Read, parse & understand
your server logs.
A practical reference for webmasters and IT professionals. Covers Apache, Nginx, FTP, MySQL, SSH, Postfix, systemd, Windows Event logs — plus a full section on detecting web attacks and compromised sites.
Web Attacks Overview
Pattern recognition table for SQLi, XSS, path traversal, scanners, and DDoS — directly from your access log.
SQL Injection in Logs
Union-based, blind, time-based, and error-based SQLi — what each looks like in the log and how to catch them.
XSS Attacks in Logs
Reflected and stored XSS payloads, encoding tricks, and scanner signatures in access logs.
Web Shell Detection
PHP shells in uploads, cmd= parameters, known backdoor names — log patterns and filesystem checks.
Suspicious Admin Logins
Detect credential stuffing, off-hours access, and post-login attacker activity in wp-admin and phpMyAdmin.
WordPress Brute Force & xmlrpc
xmlrpc.php multicall attacks explained, wp-login status codes decoded, block configs for Nginx + Apache.
Malicious Plugin Detection
Backdoor plugins, SEO cloaking, Googlebot redirects, and nulled plugin signs in logs and on the filesystem.
Incident Response
Preserve evidence, build the attack timeline, identify the entry point, determine scope. Step-by-step with commands.
Apache HTTP Server
Access log, error log, HTTP status codes, and LogFormat directive reference.
Nginx
All log variables explained, error log decoded, and recommended log_format configs including JSON.
FTP — vsftpd & ProFTPD
xferlog format, ProFTPD directives, and FTP reply codes for diagnosing transfer failures.
MySQL / MariaDB
Error, slow query, general query, and binary log — all four log types covered.
SSH / Auth Log
Decode authentication events, spot brute force attacks, understand every field in auth.log.
Postfix / Mail
Trace any email end-to-end by queue ID, understand DSN codes, know what each daemon logs.
systemd Journal
Master journalctl — filter by unit, time, priority, and boot. Full structured field reference.
Windows Event Logs
Security Event IDs, IIS W3C log format, and PowerShell queries for Windows Server environments.