First of all, we should be clear that log files not only help us trace the origin of an intruder and find their attack path — in normal operations and maintenance, logs can also reveal many security attacks.
A simple, easy-to-use web log analysis tool can greatly improve efficiency. There are many log analysis tools on the market today. Here we recommend ten easy-to-use web log security analysis tools.
- 360 Starmap (360星图)
A very easy-to-use website access log analysis tool that can effectively identify web vulnerability attacks, CC attacks, malicious crawler scans, abnormal access and other behaviors. One-click automatic analysis outputs a security analysis report, supports iis / apache / nginx logs, and supports custom formats.
- LogForensics
A log analysis tool provided by TSRC that can start from a single suspicious clue and traverse all suspicious URLs (CGI) and source IPs.
- GoAccess
A visual web log analysis tool, accessible through a web browser or a terminal program on *nix systems. It provides system administrators with fast and valuable HTTP statistics, presented as an online visual server.
- AWStats
A powerful open-source log analysis system that can graphically generate advanced statistics for web, streaming media, ftp or mail servers.
- Logstalgia
A very cool visual log analysis tool that can intuitively display CC attacks and website log analysis, presenting it with a visual 3D effect.
- FinderWeb
A tool for programmers to monitor logs, supporting tail, less, grep, and large text files. Log files ranging from a few MB to tens of GB are handled smoothly, and it’s free.
- web-log-parser
An open-source web log analysis tool developed in Python, with flexible log format configuration.
- ELK
The ELK platform for open-source real-time log analysis consists of three open-source projects: ElasticSearch, Logstash and Kiabana. It is very common in enterprise-level log management platforms.
- Splunk
A top-tier log analysis tool. If you often use grep, awk, sed, sort, uniq, tail, head to analyze logs, you can transition to Splunk easily.
- IBM QRadar
Qradar has a free community edition whose features are not much different from the commercial version, suitable for small-scale log and traffic analysis.
Article source: WooYun Security (乌云安全)
