Open Source PHP Log Analysis Software for Linux

OSSIM, AlienVault’s Open Source Security Information and Event Management (SIEM) product, provides event collection, normalization and correlation. For more advanced functionality, AlienVault Unified Security Management (USM) builds on OSSIM with these additional capabilities: * Log management * Advanced threat detection with a continuously updated library of pre-built correlation rules * Actionable threat intelligence updates from AlienVault Labs Security Research Team * Rich analytics dashboards and data visualization

Screen squid is web-based interface for viewing reports based on Squid proxy server log files. It can be accessed from web-browser through more than 50 reports. No extra files, only DB. All reports generated "on-the-fly". And we got personal cabinet for each user/group.

HoneyVIew ist a tool to analyze honeyd-logfiles of the honeyd-daemon implemented by Niels Provos in an convenient way. HoneyView generates graphical and textual results from queries against the logfile data.

MySQL Squid Access Report

AutoIndex is a PHP script that makes a table that lists the files in a directory, and lets users access the files and subdirectories. It includes searching, icons for each file type, an admin panel, uploads, access logging, file descriptions, and more.

ClickHeat is a visual heatmap of clicks on a HTML page, showing hot and cold click zones. Requires Javascript on the client to track clicks, PHP and GD on the server to log clicks and generate the heatmap. You should download it on Github where the project has moved: https://github.com/dugwood/clickheat

SIGOF (Security Information Graphics Oriented Forensic) aims at synthetizing security log, stored in a acid/base database schema, in order to provide a graphical / visual oriented security forensic and statistical analysis.

SRG is a log file analyser and report generator for the Squid web proxy. It is fast and was created to allow easy integration with other authentication systems. SRG is flexible and can report right down the the level of individual files requested.

SqStat is a script which allows to look through active squid users connections. It use cachemgr protocol to get information from squid proxy server.

SNĒZ is a web interface to the popular open source IDS programs SNORT® and Suricata. IDS output can be unified2 or JSON formats. The main design feature of SNĒZ is the ability to filter alerts based on criteria set by, and documented by, a security analyst. Alerts are viewed and summarized in different ways, filtered, and documented until ideally no alerts remain. At any time, filters can be suppressed so that all collected alerts can be analyzed for patterns, forensics, etc. Filters can also be used to hide noisy alerts without deleting them or suppressing them at the IDS. An effective strategy for dealing with noisy alerts can be achieved by combining alert thresholding at the IDS and filtering in SNEZ. SNORT® is a registered trademark of Sourcefire, Inc. All rights reserved.

BetterAWStats is made to provide better statistics out of the data AWStats provides. It is not a replacement of AWStats. It is using all data and language resources from AWStats, so the same translations and general features are always available also in

my-swatch pretends to be an implementation of msyslog and swatch together. What it pretends to accomplish is put all together, to log events to a remote database (like msyslog) and to awake triggers (like swatch).

readlog is a pair of scripts for reviewing iptables firewall logs via a handy web interface using a MySQL backend.

NOTE: This project is no longer under active developement. Check out the successor at: https://github.com/jensvoid/lorg Web Forensik ist a script that uses PHPIDS to automatically scan your HTTPD logfiles for attacks against web applications. Check the Wiki for installation, configuration, usage.

Apache Hourly Stats starts like an excesively simple PHP script which generates an HTML report from an Apache access_log file. The statistics it provides are mainly unique IP adresses per hour and per day. I didn't find existing log analyzers which provi

IP2Location C library enables the user to find the country, region, city, coordinates, zip code, time zone, ISP, domain name, connection type, area code, weather, MCC, MNC, mobile brand name, elevation and usage type that any IP address or hostname originates from. It has been optimized for speed and memory utilization. Developers can use the API to query all IP2Location™ binary databases for applications written in C or supporting static/dynamic library.

A PHP script for parsing MRTG log files and displaying network traffic statistics. It can display total traffic, avg. rate, peak time and rate over a selectable period of time. We wish to later support RRD tool and maybe even more log formats.

FreeBSD Forensics Bootable ISO

A PHP script to submit .scrobbler.log/.scrobbler-timeless.log files made by DAPs (Rockbox only at the moment) via the audioscrobbler servers to the Last.fm music blogging site.

Application to display, as well as interpret, firewall information from a database to serve a variety of users needs. The application is online and cross-platform, written using PHP.

AVirCAP is a system for manual and / or automated detection of CodeRed and Nimda type of hack attempts and virtually all other kinds of "logable" intrusion attempts. It can work stand alone or together with other additional AVirCAP machines in the LAN/W

PHP addon for AWSTATS to allow viewing of statistics for multiple domains on a single dynamic page

AWStats Enterprise Manager is a tool for managing awstats configuration creation and logfile processing, in a multi-server environment. This script is designed to pull all the webserver logs, for every server, and parse them with awstats.

A simple PHP addon for AWStats which allows viewing and comparing statistics for multiple domain hosted in the same machine.

AccounteX is an IP accounting system based on the IP Stat program. It has many exciting features like fully customizable web traffic accounting and user access control by many different values. information service and web statistics and administration.