由 turbo123 在 11-08-2002 10:40 发表:
请问各位,了解linux服务器的安全状况,应该从那些日志文件入手?有没有比较直观的工具?
怎样知道是否有人企图攻击服务器?
怎样指导是否有人攻击成功?
从那些文件可以看出来?
有什么比较直观的工具来分析吗?谢谢!
由 turbo123 在 11-08-2002 10:44 发表:
这里有我的2个日志文件,都是在夜里无人时产生的纪录,因为服务器还在测试阶段,没有做过宣传,应该不会有人知道,请大家看看这些访问纪录都是在座什么?
最好可以简单的介绍一下如何来读日志文件,以后我就可以自己分析了!谢谢!
maillog文件!!
Nov 8 02:00:04 me qmail: 1036692004.950572 new msg 30243724
Nov 8 02:00:04 me qmail: 1036692004.950898 info msg 30243724: bytes 469 from
1<[email protected]> qp 813 uid 0
2
3Nov 8 02:00:04 me qmail: 1036692004.954953 starting delivery 8: msg 30243724 to local [email protected]
4
5Nov 8 02:00:04 me qmail: 1036692004.955116 status: local 1/10 remote 0/20
6
7Nov 8 02:00:04 me qmail: 1036692004.976175 delivery 8: failure: Sorry,_no_mailbox_here_by_that_name._vpopmail_(#5.1.1)/
8
9Nov 8 02:00:04 me qmail: 1036692004.976342 status: local 0/10 remote 0/20
10
11Nov 8 02:00:04 me qmail: 1036692004.984370 bounce msg 30243724 qp 816
12
13Nov 8 02:00:04 me qmail: 1036692004.984539 end msg 30243724
14
15Nov 8 02:00:04 me qmail: 1036692004.986874 new msg 30243725
16
17Nov 8 02:00:04 me qmail: 1036692004.987136 info msg 30243725: bytes 1034 from <> qp 816 uid 508
18
19Nov 8 02:00:04 me qmail: 1036692004.991587 starting delivery 9: msg 30243725 to local [email protected]
20
21Nov 8 02:00:04 me qmail: 1036692004.992044 status: local 1/10 remote 0/20
22
23Nov 8 02:00:05 me qmail: 1036692005.009292 delivery 9: failure: Sorry,_no_mailbox_here_by_that_name._vpopmail_(#5.1.1)/
24
25Nov 8 02:00:05 me qmail: 1036692005.011103 status: local 0/10 remote 0/20
26
27Nov 8 02:00:05 me qmail: 1036692005.018622 bounce msg 30243725 qp 819
28
29Nov 8 02:00:05 me qmail: 1036692005.019585 end msg 30243725
30
31Nov 8 02:00:05 me qmail: 1036692005.021696 new msg 30243724
32
33Nov 8 02:00:05 me qmail: 1036692005.022497 info msg 30243724: bytes 1509 from <#@[]> qp 819 uid 508
34
35Nov 8 02:00:05 me qmail: 1036692005.027116 starting delivery 10: msg 30243724 to local [email protected]
36
37Nov 8 02:00:05 me qmail: 1036692005.027592 status: local 1/10 remote 0/20
38
39Nov 8 02:00:05 me qmail: 1036692005.046408 delivery 10: success: did_0+0+1/
40
41Nov 8 02:00:05 me qmail: 1036692005.047727 status: local 0/10 remote 0/20
42
43Nov 8 02:00:05 me qmail: 1036692005.048480 end msg 30243724
44
45Nov 8 02:01:01 me qmail: 1036692061.531863 new msg 30243724
46
47Nov 8 02:01:01 me qmail: 1036692061.532044 info msg 30243724: bytes 3262 from <[email protected]> qp 849 uid 0
48
49Nov 8 02:01:01 me qmail: 1036692061.537680 starting delivery 11: msg 30243724 to local [email protected]
50
51Nov 8 02:01:01 me qmail: 1036692061.537841 status: local 1/10 remote 0/20
52
53Nov 8 02:01:01 me qmail: 1036692061.580807 delivery 11: failure: Sorry,_no_mailbox_here_by_that_name._vpopmail_(#5.1.1)/
54
55Nov 8 02:01:01 me qmail: 1036692061.580973 status: local 0/10 remote 0/20
56
57Nov 8 02:01:01 me qmail: 1036692061.589431 bounce msg 30243724 qp 856
58
59Nov 8 02:01:01 me qmail: 1036692061.589601 end msg 30243724
60
61Nov 8 02:01:01 me qmail: 1036692061.591948 new msg 30243725
62
