Recently I've had several bouts of spambot traffic on my website. On each occasion the attacks have come from just a handful of IP addresses (so not a DDOS attack).

I would like to be able to monitor my server logs and look for patterns/indicators of this type of attack happening again.

For example, I would like to be able to:

  • See the top IP addresses with most requests to my site/server
  • See the top IP addresses with most bandwidth usage of my site/server
  • Filter by (e.g.) country, user agent, browser, operating system
  • Filter by request parameters: query string, path, etc.

I do use Cloudflare, however it's not always helpful because its analytics doesn't show you the IP addresses making the requests, and it doesn't allow you to filter or group by the top IP addresses or the IPs using the highest bandwidth. Plus, it's not self-hosted.

Is there some self-hosted software which can do this?

  • If you have access to the log files, you might wisht to take a look at GoAccess. I'm not sure about query parameters, but all else should be covered.
    – Izzy
    Feb 17 '21 at 1:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.