Billy's Blog of Geekery

I was recently the subject of a hacker, it used my servers to send spam emails via a web-script. To find the script I had to check out my server logs. Turns out that this is a bit of a pain to do. I decided to write a wee script to read them and display the contents for me online. A web-page that fills a table with the details.

Sounds simple right?

Well it *is*… kinda. There are a number of issues with this.

1. The log file is huge
2. Apache isn’t allowed to read it
3. The log files rotate

…being the main ones. So this is how we handle that…

Firstly we don’t read the whole file, we choose how many calls we want to return (I found 500 to be adequate for my needs). To get this I decided to use the linux/unix tail command rather than any file handling stuff within PHP.
Secondly we alter permissions on the log file. Finding the log itself might be a bit problematic but on mine the log files are found in the /var/log/apache2/ directory. The file needing it’s permissions changed is other_vhosts_access.log on my installation, using the command:
sudo chmod 0644 /var/log/apache2/other_vhosts_access.log
should sort that out. Doing a ls -l on the /var/log/apache2/ directory should show it as having -rw-r–r– privileges (owner read/write, group read, others read)
The log rotation may not happen on your installation but I didn’t bother to address this on mine. Once it’s rotated I just redo that permissions change for the “new” log file to re-enable reading of it.

Here’s the script…

<?php
$me = $_SERVER['REMOTE_ADDR'];
$self = $_SERVER['SERVER_ADDR'];
$output = shell_exec('tail /var/log/apache2/other_vhosts_access.log -n 500');
$stuff = explode("
",$output);
array_pop($stuff);
?>
<title>Apache Logs</title>
<style>
html {
    font-family:monospace;
}
.tbl {
        table-layout:fixed;
        border-top: 5px solid #333;
        border-collapse: collapse;
        background: #fff;
        width:100%;
         }
.tbl td {
        border-bottom: 1px dashed #333;
        padding: 2px 5px;
        text-overflow:ellipsis;
        overflow:hidden;
        white-space:nowrap;
 }
 </style>
Visits from your current IP (<?=$me?>) are highlighted in <span style="background:yellow;">yellow</span><br/>
Attempts to POST data (from other IPs) are highlighted in <span style="background:pink;">pink</span><br/>
Jobs run from the server itself are <span style="background:silver;color:grey;">greyed out</span><br/>
Showing the last <strong><?=count($stuff)?></strong> site hits.
<pre><?php// echo $output ?></pre>
<table class="tbl" border="1" style='font-family:sans-serif;'>
    <tr>
        <th width="150px">Domain</th>
        <th width="150px">IP</th>
        <th width="200px">Date</th>
        <th>Request</th>
        <th>UserAgent</th>
    </tr>
<?
    foreach($stuff as $line) {
        $linearray = explode(" ", $line);
        $array2 = explode('"', $line);
        $domain = $linearray[0];
        $ip = $linearray[1];
        $date = $linearray[4].$linearray[5];
        $request = $array2[1];
        $useragent = $array2[5];
        //var_dump($linearray);
        //var_dump($array2);
        $style = "";
        if ($ip == $me) $style = " style='background:yellow;'";
        elseif ($ip == $self) $style = " style='color:grey;background:silver;'";
        elseif ($linearray[6] == '"POST') $style = " style='background:pink;'";
        ?>
    <tr<?=$style?>>
        <td><?=$domain?></td>
        <td><?=$ip?></td>
        <td><?=$date?></td>
        <td><?=$request?></td>
        <td><?=$useragent?></td>
    </tr>
        <?
    }
?>
</table>

Which gives me output something like (click for bigger)…

Occasionally I’ll navigate to this file and it’ll be empty, saying it’s showing 0 site hits. This is after the logs have been rotated and I need to re-do the chmod command above. There’s no way I can see to script this, perhaps a cron job for root… That’s not a big enough issue for me to worry about. For my needs this works fine.