logrotate cron awstats apache
vim /etc/logrotate.d/rsyslog
vim /etc/logrotate.conf
/etc/cron.daily/awstats
#!/bin/sh
/usr/share/awstats/tools/update.sh && /usr/share/awstats/tools/buildstatic.sh/etc/logrotate.d/apache2
/var/log/apache2/*.log {
weekly
missingok
rotate 1
compress
delaycompress
notifempty
create 640 root adm
sharedscripts
logcheck
- ai logcheck syslog-summary
- rm /etc/logcheck/logcheck.logfiles.d/syslog.logfiles
vim /etc/logcheck/logcheck.conf
SYSLOGSUMMARY=1ATTACKSUBJECT="Security Alerts"
SECURITYSUBJECT="Security Events"
EVENTSSUBJECT="System Events"journalctl
/etc/systemd/journald.conf
Storage=auto
SystemMaxUse=1G
MaxRetentionSec=1week
ForwardToSyslog=no- sc-restart systemd-journald
- du -sch /var/log/journal
- sc-failed
- omz plugin info systemd
- journalctl -p err -b
netdata
- https://serverfault.com/questions/899364/netdata-ipv4-udp-errors
- ai netdata
- echo "[global]" > /var/lib/netdata/cloud.d/cloud.conf
echo "enabled = no" >> /var/lib/netdata/cloud.d/cloud.conf - chown netdata:netdata /var/lib/netdata/cloud.d/cloud.conf
goaccess
- https://www.digitalocean.com/community/tutorials/how-to-install-and-use-goaccess-web-log-analyzer-on-ubuntu-20-04
- https://kifarunix.com/install-goaccess-on-ubuntu-18-04-debian-10-buster/
- ai fonts-font-awesome goaccess
- ln -s /usr/share/fonts-font-awesome/fonts/
- l /var/www/goaccess
- htpasswd
/etc/goacc
logwatch
- zless /usr/share/doc/logwatch/HOWTO-Customize-LogWatch.gz
- vim /usr/share/logwatch/default.conf/logwatch.conf
- Detail = Med
- logwatch --service http --range today
- vim /etc/cron.daily/00logwatch
- /usr/sbin/logwatch --mailto root
vim ~/.forward
awstats
- https://tecadmin.net/install-awstats-apache-log-analyzer-on-ubuntu/
- cp /usr/share/doc/awstats/examples/apache.conf /etc/apache2/conf-available/awstats.conf
- a2enconf awstats
- a2enmod cgi remoteip
- mkdir /var/lib/awstats/DOMAIN
- chmod go+w /var/lib/awstats/DOMAIN
- vim /etc/awstats/awstats.DOMAIN.conf
- /etc/cron.daily/awstats
/etc/awstats/awstats.DOM.TLD.conf
Include "/etc/awstats/awstats.conf"
Sitlog viewer
- tail -f
- t
- systemctl --failed
- journalctl https://wiki.ubuntuusers.de/systemd/journalctl/
- colortail https://manpages.debian.org/bullseye/colortail/colortail.1.en.html
- multitail https://www.vanheusden.com/multitail/
- awk '{print $9}' /var/log/nginx/access.log | sort | uniq -c | sort -rn
icinga
- https://www.howtoforge.com/how-to-install-icinga-2-monitoring-software-on-debian-12/
- ai -y wget curl nano software-properties-common dirmngr apt-transport-https gnupg2 ca-certificates lsb-release debian-archive-keyring ufw unzip
- ai -y mariadb-server
- mariadb-secure-installation
- ai -y icinga2 monitoring-plugins
- ai -y icinga2-ido-mysql
- vim /etc/icinga2/features-available/ido-mysql.conf
- icinga2 feature list
fail2ban status script
#!/bin/sh
list=$(fail2ban-client status | grep list | cut -d ":" -f2 | tr -d ',')
for i in $list; do
fail2ban-client status $i
done
pflogsum
crontab -e
59 23 * * * /usr/sbin/pflogsumm -d today /var/log/mail.log | mail -s "pflogsum daily Report `date`" log@DOM.TLD
0 1 * * mon /usr/sbin/pflogsumm /var/log/mail.log.1 | mail -s "pflogsum weekly Report `date`" log@DOM.TLD
nginx netdata
server {
server_name netdata.TLD;
add_header Strict-Transport-Security "max-age=7200";
fail2ban statistics
- ai mailutils
- https://www.abuseipdb.com/
- https://www.liveipmap.com/
/etc/cron.monthly/f2b-stat
#!/bin/sh
logging
- ai rsyslog
- timedatectl
- timedatectl set-timezone Europe/Vienna
logrotate cron goaccess nginx
/etc/cron.daily/goaccess
#!/bin/sh
goaccess
chmod +x /etc/cron.daily/goaccess