>To: E-smith developers list <[EMAIL PROTECTED]>
>From: Mike Sensney <[EMAIL PROTECTED]>
>Subject: Re: [e-smith-devinfo] FYI - new worm appears to be hitting
>Microsoft IIS servers
>X-Fetchmail-Warning: recipient address [EMAIL PROTECTED] didn't
>match any local name
>
>21:33:12 - I've now been hit 4790 times now from 149 different servers.
>
>I'm now running this rough little script which gives the above output.
>It loops about every 10 minutes.
><script>
>while : ; do
>cat /var/log/httpd/access_log |grep 'c+dir' >tempfile
>TIME=`date | cut -f 4 -d " "`
>ATTACKS=`wc -l <tempfile | tr -d ' '`
>SERVERS=`cat tempfile | grep 'c+dir' | cut -f 2 -d " " | sort | uniq | wc
>-l | tr -d ' '`
>rm -rf tempfile
>echo "$TIME - I've now been hit $ATTACKS times now from $SERVERS different
>servers."
>sleep 600
>done
></script>
At 11:04 AM 20/09/2001 +1000, ccgaddes wrote:
>I guys I was just woundering how I would go about setting up a filter \ rule
>to view how many times my box is hit with the Nimda virus ...any ideas would
>be cool as I am new to the linux world..thanks
>
>--
>SLUG - Sydney Linux User Group Mailing List - http://slug.org.au/
>More Info: http://lists.slug.org.au/listinfo/slug
--
SLUG - Sydney Linux User Group Mailing List - http://slug.org.au/
More Info: http://lists.slug.org.au/listinfo/slug