63Nov 8 02:01:01 me qmail: 1036692061.592209 info msg 30243725: bytes 3817 from <> qp 856 uid 508
64
65Nov 8 02:01:01 me qmail: 1036692061.596674 starting delivery 12: msg 30243725 to local [email protected]
66
67Nov 8 02:01:01 me qmail: 1036692061.596828 status: local 1/10 remote 0/20
68
69Nov 8 02:01:01 me qmail: 1036692061.614206 delivery 12: failure: Sorry,_no_mailbox_here_by_that_name._vpopmail_(#5.1.1)/
70
71Nov 8 02:01:01 me qmail: 1036692061.615976 status: local 0/10 remote 0/20
72
73Nov 8 02:01:01 me qmail: 1036692061.623970 bounce msg 30243725 qp 859
74
75Nov 8 02:01:01 me qmail: 1036692061.624930 end msg 30243725
76
77Nov 8 02:01:01 me qmail: 1036692061.626989 new msg 30243724
78
79Nov 8 02:01:01 me qmail: 1036692061.627789 info msg 30243724: bytes 4287 from <#@[]> qp 859 uid 508
80
81Nov 8 02:01:01 me qmail: 1036692061.632452 starting delivery 13: msg 30243724 to local [email protected]
82
83Nov 8 02:01:01 me qmail: 1036692061.632926 status: local 1/10 remote 0/20
84
85Nov 8 02:01:01 me qmail: 1036692061.651491 delivery 13: success: did_0+0+1/
86
87Nov 8 02:01:01 me qmail: 1036692061.652816 status: local 0/10 remote 0/20
88
89Nov 8 02:01:01 me qmail: 1036692061.653569 end msg 30243724
90
91Nov 8 03:01:00 me qmail: 1036695660.678250 new msg 30243724
92
93Nov 8 03:01:00 me qmail: 1036695660.678434 info msg 30243724: bytes 1619 from <[email protected]> qp 890 uid 0
94
95Nov 8 03:01:00 me qmail: 1036695660.683724 starting delivery 14: msg 30243724 to local [email protected]
96
97Nov 8 03:01:00 me qmail: 1036695660.683885 status: local 1/10 remote 0/20
98
99Nov 8 03:01:00 me qmail: 1036695660.717181 delivery 14: failure: Sorry,_no_mailbox_here_by_that_name._vpopmail_(#5.1.1)/
100
101Nov 8 03:01:00 me qmail: 1036695660.717344 status: local 0/10 remote 0/20
102
103Nov 8 03:01:00 me qmail: 1036695660.726057 bounce msg 30243724 qp 898
104
105Nov 8 03:01:00 me qmail: 1036695660.726225 end msg 30243724
106
107Nov 8 03:01:00 me qmail: 1036695660.728464 new msg 30243725
108
109Nov 8 03:01:00 me qmail: 1036695660.728728 info msg 30243725: bytes 2174 from <> qp 898 uid 508
110
111Nov 8 03:01:00 me qmail: 1036695660.733516 starting delivery 15: msg 30243725 to local [email protected]
112
113Nov 8 03:01:00 me qmail: 1036695660.733962 status: local 1/10 remote 0/20
114
115Nov 8 03:01:00 me qmail: 1036695660.760165 delivery 15: failure: Sorry,_no_mailbox_here_by_that_name._vpopmail_(#5.1.1)/
116
117Nov 8 03:01:00 me qmail: 1036695660.760331 status: local 0/10 remote 0/20
118
119Nov 8 03:01:00 me qmail: 1036695660.768700 bounce msg 30243725 qp 901
120
121Nov 8 03:01:00 me qmail: 1036695660.768870 end msg 30243725
122
123Nov 8 03:01:00 me qmail: 1036695660.770933 new msg 30243724
124
125Nov 8 03:01:00 me qmail: 1036695660.771107 info msg 30243724: bytes 2644 from <#@[]> qp 901 uid 508
126
127Nov 8 03:01:00 me qmail: 1036695660.775879 starting delivery 16: msg 30243724 to local [email protected]
128
129Nov 8 03:01:00 me qmail: 1036695660.776036 status: local 1/10 remote 0/20
130
