Log file of all domain traffic ?

[dubres]

Hello,

please help me, my server was attacked.

where can i find the traffic log file of all domains in ssh mode ?

i need to view the traffic usage of all my domains in one place, not the details like in /var/www/vhosts/domain.com/statistics/logs/access_log but in general view ?

Thank you

 

[dpineda]

Hi,
We use this scritp:
log_domain.sh
******************************
#!/bin/sh

RUTA="/var/www/vhosts/"
DOMINIO=DOMAIN
LOG="/statistics/logs/"
LOG_ACCESOS=access_log
LOG_ERROR=error_log
LOG_FTP=xferlog_regular

`ls /var/www/vhosts/ > domain.txt`
DOM_COUNT=`cat domain.txt | wc -l`
echo "Hay $DOM_COUNT dominios en total"

echo "Que deseas buscar?"

select LOG_CHOICE in ACCESOS ERRORES FTP SALIR

do
case $LOG_CHOICE in

ACCESOS) LOG_CHOICE=$LOG_ACCESOS;;
ERRORES) LOG_CHOICE=$LOG_ERROR;;
FTP) LOG_CHOICE=$LOG_FTP;;
SALIR) exit ;;
*) echo "Debe elegir una opcion";;
esac

while read DOMINIO
do

echo -e "LOG $LOG_CHOICE DE DOMINIO $DOMINIO\n\n" | tr "[:lower:]" "[:upper:]"
# tail -50 $RUTA$DOMINIO$LOG$LOG_CHOICE |more
cat $RUTA$DOMINIO$LOG$LOG_CHOICE

done < domain.txt

done

******************************

how to use:

./log_domain.sh | grep "word_to_mach" | less

****


David.

 

[dpineda]

Other possible:
cat /usr/local/psa/var/log/maillog | grep -o 'to=.*@.*' | sed 's/to=.*@//' | sort | uniq -c | sort -rn | head

This lines indicate most traffic SMTP IN/OUT.

 

[dpineda]

insmtp.sh

****************

# VARIABLES
DATE=`date | cut -c 5-10`

echo $DATE

cat /var/log/messages | grep "$DATE"|grep from |grep xinetd| awk '{print $9}'|sort|uniq -c |sort -n | tail -25
****************

This locate ip.