From 5e406b23456d60acf84cca386f6ba82792ef5908 Mon Sep 17 00:00:00 2001 From: benoit Date: Thu, 14 Jan 2016 14:25:15 +0100 Subject: [PATCH] Add: WTF is happening? Let's tail all logs. --- SysadminTips.page | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/SysadminTips.page b/SysadminTips.page index 7082bff..cf92773 100644 --- a/SysadminTips.page +++ b/SysadminTips.page @@ -1,3 +1,9 @@ +WTF is happening? Let's tail all logs. + +``` +# tail -f $(lsof | grep -F .log | tr -s '\t' ' ' | cut -d' ' -f10 | sort | uniq | tr -s '\n' ' ') +``` + Search for suspects POST in apache.log (often attacks). ```{.bash} grep -Eo '"POST .*.php' access.log | grep -ve cron -e login -e admin -e xmlrpc -e trackback -e comment -e 404 | sort -u