinned topic Bash script for server log (namely var/log/messages)
Answered question This question has been answered.
Unanswered question This question has not been answered yet.
Updated on 2008-03-12T12:34:30Z at 2008-03-12T12:34:30Z by SystemAdmin