Open Source Python Logging Software for Linux

A command line tool that allows you to (live) analyze netfilter (iptables) log files. It provides a nice output and has features like displaying hostnames, duplicate detection... More info (+ screenshots) can be found in the pdf inside the tarball.

Fail2Ban monitors log files like /var/log/pwdfail or /var/log/apache/error_log and bans failure-prone addresses. It updates firewall rules to reject the IP address or executes user defined commands. Please see code and download from https://github.com/fail2ban/fail2ban . SF Fail2ban portal might not be up-to-date

justniffer is a TCP sniffer. It reassembles and reorders packets and displays the tcp flow in a customizable way. It can log network traffic in web server log format. It can also log network services performances (e.g. web server response times) and extract http content (images, html, scripts, etc)

Kojoney is an easy of use, secure, robust and powerfull Honeypot for the SSH Service written in Python. With the kojoney daemon are distributeds other tools such as kip2country (IP to Country) and kojreport, a tool to generate reports from the log fi

The Secure Remote Log Monitor (SRLM) project provides client and server utilities that collect application or system log files from multiple systems over an untrusted network onto a central server for analysis and action.

This project offers a client/server tool to analyze the /var/log/auth.log in order to gather information about the login attempts. The information is sent to a server side where the datas are stored in a sqlite database.

BlueLogger is built using the Python programming language in order to monitor for Bluetooth devices nearby. The application can log the "Time", "Device Name" and "Device Address" of each discovered device.

DPytHOS is a means for administrators of large networks to both monitor and manage the servers under their control. DPytHOS is implemented in python and uses a generic database back-end (with MySQL supported and MS-SQL 2000 supported via XML)

Insidias is a next-generation intrusion detection engine, with a focus on speed, efficiency, advanced pattern matching, parallel-processing, modularity, and expandability.

Kismon is a PyGTK based Kismet Newcore (since 2009-05-RC1) Client with a live map of the networks.

Loganalyzer for Windows XP Firewall and Linux Iptables firewall. Generates a nice html document with statistics from all the pakets captured by the firewall. The program is written in Python and has an (optional) graphical interface.

Nuhe is a log monitoring system, which is capable of alarm generation and action when rules are matched against log(s) activity.

Nuhe Client is a project related to the Nuhe Action Capable Log Monitor. This GUI client simplifies the administration of sensors and node managers, making it easier to control and monitor the network. Comes with a rule editor as well as a log monitor.

An ARP watch daemon for windows (portable to linux but it is already there...) which is able to be run as a service and logs to eventlog so one can collect the logs and react to events.

Retrieve statistics from SNMP-aware devices, store them in a database and graphically display them for monitoring and notification purposes.

PotHead What is it? Pothead: A simple lightweight packet for creating a minimal interaction honeypot How does it work? Magic, Well kinda you don’t need super dupper knowledge to use this! Oops the magic failed ;) a really nice INSTALL.md will be written unfortunately it’s not yet available. 1) Download all the files 2) Check if you got everything 3) Upload and configure the Website and backend (includes/Config.php & the .SQL files) 4) Do not forget to change your APIKEY! 5) Run the python file! Pothead.py -pp 22 23 -site http://YOURSITE.COM/api/write.php -apikey YOURAPIKEY 6) Profit! Is this for anyone? Hmmmm, yes and no I would suggest you know a thing or two about PHP & Python. It’s a pre-release and still in the early alpha stage. Is it safe? It’s pretty safe ;) Does it work? Yeah check it live! http://7ol.eu/view.php

PyIDS is an intrusion detection system whose aim is to provide concise information to administrators about some parts of the system i.e filesystem checksums, unknown connections to the machine, access control lists of special files, log revision...

Open Source system and network monitoring application for desktop Linux user. It gives end-user broader view of what happening on their system. The basic idea is give linux user application that can monitor system like many commercial antivirus HIDS.

RRFiller provides an easy-to-use solution for logging statistics into an RRDTool database. Designed to complement RRGrapher, the project also provides configurations for creation and updating RRD databases using standard tools like vmstat and netstat.

Shadow Watcher is a Peer to Peer log sharing tool for the security analyst. Consider it a "community watch" program which allows you to keep your system secure from the threats on the internet and help others do the same.

Snort IDS library for Python

Syslog Collector listen for syslog messages and parse them following some regular expressions. It then increment some counters which are exposed through SNMP Agent-X interface

VScan is a small, text-based, platform independent port scanner written in python, which supports multithreading and banner grabbing.

Originally written by Paul Vixie in 1986 and distributed through mod.sources, "display" is a program which will repeatedly execute a command and display the output through curses. The purpose of this project is to maintain and extend display.

fwgraph is an attempt to characterize and present network traffic including network devices, QoS, and iptables under Linux.