131Nov 8 03:01:00 me qmail: 1036695660.794880 delivery 16: success: did_0+0+1/
132
133Nov 8 03:01:00 me qmail: 1036695660.796278 status: local 0/10 remote 0/20
134
135Nov 8 03:01:00 me qmail: 1036695660.796625 end msg 30243724
136
137Nov 8 03:06:23 me splogger: 1036695983.980238 tcpserver: status: 1/100
138
139Nov 8 03:06:23 me splogger: 1036695983.980930 tcpserver: pid 904 from 211.95.148.168
140
141Nov 8 03:06:23 me splogger: 1036695983.981797 tcpserver: ok 904 me.com:218.2.158.159:25 :211.95.148.168::1599
142
143Nov 8 03:06:29 me qmail: 1036695989.062586 new msg 30243724
144
145Nov 8 03:06:29 me qmail: 1036695989.062870 info msg 30243724: bytes 743 from <[email protected]> qp 905 uid 503
146
147Nov 8 03:06:29 me qmail: 1036695989.066713 starting delivery 17: msg 30243724 to local [email protected]
148
149Nov 8 03:06:29 me qmail: 1036695989.066872 status: local 1/10 remote 0/20
150
151Nov 8 03:06:29 me qmail: 1036695989.119665 delivery 17: success: did_0+0+1/
152
153Nov 8 03:06:29 me qmail: 1036695989.119832 status: local 0/10 remote 0/20
154
155Nov 8 03:06:29 me qmail: 1036695989.119876 end msg 30243724
156
157Nov 8 03:06:30 me splogger: 1036695990.294550 tcpserver: end 904 status 0
158
159Nov 8 03:06:30 me splogger: 1036695990.294704 tcpserver: status: 0/100
160
161Nov 8 04:01:04 me qmail: 1036699264.820117 new msg 30243724
162
163Nov 8 04:01:04 me qmail: 1036699264.820298 info msg 30243724: bytes 2013 from <[email protected]> qp 935 uid 0
164
165Nov 8 04:01:04 me qmail: 1036699264.825566 starting delivery 18: msg 30243724 to local [email protected]
166
167Nov 8 04:01:04 me qmail: 1036699264.825729 status: local 1/10 remote 0/20
168
169Nov 8 04:01:04 me qmail: 1036699264.868712 delivery 18: failure: Sorry,_no_mailbox_here_by_that_name._vpopmail_(#5.1.1)/
170
171Nov 8 04:01:04 me qmail: 1036699264.868878 status: local 0/10 remote 0/20
172
173Nov 8 04:01:04 me qmail: 1036699264.877247 bounce msg 30243724 qp 942
174
175Nov 8 04:01:04 me qmail: 1036699264.877418 end msg 30243724
176
177Nov 8 04:01:04 me qmail: 1036699264.879348 new msg 30243725
178
179Nov 8 04:01:04 me qmail: 1036699264.879521 info msg 30243725: bytes 2568 from <> qp 942 uid 508
180
181Nov 8 04:01:04 me qmail: 1036699264.884246 starting delivery 19: msg 30243725 to local [email protected]
182
183Nov 8 04:01:04 me qmail: 1036699264.884392 status: local 1/10 remote 0/20
184
185Nov 8 04:01:04 me qmail: 1036699264.902231 delivery 19: failure: Sorry,_no_mailbox_here_by_that_name._vpopmail_(#5.1.1)/
186
187Nov 8 04:01:04 me qmail: 1036699264.904002 status: local 0/10 remote 0/20
188
189Nov 8 04:01:04 me qmail: 1036699264.911598 bounce msg 30243725 qp 945
190
191Nov 8 04:01:04 me qmail: 1036699264.912557 end msg 30243725
192
193Nov 8 04:01:04 me qmail: 1036699264.914622 new msg 30243724
194
195Nov 8 04:01:04 me qmail: 1036699264.915421 info msg 30243724: bytes 3038 from <#@[]> qp 945 uid 508
196
197Nov 8 04:01:04 me qmail: 1036699264.920059 starting delivery 20: msg 30243724 to local [email protected]
198
199Nov 8 04:01:04 me qmail: 1036699264.920533 status: local 1/10 remote 0/20
