Read a web server's access log
Run a local web server, browse it yourself (including a few pages that don't exist), then read the access log to pick out status codes, clients and unusual requests.
Environment
Docker on your own PC, with the server bound to 127.0.0.1.
Before you start
- Read Web Server Logs (p.368), URL Analysis (p.367) and Application and Endpoint Logs (p.319).
You will
- Read the combined log format
- Filter by status code
- Spot patterns worth investigating
Steps
-
1
Start a server:
docker run -d --name logs -p 127.0.0.1:8084:80 nginx:alpine. -
2
In your browser, open http://127.0.0.1:8084 a few times, then some pages that don't exist such as
/admin,/backup.zipand/old/login. -
3
Also request it once from the terminal:
curl http://127.0.0.1:8084/. -
4
Read the log:
docker logs logs. For one line, identify the client IP, timestamp, method, path, status code, size and user agent. -
5
Show only the errors:
docker logs logs 2>&1 | grep '" 404 '. -
6
Compare the browser's user agent with curl's.
-
7
Write down what a real analyst would find suspicious: many 404s from one address probing for admin pages or backup files is a common sign of automated reconnaissance.
-
8
Clean up:
docker rm -f logs.
Check your understanding
- ?What does a burst of 404s for
/admin,/backup.zipand similar paths suggest? - ?Why can't you fully trust the user agent string?
- ?Which other log would you correlate this with to see what the same address did next?