Recently I've had several bouts of spambot traffic on my website. On each occasion the attacks have come from just a handful of IP addresses (so not a DDOS attack).
I would like to be able to monitor my server logs and look for patterns/indicators of this type of attack happening again.
For example, I would like to be able to:
- See the top IP addresses with most requests to my site/server
- See the top IP addresses with most bandwidth usage of my site/server
- Filter by (e.g.) country, user agent, browser, operating system
- Filter by request parameters: query string, path, etc.
I do use Cloudflare, however it's not always helpful because its analytics doesn't show you the IP addresses making the requests, and it doesn't allow you to filter or group by the top IP addresses or the IPs using the highest bandwidth. Plus, it's not self-hosted.
Is there some self-hosted software which can do this?