200
201Nov 8 04:01:04 me qmail: 1036699264.939228 delivery 20: success: did_0+0+1/
202
203Nov 8 04:01:04 me qmail: 1036699264.940553 status: local 0/10 remote 0/20
204
205Nov 8 04:01:04 me qmail: 1036699264.941206 end msg 30243724
206
207Nov 8 04:05:08 me qmail: 1036699508.453231 new msg 30243724
208
209Nov 8 04:05:08 me qmail: 1036699508.453413 info msg 30243724: bytes 544 from <[email protected]> qp 9718 uid 0
210
211Nov 8 04:05:08 me qmail: 1036699508.470108 starting delivery 21: msg 30243724 to local [email protected]
212
213Nov 8 04:05:08 me qmail: 1036699508.470267 status: local 1/10 remote 0/20
214
215Nov 8 04:05:08 me qmail: 1036699508.631306 delivery 21: failure: Sorry,_no_mailbox_here_by_that_name._vpopmail_(#5.1.1)/
216
217Nov 8 04:05:08 me qmail: 1036699508.675030 status: local 0/10 remote 0/20
218
219Nov 8 04:05:08 me qmail: 1036699508.683304 bounce msg 30243724 qp 9721
220
221Nov 8 04:05:08 me qmail: 1036699508.683472 end msg 30243724
222
223Nov 8 04:05:08 me qmail: 1036699508.708826 new msg 30243725
224
225Nov 8 04:05:08 me qmail: 1036699508.709571 info msg 30243725: bytes 1110 from <> qp 9721 uid 508
226
227Nov 8 04:05:08 me qmail: 1036699508.714953 starting delivery 22: msg 30243725 to local [email protected]
228
229Nov 8 04:05:08 me qmail: 1036699508.715427 status: local 1/10 remote 0/20
230
231Nov 8 04:05:08 me qmail: 1036699508.734080 delivery 22: failure: Sorry,_no_mailbox_here_by_that_name._vpopmail_(#5.1.1)/
232
233Nov 8 04:05:08 me qmail: 1036699508.734245 status: local 0/10 remote 0/20
234
235Nov 8 04:05:08 me qmail: 1036699508.742569 bounce msg 30243725 qp 9724
236
237Nov 8 04:05:08 me qmail: 1036699508.742738 end msg 30243725
238
239Nov 8 04:05:08 me qmail: 1036699508.744808 new msg 30243724
240
241Nov 8 04:05:08 me qmail: 1036699508.744981 info msg 30243724: bytes 1586 from <#@[]> qp 9724 uid 508
242
243Nov 8 04:05:08 me qmail: 1036699508.749721 starting delivery 23: msg 30243724 to local [email protected]
244
245Nov 8 04:05:08 me qmail: 1036699508.749877 status: local 1/10 remote 0/20
246
247Nov 8 04:05:08 me qmail: 1036699508.812758 delivery 23: success: did_0+0+1/
248
249Nov 8 04:05:08 me qmail: 1036699508.812919 status: local 0/10 remote 0/20
250
251Nov 8 04:05:08 me qmail: 1036699508.812962 end msg 30243724
252
253Nov 8 05:01:04 me qmail: 1036702864.840007 new msg 30243724
254
255Nov 8 05:01:04 me qmail: 1036702864.840188 info msg 30243724: bytes 2389 from <[email protected]> qp 9755 uid 0
256
257Nov 8 05:01:04 me qmail: 1036702864.847975 starting delivery 24: msg 30243724 to local [email protected]
258
259Nov 8 05:01:04 me qmail: 1036702864.848139 status: local 1/10 remote 0/20
260
261Nov 8 05:01:04 me qmail: 1036702864.878955 delivery 24: failure: Sorry,_no_mailbox_here_by_that_name._vpopmail_(#5.1.1)/
262
263Nov 8 05:01:04 me qmail: 1036702864.879119 status: local 0/10 remote 0/20
264
265Nov 8 05:01:04 me qmail: 1036702864.917116 bounce msg 30243724 qp 9761
266
267Nov 8 05:01:04 me qmail: 1036702864.917282 end msg 30243724
268
269Nov 8 05:01:04 me qmail: 1036702864.920132 new msg 30243725
