Free iis log files software for linux

IPTables log analizer displays Linux 2.4 iptables logs (rejected, acepted, masqueraded packets...) in a nice HTML page (it support rough netfilter logs but also Shorewall and Suse Firewall logs).

This page shall be easy to read and understand to reduce the manual analysis time.

This page containts statistics on packets and links to more detailled information on a given host, port, domain and so on.

To convice you, here is a typical syslog entry for iptables :

[IPTABLES DROP] : IN=ppp0 OUT= MAC= SRC=172.186.2.157 DST=193.253.186.217 LEN=36 TOS=0x00 PREC=0x00 TTL=115 ID=4775 PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=3663

How does it work ?

A small deamon is launched by a user which can read iptables logs files. Each time a new packet is logged, the daemon insert a new row in the database.

The statistics and so on are elaborated by the PHP page itself.

Libflog is a simple file based event logger. libflog is customizable and easy to integrate with any C or C++ application. The library allows an application to define an unlimited number of log streams, each with its own time satmping and prefix settings.

Each log stream can be directed to a different file, or it can be redirected to standard console output (stdout, stderr). The library supports transparent log file compression, provided you have a shared version of zlib installed on your system: all you have to do is append a ".gz" suffix to the log file name.

Writing to a log stream is as easy as using the printf function. The library hides duplicated messages, replacing them with the repeat count. It is thread safe and includes the code for serializing calls from different threads, you dont need to care about it.

The library is developed as an attempt to minimize code replication and centralize bug tracking for a number of projects that Im working on. If someone is willing to use the library, they may do so.

loggerfs is the virtual file system that allows you to store logs in a database. I just released the first version of it (checkout the News) and will now be focusing on supporting more logging formats. If you dont yet know what loggerfs is, then heres a simple explanation for when you need it:

- Are you running cron scripts periodically to parse log files and put them in a database?
- Do you need to store log files remotely because you have limited space?
- Would you like a more efficient solution than simply polling the log files and waiting for new data?

If you answer yes to any of the above questions, please take a look at loggerfs. It will allow you to create virtual files to which you can then direct syslog/ apache/ squid/ etc. to log to. For example, instead of having syslog store authentication information in /var/log/auth.log, you could create a virtual file in /var/loggerfs/auth.log and then tell syslog to log to that file. Now instead of storing the information in the auth.log file, the data is actually sent to a database server that you defined in the logs.xml file. Every time new information is sent to the file, it is immediately sent to the database server, which means that:

- It doesnt poll for information, it listens, which makes it a lot more efficient.
- It automatically creates the tables in the database and makes sure that all the information can be stored.
- Youll be able to easily sort/ analyze the log files once theyre in the database.

I encourage you to checkout the CVS on the sourceforge project page, and let me know if you have any questions/ problems/ suggestions.

logviewer is a GUI application for easy management of log files. It features page layout configuration, text filtering and date-time filtering for a logs name and for its pages, a date-time format variable, page selection and saving, and configurable file patterns and directories to analyze.
Main features:
- selection of configuration file on starting
- automatic load from configuration file of files list to show
- search configuration: files to show, directories to search files and files patterns to find (*.log, *log*.txt...)
- layout of showing files (show on pages)
- page configuration: number of characters per line and number of lines per page
- files list filtering based on "date-time from/date-time to" filters or text pattern filter
- pages-lines filtering based on "date-time from/date-time to" filters or text pattern filter
- date-time format configuration: standard sequence yyyymmddhhmmss, but with variables separators
- saving filtered or selected pages to new file
Installation
The installation is standard:
Source version:
- copy and decompression of package .tar.gz to installation directory
- ./configure
- make
- logviewer executable are created in src directory
(installation subdirectory)
Binary version:
- copy and decompression of package .tar.gz to installation directory
- decompressed file logviewer is the executable

Nmap Log Stripp3r program is intended to be a way to condense all, or some, of the IPs of a "random" nmap scan into a file for later usage.

Common uses are to be able to feed the file back into nmap with the -iL switch, or feeding it into another port or vulnerability scanner of your choice.

Stripp3r supports stripping the nmap log of all but the IPs of hosts running a certain service, a version of a service, or even an arbitrary banner, and writing them to a file.

This is intended to be a way to condense all the IPs of a "random" Nmap scan into a file for later useage. Common uses are to be able to feed the file back into Nmap its self with the -iL switch, or feeding it into another port or vulnerability scanner.

Useage: ./stripp3r < logfile > < output > "< version string >" -v

Pretty simple. First, you must run an Nmap scan, on random hosts.

Ex. nmap -p 80 -sV -v -iR 500000 -oN nmaplogfile.nmap

This will tell nmap to do a scan service scan of 500,000 random IP addresses for the port 80, vobosely, and save the log to a file named nmaplogfile.nmap. You can change this around, eg, scanning a different service port (if say, you were looking for computers running FTP, you would scan for port 21 instead of 80 for HTTP), scanning a different number of hosts (500,000 or so is good, takes a few hours ususally though), or saving the log file to a different filename.

Nmap will then save a list of hosts that were "up" to a log file, with some informaiton about them, specifically weather the port that you specified was open, closed, or filtered. We are interested in "open" ports, so by default, Stripp3r will take all the log
enteries that have the port your specified listed as "open" and condense them into a file, listing only the IPs, one on each line.

Ex. ./stripp3r nmaplogfile.nmap output.ips

You can be more specific, and have Stripp3r put only the IPs that are running a certain service in the output file. The service string will only register the strings matching EXACTLY, so be careful to get the case and such correct.

apache httpd 1.3.27 (wont work)
Apache 1.3.27 (wont work)
Apache httpd 1.3.27 (works!)

Ex. ./stripp3r nmaplogfile.nmap output.ips "Apache httpd 1.3.27"

If you want to try it with verbosity, say

Ex. ./stripp3r nmaplogfile.nmap output.ips "Apache httpd 1.3.27" -v

And stripp3r will print out what it finds, along with writing it to the file.

You may change, copy, and reproduce this file, as long as the author is given credit for the initial writing of the code.

Log::StdLog is a Perl module with a simple log file via a special filehandle.

SYNOPSIS

use Log::StdLog { level => warn, file => "$0.log" };

# Messages at the same or a higher level are logged...
print {*STDLOG} error => "This error message will be loggedn";
print {*STDLOG} warn => "This warning message will be loggedn";

# Messages at a lower level are ignored...
print {*STDLOG} info => "This info message will NOT be loggedn";

# The default message level is the one that was specified
# when the module was loaded...

print {*STDLOG} "This is a warning message. It will be loggedn";

This module provides a very simple kind of log file, with a very simple interface. Messages are logged simply by printing to *STDLOG, which the module exports to any namespace into which its loaded.

tichulog-ng is an application to view a previously played tichu game from a log file. It aims to be better than the tichulog tool available at http://tichu-gilde.bsw-portal.de/logs/.

tichulog-ng allows the user to view a logged game with open cards as if one would play the game by itself.

Usage:

unzip tichulog-ng.zip
java -jar tichulog-ng.jar
select the right logfile (*.tch)
Take cup of coffee (depends on the round size in the logfile)