Worm Report 1.2 by Robert S. Muhlestein (http://freshmeat.net/users/rmuhlestein/) Friday, September 21st 2001 09:54 Categories: Internet :: WWW/HTTP, Internet :: WWW/HTTP :: HTTP Servers, Internet :: WWW/HTTP :: Site Management, Security, System :: Logging, System :: Monitoring, System :: Systems Administration, Utilities About: Worm Report is a very simple Perl script to filter out the known worm hits from the access log, and put them into their own files named for the IP/Host that has been "wormed". A basic report containing the count, hostname, ip, and a guess at the parent domain is then printed to STDOUT to facilitate contacting these individuals. This script is useful in the short term to get the info to the people who need it. Adding a new worm requires adding a new worm hit string to the DATA section of the script, nothing so fancy (or exhaustive) as an Apache module. Changes: This release contains a fix for a bug, affecting older Perl interpreters, where a mask is required for the mkdir command. It also more tightly checks the DATA section to safegaurd against the inclusion of blank lines, which would otherwise cause every log entry to be matched. License: Public Domain URL: http://freshmeat.net/projects/wormreport/ -- Elias Levy SecurityFocus http://www.securityfocus.com/ Si vis pacem, para bellum
This archive was generated by hypermail 2b30 : Mon Oct 01 2001 - 16:46:57 PDT