show users that are sending email:
mail /var/log# grep authid= /var/log/maillog | awk -F “]” ‘{print$3}’ | awk -F , ‘{print$2}’ | tr -d ” ” | sort | uniq -c | sort -rn
show what IP addresses are sending email:
mail /var/log# grep authid= /var/log/maillog | awk -F “]” ‘{print$2}’ | awk -F “[” ‘{print$2}’ | tr -d ” ” | sort | uniq -c | sort -rn
If you have a server that is not responding, there might be an attack on one of the domains. You can get a good idea if a normally low volume website is suddenly getting lots of traffic by running a few checks on the log files.
Count the number of posts to each unique file:
# grep POST /usr/local/apache2/logs/USER/DOMAIN-accesslog | awk ‘{print $7}’ | sort | uniq -c | sort -n
Count the number of times each IP posted to the domain:
# grep POST /usr/local/apache2/logs/USER/DOMAIN-accesslog | awk ‘{print $1}’ | sort | uniq -c | sort -n
Count the number of unique IP addresses that posted to the domain:
# grep POST /usr/local/apache2/logs/USER/DOMAIN-access_log | awk ‘{print $1}’ | sort | uniq | wc -l