Apache: Analyze Logs for Malicious Activities & Monitor Server Performance EventTracker v7.6 Publication Date: Feb 12, 2015 EventTracker 8815 Centre Park Drive Columbia MD 21045 www.eventtracker.com
About this Guide: This guide will help the end user in analyzing the logs for malicious activities and will also help them in monitoring the server performance. Scope: The configurations detailed in this guide are consistent with EventTracker Enterprise version 7.6. Audience: The users are those who wish to analyze logs for malicious activities and track the server performance. The information contained in this document represents the current view of Prism Microsystems Inc. on the issues discussed as of the date of publication. Because Prism Microsystems must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Prism Microsystems, and Prism Microsystems cannot guarantee the accuracy of any information presented after the date of publication. This document is for informational purposes only. Prism Microsystems MAKES NO WARRANTIES, EXPRESS OR IMPLIED, AS TO THE INFORMATION IN THIS DOCUMENT. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, this paper may be freely distributed without permission from Prism, as long as its content is unaltered, nothing is added to the content and credit to Prism is provided. Prism Microsystems may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Prism Microsystems, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property. The example companies, organizations, products, people and events depicted herein are fictitious. No association with any real company, organization, product, person or event is intended or should be inferred. 2015 Prism Microsystems Corporation. All rights reserved. The names of actual companies and products mentioned herein may be the trademarks of their respective owners. 1
Table of Contents Introduction: 3 Identifying clues for attack:..4 Spikes visit in a specific duration:..4 Hits with 4xx, 5xx status codes:..5 Same IP address making multiple visits in a short duration:..6 Web Site Attacks Exploiting Software Vulnerabilities:....7 Monitoring Performance:... 7 Monitoring CPU/Memory/Disk usage:..8 Web Traffic Statistics:..8 2
Introduction Detecting an attack that has occurred is a daunting task. One has to go through various logs to arrive at a conclusion. EventTracker provides various statistics in the form of behavior, dashboards and reports to reduce the amount of logs; one has to parse to be able to conclude on an attack. Below are some of the pointers which can lead you to analyze the performance and attacks on Apache webserver. It is not just the attacks but also the performance parameters of the web server, which are important. Hence, it is important to check that the server is performing optimally on memory, disk and CPU wise. It is advised to keep track of low disk, high CPU/high memory usage on the Apache server. 3
Identifying clues of Attack Here are the important areas to lookout, for identifying the malicious or attacks that might be occurring. Some of the indicators mentioned below may require further analysis for identifying source or nature of attack. Some of the indicator may also point out to malfunctioning of web server or programmatic error in the web application hosted on the server. NOTE: The details mentioned in this section would be of great interest to a Security Analyst for identifying attacks and securing the web server from future web attacks. Spikes visit in a specific duration There is usually a pattern or average visit observed on a website. There may be spikes on a website for a short duration occasionally due to a webinar or discount sale, etc. But on many occasions this also could indicate a hacker trying to attack website. Figure: 1 4
The above graph shows a Spike in hit count. What to lookout for? Is the traffic from a single or handful of IP addresses only? If from a single or handful of IP addresses then what is the IP reputation or WHOIS information about the IP address EventTracker helps with: Flex Dashboard with hit count for last 24 hours. On clicking the graph, details of visits during that duration is shown. Behavior with client IP addresses activity which can be used for out of ordinary or with list management. Hits with 4xx, 5xx status codes HTTP Status 200 indicates an OK status regarding the request received to the server. Apart from this code other codes like 3xx, 4xx or 5xx indicate an alert condition Here is the link with list of all status codes and its meaning. http://www.w3schools.com/tags/ref_httpmessages.asp Figure: 2 5
The above graph shows hits with status 403 and some with 404. What to lookout for? A log entry with any of the non 200 status codes doesn t mean an attack condition. But these status codes provide information which may be useful for bringing to the notice of web-admin. Example: Status code 404 means the page/resource is not available at the location. This might mean that users are looking for a specific page on the site. This might be an advertisement link put up by the website owners on some other site but when clicked, throws error. It would be useful to bring these links to the notice of the web-admin for taking corrective actions. A log entry with 5xx error means the server is misconfigured or showing error messages to the users. It would be important to inform the web-admin. EventTracker helps with: Dashboard with count for each status code found in last 24 hours. Clicking on the graph shows the details. A behavior for tracking new and out of ordinary activity for each status code. Same IP address making multiple visits in a short duration As mentioned earlier, any spike in hits count or specific IP address trying to access the page(s) in a website multiple times in a short span of time might be an indicator of attack. Figure: 3 6
The above graph shows two IP addresses having higher hits. What to lookout for? What is the IP reputation or WHOIS information about the IP address? Whether the same IP address was found to have done any other activity on the web server? EventTracker helps with: Flex Dashboard with top 10 client IP address found in last 24 hours. On clicking the graph, details of visits during that duration is shown. Behavior with client IP addresses activity which can be used for out of ordinary or with list management. Web Site Attacks Exploiting Software Vulnerabilities New web-based attack types and vectors are coming out every day; this is worrying the enterprises who are taking extra steps to secure the websites. Below mentioned are some of the common web attacks observed. 1) SQL Injection 2) Cross site Scripting 3) Remote file inclusion 4) JavaScript injection It is difficult to identify the attack by looking at the logs. It requires pattern analysis and keywords detection. EventTracker helps with: Pre-defined Website attack reports for the common attack types identified by OWASP. These reports can be scheduled to be generated on a day-day basis. These reports provide pointers to the attacks. Further analysis needs to be conducted for assessing the attack impact. Monitoring Performance NOTE: The details mentioned in this section would be of great interest to a System Administrator for monitoring the web server s vital parameters memory, CPU usages and in turn making sure the web server is up and performing optimally. 7
Monitoring CPU/Memory/Disk usage Figure: 4 The graph shows trend of remaining disk space for the last 7 days. What to lookout for? Is the Apache server having frequent spikes in CPU usage? Is the memory usage within threshold limits? Are the disk partitions running out of space? EventTracker helps with: Dashboard for monitoring CPU & memory usage within defined threshold. Alerts when low disk space, continuous high CPU & memory usage are observed. Web Traffic Statistics NOTE: The details mentioned under this section would be of great interest to a Website Owner for monitoring the web server s traffic trends and page hits. 8
Apache logs provide a wealth of information when analyzed and correlated. This statistics would be of great help for people who are more concerned about the website traffic and usage and less on security aspect. Some of the common questions raised would be: Are there any 404- File not found errors? Which are the commonly used browsers and their versions? How many are accessing site through Smartphone/Tab? What is the trend of hits count on the site? Figure: 5 Figure: 6 9
Figure: 7 EventTracker helps with: AWStat log analysis report which provides various statistical figures and analytical data like trend observed in the recent days. Flex Dashboard with hit count for last 24 hours. On clicking the graph, details of visits during that duration is shown. A behavior for tracking new and out of ordinary activity of each status code. 10
11