diff --git a/SysadminTips.page b/SysadminTips.page index 7082bff..cf92773 100644 --- a/SysadminTips.page +++ b/SysadminTips.page @@ -1,3 +1,9 @@ +WTF is happening? Let's tail all logs. + +``` +# tail -f $(lsof | grep -F .log | tr -s '\t' ' ' | cut -d' ' -f10 | sort | uniq | tr -s '\n' ' ') +``` + Search for suspects POST in apache.log (often attacks). ```{.bash} grep -Eo '"POST .*.php' access.log | grep -ve cron -e login -e admin -e xmlrpc -e trackback -e comment -e 404 | sort -u