Group: Forum Members
Posts: 1,
Visits: 14
|
Hello folks - I host e-commerce sites and have to deal with researching hacking events.
My typical strategy is to paste the IIS server logs into a Word document, then I use a series of macros. I remove all references to objects (images, .css, .js, etc.) from the document. This way I am left with only the calls to specific files. Once I have the log entries narrowed down, I use another macro to summarize the top IPs that visited the site. Then I use another macro to facilitate limiting copies of those logs to the traffic based on selected IPs. I'm able to scroll through those documents in order to look for mischief.
A set of logs that I am currently dealing with are large enough that it's become a challenge, in that the files are large enough to bog down the process such that it takes forever. So I'm looking for more efficient means of tackling this task.
I discovered this tool yesterday, and have not seen a means of producing the sort of summary that I am posting below. Can the tool be used to isolate all of the IPs, and tell me how many hits on pages that IP was responsible for? Thanks.
13.74.149.232 1114 40.84.18.217 832 52.169.180.58 467 192.42.116.192 444 52.178.210.189 411 52.169.183.46 377 52.169.5.45 377 52.169.180.88 377 52.169.88.234 377
|