Posts Tagged plesk

Shell Commands for HTTP access log

Nov 20

Posted by Dale in Computer Stuff | 1 Comment

I had to do some anayalsis of a clients site and verify if it was actually as popular as the data usage and web statistics said it was. Bellow are some of the shell commands that I have used to analyze the access log on the server the site was hosted on:

Unique IP’s and amount of entries in access_log:
======================================
cat <path to log file> | awk ‘{print $1}’ | sort -n | uniq -c

Amount of unique IP’s:
===================
cat <path to log file> | awk ‘{print $1}’ | sort -n | uniq -c | wc -l

Amount of Bytes of data from files logged.
=================================
cat <path to log file> | awk ‘{sum+=$10}END{print sum}’

Unique files and the amount of times accessed
====================================
cat <path to log file> | awk ‘{print $7}’ | sort | uniq -c | sort -n -r

Unique files and there size in bytes
============================
cat <path to log file> | awk ‘{print $10, $7}’ | sort -n -r

Tags: , , , , , ,

Plesk: How to count SMTP connections per email account.

Jun 25

Posted by Dale in Computer Stuff | No Comments

Found an interesting solution for users of plesk/qmail for how to identify a user who is abusing your authenticated SMTP service.

Running the command:

cat /var/log/messages | grep -i smtp_auth | grep "logged in" | awk {' print $11 '} | awk -F / {' print $6"@"$5 '} | sort | uniq -c | sort -n | tail

or:

cat /var/log/syslog | grep -i smtp_auth | grep "logged in" | awk {' print $11 '} | awk -F / {' print $6"@"$5 '} | sort | uniq -c | sort -n | tail

Depending on your Linux Distro and you will get an output like the example bellow:

7 user@example.com
7 someone@spamewhere.net.au
8 stuff@onthenet.com.au
8919 user@crackeddomain.com.au

As you can see the account ‘user’ for the domain ‘crackeddomain.com.au’ are having unusually high amounts of SMTP connections for an account.

This is useful for tracking bulk email being sent through your system or hijacked accounts being used by spammers.

I found this on rackerhacker.com a site by Senior Rackspace Systems Engineer Major Hayden, go and check it out it is full of awesome content.

Tags: , , , , , ,