[Intruder alert] Log analyzer?

[ayu]

I might have had an unwanted guest on my server, not sure yet, but it's possible.
So what I'm asking is if anyone know of a really good cli log analyzer.
I have one already that I use, but it's not installed on this server, and comes with a complete system that I really don't want right now.

I have done all the usual checkups, basically checked for things I would have done myself when breaking in somewhere xF

This includes, but not limited to;

* Checked all virtual sites for php shells
* Did a quick code review on my own code for vulnerabilities (none found, of course not, what do you take me for?)
* Scanned the whole server with ClamAV CLI for potential known threats
* Checked all running processes, nothing strange found
* Scanned for rootkits, nothing found
* Checked netstat for anything strange, nothing out of the ordinary
* Checked for updates (no problems there, I update the same day as there are any, Debian, stable updates etc)
* Checked installed web applications for known vulnerabilities, some were found actually (forgot to update roundcube and mediawiki for a while)


I guess it comes down to roundcube or mediawiki.
There was a critical vuln in my roundcube install, but it needed an account to exploit.
I did check the roundcube install anyway if the exploit had been used (it alters the config-file), but it had not been used.

I keep no super important stuff on that server, so it's not the whole world.
It's mostly about my pride

If someone did take a peek inside my server, they need to be rolled down a hill in a barrel filled with spikes

Any other advice is welcome, stuff that I have forgotten to check etc.

PS: roundcube and mediawike have been updated to the latest versions.

[bad_brain]

hm, I don't know, such log analysers are good for simple monitoring but not really for incident response..at least imo...the best is still the good old manual log analysis.
I know, can be quite some work, especially when you not narrow down the incident to a specific day or time, but when you filter the logs it makes it much easier.

for example: filter and pipe all lines with POST requests from the apache logs, then filter the known IPs (like your own and customers). next auth- and syslog, bash history and lastlog. very interesting would also be the mail log, just to see if maybe a spam script sent/sends out mail (just look for bounces), for that you could/should also check the deferred queue (assuming you use postfix, no idea where it's located or how it is named in exim).

[ayu]

Thanks b_b, I will have another look tomorrow.
Spent the evening going through logs, but it appears to be safe.

I will subscribe to updates for the applications that I use on the server, and make sure to always update it right away from now on ^^

I used to have loads of RSS feeds with that kind of stuff, but after a while it became unmanageable with all the feeds xD

[bad_brain]

yeah, that's why I focus on a few different platforms, best with onboard update management like Wordpress for example. I used to utilize RSS feeds too for a while, but it became more work to filter out the interesting entries than logging in and check for available updates manually...

if you need any help let me know...