Open Source PHP Log Analysis Software for Linux

OSSIM, AlienVault’s Open Source Security Information and Event Management (SIEM) product, provides event collection, normalization and correlation. For more advanced functionality, AlienVault Unified Security Management (USM) builds on OSSIM with these additional capabilities: * Log management * Advanced threat detection with a continuously updated library of pre-built correlation rules * Actionable threat intelligence updates from AlienVault Labs Security Research Team * Rich analytics dashboards and data visualization

The pimped Apache status makes the Apache server status readable, sortable and searchable. The pimped Apache status can merge the status of several servers that opens the possibility to identify the troubleshooter even in a loadbalanced website. The webbased tool offers a multilanguage, skinable interface with a built-in updater. In several views you see most requested pages, vhosts, used methods, IPs that make the most requests and more. All views are sortable tables you can filter by a keyword and are available as API Request too to get its data as CSV, XML or JSON. Compatible with PHP 7+8 (and should run on PHP 5.x - but is not supported).

Monolog sends your logs to files, sockets, inboxes, databases and various web services. See the complete list of handlers below. Special handlers allow you to build advanced logging strategies. This library implements the PSR-3 interface that you can type-hint against in your own libraries to keep a maximum of interoperability. You can also use it in your applications to make sure you can always use another compatible logger at a later time. As of 1.11.0 Monolog public APIs will also accept PSR-3 log levels. Internally Monolog still uses its own level scheme since it predates PSR-3. Tidelift delivers commercial support and maintenance for the open source dependencies you use to build your applications. Save time, reduce risk, and improve code health, while paying the maintainers of the exact dependencies you use. Monolog 1.x support is somewhat limited at this point and only important fixes will be done. You should migrate to Monolog 2 where possible to benefit from all the features.

Screen squid is web-based interface for viewing reports based on Squid proxy server log files. It can be accessed from web-browser through more than 50 reports. No extra files, only DB. All reports generated "on-the-fly". And we got personal cabinet for each user/group.

AutoIndex is a PHP script that makes a table that lists the files in a directory, and lets users access the files and subdirectories. It includes searching, icons for each file type, an admin panel, uploads, access logging, file descriptions, and more.

HoneyVIew ist a tool to analyze honeyd-logfiles of the honeyd-daemon implemented by Niels Provos in an convenient way. HoneyView generates graphical and textual results from queries against the logfile data.

SRG is a log file analyser and report generator for the Squid web proxy. It is fast and was created to allow easy integration with other authentication systems. SRG is flexible and can report right down the the level of individual files requested.

Pothos is an iptables log analyzer. It is used to interpret, in a user-friendly fashion, the logs that ulogd creates with it's MySQL plugin. It's main objective is to be efficient, leaving as small a foot-print as possible.

TraffStats: network Traffic Statistic - is a monitoring and traffic analysis software, using SNMP to collect data from any enabled device. - has the ability to generate graphs (using jpgraph) with the option to compare and sum up different devices.

(Deprecated for vnstat 2.0+, because of the removal of the --dumpdb feature) jsvnstat is a web frontend for vnstat. It is largely based on javascript, so you can easily switch views without reloading the entire page. The graph is interactive, just hover over a datapoint to see what I'm talking about. Requires: vnstat 1.x, PHP

Application to display, as well as interpret, firewall information from a database to serve a variety of users needs. The application is online and cross-platform, written using PHP.

AVirCAP is a system for manual and / or automated detection of CodeRed and Nimda type of hack attempts and virtually all other kinds of "logable" intrusion attempts. It can work stand alone or together with other additional AVirCAP machines in the LAN/W

AWStats Enterprise Manager is a tool for managing awstats configuration creation and logfile processing, in a multi-server environment. This script is designed to pull all the webserver logs, for every server, and parse them with awstats.

AccounteX is an IP accounting system based on the IP Stat program. It has many exciting features like fully customizable web traffic accounting and user access control by many different values. information service and web statistics and administration.

The goal of this project is to provide a liveCD allowing the user to analyze networks for VoIP installations. This project gives you a global network state.

CSWA is a PHP based analyzer for reactive analyses of syslogs messages from Cisco network equipment.

Capra is a Open Source tool to quickly get some nice and useful reports out off your Watchguard Fireware log files.

Keep your eye on unlimited number of machines using CheckPing. Timeouts, ping times, live graphs and notification via mail/SMS/pager/etc.

The Distributed Intrusion Detection System.

FAHWebMon is a web based log analyzer for Folding @ Home Diskless Folding Farms (F@HF). It allows an administrator of such a system to visually see the status of individual work nodes in a given farm.

A Tool used in conjunction with glftpd to dynamically create reports on users groups. And Allow the user to access those reports through the web, irc, and glftpd itself

IPHPLog (IP PHP Log) is a simple software written in PHP, JS and SQL that runs over a MySQL database manager system . IPHPLog can log the information of your visitors and organize that on a data base with GeoIP.

What are the packets rejected by your Netfilter based firewall today ? How often this suspicious host try to connect to your box ? What are the most rejected domains ? Who is this strange host which scan your ports ? The responses are in the iptables log

Ida, is a Apache log security analyzer written in PHP. It will scan Apache logs and report about security incidents like SQL injections, XSS attacks, path traveling and so on.

Traffic accounting suite for Linux that comes with a webinterface written in PHP. Requires iptables, its ULOG target and MySQL for data storage. This system uses categories which are fed by iptable rules that can be defined using the webinterface.