270
271Nov 8 05:01:04 me qmail: 1036702864.920390 info msg 30243725: bytes 2945 from <> qp 9761 uid 508
272
273Nov 8 05:01:04 me qmail: 1036702864.926738 starting delivery 25: msg 30243725 to local [email protected]
274
275Nov 8 05:01:04 me qmail: 1036702864.927213 status: local 1/10 remote 0/20
276
277Nov 8 05:01:04 me qmail: 1036702864.945744 delivery 25: failure: Sorry,_no_mailbox_here_by_that_name._vpopmail_(#5.1.1)/
278
279Nov 8 05:01:04 me qmail: 1036702864.945907 status: local 0/10 remote 0/20
280
281Nov 8 05:01:04 me qmail: 1036702864.954375 bounce msg 30243725 qp 9764
282
283Nov 8 05:01:04 me qmail: 1036702864.954540 end msg 30243725
284
285Nov 8 05:01:04 me qmail: 1036702864.956606 new msg 30243724
286
287Nov 8 05:01:04 me qmail: 1036702864.956781 info msg 30243724: bytes 3416 from <#@[]> qp 9764 uid 508
288
289Nov 8 05:01:04 me qmail: 1036702864.961513 starting delivery 26: msg 30243724 to local [email protected]
290
291Nov 8 05:01:04 me qmail: 1036702864.961968 status: local 1/10 remote 0/20
292
293Nov 8 05:01:04 me qmail: 1036702864.980482 delivery 26: success: did_0+0+1/
294
295Nov 8 05:01:04 me qmail: 1036702864.981847 status: local 0/10 remote 0/20
296
297Nov 8 05:01:04 me qmail: 1036702864.982621 end msg 30243724
298
299Nov 8 06:01:04 me qmail: 1036706464.974894 new msg 30243724
300
301Nov 8 06:01:04 me qmail: 1036706464.975076 info msg 30243724: bytes 1372 from <[email protected]> qp 9794 uid 0
302
303Nov 8 06:01:04 me qmail: 1036706464.980324 starting delivery 27: msg 30243724 to local [email protected]
304
305Nov 8 06:01:04 me qmail: 1036706464.980483 status: local 1/10 remote 0/20
306
307Nov 8 06:01:05 me qmail: 1036706465.023486 delivery 27: failure: Sorry,_no_mailbox_here_by_that_name._vpopmail_(#5.1.1)/
308
309Nov 8 06:01:05 me qmail: 1036706465.023649 status: local 0/10 remote 0/20
310
311Nov 8 06:01:05 me qmail: 1036706465.032220 bounce msg 30243724 qp 9801
312
313Nov 8 06:01:05 me qmail: 1036706465.032386 end msg 30243724
314
315Nov 8 06:01:05 me qmail: 1036706465.035219 new msg 30243725
316
317Nov 8 06:01:05 me qmail: 1036706465.035476 info msg 30243725: bytes 1928 from <> qp 9801 uid 508
318
319Nov 8 06:01:05 me qmail: 1036706465.039996 starting delivery 28: msg 30243725 to local [email protected]
320
321Nov 8 06:01:05 me qmail: 1036706465.040148 status: local 1/10 remote 0/20
322
323Nov 8 06:01:05 me qmail: 1036706465.057457 delivery 28: failure: Sorry,_no_mailbox_here_by_that_name._vpopmail_(#5.1.1)/
324
325Nov 8 06:01:05 me qmail: 1036706465.059227 status: local 0/10 remote 0/20
326
327Nov 8 06:01:05 me qmail: 1036706465.066878 bounce msg 30243725 qp 9804
328
329Nov 8 06:01:05 me qmail: 1036706465.067832 end msg 30243725
330
331Nov 8 06:01:05 me qmail: 1036706465.069942 new msg 30243724
332
333Nov 8 06:01:05 me qmail: 1036706465.070775 info msg 30243724: bytes 2399 from <#@[]> qp 9804 uid 508
334
335Nov 8 06:01:05 me qmail: 1036706465.075433 starting delivery 29: msg 30243724 to local [email protected]
336
337Nov 8 06:01:05 me qmail: 1036706465.075902 status: local 1/10 remote 0/20
