log-reader
A log file answers questions nobody has time to ask it. Drop one here and get the short version: who tried to get in and whether it worked, what the scanners found, when the errors started, and which message repeats ten thousand times. It reads web server access logs and syslog-style logs. The file is read by your browser and never uploaded.
which logs, and where they are
| Log | Where | Notes |
|---|---|---|
| nginx access log | /var/log/nginx/access.log | The default "combined" format. Older days are in access.log.1 and compressed files: zcat access.log.*.gz. |
| Apache access log | /var/log/apache2/access.log or /var/log/httpd/access_log | Common and combined format, with or without the virtual host in front. |
| Logins on Debian and Ubuntu | /var/log/auth.log | SSH, sudo, account changes. |
| Logins on RHEL, Rocky, Alma | /var/log/secure | The same content under another name. |
| System log | /var/log/syslog or /var/log/messages | Kernel, services, cron. |
| Systems with only the journal | journalctl --since "2 days ago" -o short > journal.txt | For SSH only: journalctl -u ssh -o short. |
| A NAS, a firewall, a router | Export from its web interface | Works if the lines look like syslog: date, host, program, message. |
what it looks for
| In | Finding | Severity |
|---|---|---|
| Logins | An address that failed several times and then got in with a password. | critical |
| Logins | root logging in by password. sudo refused for an account. | high |
| Logins | Accounts created or passwords changed. Password guessing, by address and by name tried. | medium, info |
| Web | Requests for files like .env or .git that were answered with 200. | high |
| Web | Attack patterns in the address: SQL injection, path traversal, script injection, Log4Shell, command injection. | high or medium |
| Web | Twenty or more login POSTs from one address to one form. | high |
| Web | Server errors: more than 5% overall, or a burst in a short window. | high or medium |
| Web | One address with a third of the traffic. Scanners. Share of automated clients. | medium, info |
| System | Out-of-memory kills, disk I/O errors, file system errors, disk full. | high |
| System | Crashing programs, hanging tasks, network link down, overheating, failed services. | medium |
| System | The same error message repeating, grouped with numbers and addresses removed. | info |
The page matches known patterns. It does not know your application, cannot tell an admin's typo from an attack, and sees only what this one file contains: an attacker who got in may have deleted the lines. Times are shown in UTC. Syslog lines without a year are assumed to be from the last twelve months. Addresses in logs are personal data in many jurisdictions: the analysis stays in your browser, but think before you paste results into a ticket. Related: nginx and Apache cheat sheet, systemd and journalctl, the Linux server is slow, incident runbook, log file locations.