log-analysis

What this skill does

Analyzes security log files to detect anomalies. Extracts top IPs, paths, status codes, and User-Agents from web access logs, and detects brute-force patterns (multiple 401s) and scanning behavior (sequential path enumeration). Extracts failed login patterns from auth logs and error/warning patterns from syslog, then outputs a summary report with a timeline.

When to use

• Analyzing access logs when a web server compromise is suspected
• Checking whether an SSH brute-force attack has occurred
• Reconstructing an attack timeline during incident response
• Automating routine security monitoring and anomaly detection

Prerequisites

• grep, awk, sort, uniq (available by default on most Linux systems)
• python3 (advanced analysis and report generation)
• Read access to the target log files

Inputs

Field	Description	Example
LOG_FILE	Path to the log file to analyze	/var/log/nginx/access.log
LOG_TYPE	Log type: access / auth / syslog	access
TOP_N	Number of top entries to display (default: 20)	20

Workflow

Step 1: Verify log file and type

LOG_FILE="${SECSKILL_LOG_FILE:-${1:-}}"
LOG_TYPE="${SECSKILL_LOG_TYPE:-${2:-auto}}"
TOP_N="${SECSKILL_TOP_N:-${3:-20}}"

if [ -z "$LOG_FILE" ]; then
    read -rp "Enter log file path: " LOG_FILE
fi

if [ ! -f "$LOG_FILE" ]; then
    echo "[!] File not found: $LOG_FILE"
    exit 1
fi

# Auto-detect log type
if [ "$LOG_TYPE" = "auto" ]; then
    filename=$(basename "$LOG_FILE")
    case "$filename" in
        access*|nginx*|apache*|httpd*) LOG_TYPE="access" ;;
        auth*|secure*|sshd*) LOG_TYPE="auth" ;;
        syslog*|messages*|system*) LOG_TYPE="syslog" ;;
        *) LOG_TYPE="access" ; echo "[*] Could not auto-detect log type, assuming access log." ;;
    esac
fi

TOTAL_LINES=$(wc -l < "$LOG_FILE")
FILE_SIZE=$(du -sh "$LOG_FILE" | cut -f1)
echo "[+] Log file: $LOG_FILE"
echo "    Type: $LOG_TYPE | Lines: $TOTAL_LINES | Size: $FILE_SIZE"