338
339Nov 8 06:01:05 me qmail: 1036706465.094365 delivery 29: success: did_0+0+1/
340
341Nov 8 06:01:05 me qmail: 1036706465.095698 status: local 0/10 remote 0/20
342
343Nov 8 06:01:05 me qmail: 1036706465.096472 end msg 30243724
344
345Nov 8 07:01:05 me qmail: 1036710065.092395 new msg 30243724
346
347Nov 8 07:01:05 me qmail: 1036710065.092577 info msg 30243724: bytes 1372 from <[email protected]> qp 9834 uid 0
348
349Nov 8 07:01:05 me qmail: 1036710065.097832 starting delivery 30: msg 30243724 to local [email protected]
350
351Nov 8 07:01:05 me qmail: 1036710065.097991 status: local 1/10 remote 0/20
352
353Nov 8 07:01:05 me qmail: 1036710065.131155 delivery 30: failure: Sorry,_no_mailbox_here_by_that_name._vpopmail_(#5.1.1)/
354
355Nov 8 07:01:05 me qmail: 1036710065.131317 status: local 0/10 remote 0/20
356
357Nov 8 07:01:05 me qmail: 1036710065.140284 bounce msg 30243724 qp 9841
358
359Nov 8 07:01:05 me qmail: 1036710065.140453 end msg 30243724
360
361Nov 8 07:01:05 me qmail: 1036710065.142830 new msg 30243725
362
363Nov 8 07:01:05 me qmail: 1036710065.143641 info msg 30243725: bytes 1928 from <> qp 9841 uid 508
364
365Nov 8 07:01:05 me qmail: 1036710065.148839 starting delivery 31: msg 30243725 to local [email protected]
366
367Nov 8 07:01:05 me qmail: 1036710065.149315 status: local 1/10 remote 0/20
368
369Nov 8 07:01:05 me qmail: 1036710065.174839 delivery 31: failure: Sorry,_no_mailbox_here_by_that_name._vpopmail_(#5.1.1)/
370
371Nov 8 07:01:05 me qmail: 1036710065.175000 status: local 0/10 remote 0/20
372
373Nov 8 07:01:05 me qmail: 1036710065.183358 bounce msg 30243725 qp 9844
374
375Nov 8 07:01:05 me qmail: 1036710065.183522 end msg 30243725
376
377Nov 8 07:01:05 me qmail: 1036710065.185674 new msg 30243724
378
379Nov 8 07:01:05 me qmail: 1036710065.185851 info msg 30243724: bytes 2399 from <#@[]> qp 9844 uid 508
380
381Nov 8 07:01:05 me qmail: 1036710065.190596 starting delivery 32: msg 30243724 to local [email protected]
382
383Nov 8 07:01:05 me qmail: 1036710065.190799 status: local 1/10 remote 0/20
384
385Nov 8 07:01:05 me qmail: 1036710065.209306 delivery 32: success: did_0+0+1/
386
387Nov 8 07:01:05 me qmail: 1036710065.210635 status: local 0/10 remote 0/20
388
389Nov 8 07:01:05 me qmail: 1036710065.211658 end msg 30243724
390
391Nov 8 08:01:01 me qmail: 1036713661.265338 new msg 30243724
392
393Nov 8 08:01:01 me qmail: 1036713661.265520 info msg 30243724: bytes 1609 from <[email protected]> qp 9876 uid 0
394
395Nov 8 08:01:01 me qmail: 1036713661.271043 starting delivery 33: msg 30243724 to local [email protected]
396
397Nov 8 08:01:01 me qmail: 1036713661.271202 status: local 1/10 remote 0/20
398
399Nov 8 08:01:01 me qmail: 1036713661.365628 delivery 33: failure: Sorry,_no_mailbox_here_by_that_name._vpopmail_(#5.1.1)/
400
401Nov 8 08:01:01 me qmail: 10</[email protected]></[email protected]></[email protected]></[email protected]></[email protected]></[email protected]></[email protected]></[email protected]></[email protected]></[email protected]>