#acess log

What should I have to check? First of all I wanted to check the IP numbers that accessed my server. So, I found the apache access log file and I used the following commands:

grep '08/Nov/2011:06' /var/log/apache2/access.log | cut -f 2 -s --delimiter=" " | awk ' {print $1 }' | sort | uniq -c | sort -n

The above command gave me the opportunity to see which IPs and how many times accessed my server at the 8th of November from 6:00:59 until 6:59:59 in the morning. Really usefull.

You can change the hour and date in the grep command. Also, have in mind that you have to insert the path and filename of your access log file.

Unortunately, I don't have enabled the binary logs on my MySQL server installation, and this prevents me to see what exactly queries run that time at the webisites. I could although guess that by changing a little bit the above commands with the following:

grep '08/Nov/2011:06' /var/log/apache2/access.log | grep '1.2.3.4' | cut -f 1 -s --delimiter=" " | awk ' {print $0}' | sort | uniq -c | sort -n

With the above command you can find the domains that the suspected IP visited in a specific date and time.

You can also use the following commands to see which pages of the domains this IP visited. 

grep '08/Nov/2011:06' /var/log/apache2/access.log | grep '1.2.3.4' | cut -f 8 -s --delimiter=" " | awk ' {print $0}' | sort | uniq -c | sort -n

If you conclude that the suspected IP might be an abuse attack, use the following command to find more information.

whois 1.2.3.4