Home/ Questions/Q 7613461
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-31T02:09:39+00:00

Some months ago the server was under a DDOS attack. (my sys admin found

  • 0

Some months ago the server was under a DDOS attack. (my sys admin found out)
At this moment the sys admin is not available, and the server went down several times.

How can i find out if I am under attack? What log files?

SSH, APACHE were not available, but i could ping the server. Then I reset the server, and everything functions again. I think they do a short attack and then the server crashes.
From what I know from the last attackers, they are just some idiots, no real ‘hackers’.

What I found in the syslog, the last log before server went down:
WEBSERVERUSER – MAIL (mailed 260 bytes of output but got status 0x0001 )

What logs to check more?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    What logs to check depends on what OS, what version, what server software is installed and how it’s configured.

    Basically apache web server (most used) has access logs here:

    /var/log/httpd/access_log

    and error logs here:

    /var/log/httpd/error_log

    SSH by default on RHEL logs to 

    /var/log/secure

    or to syslog

    /var/log/messages

    I used denyhost tool to detect & prevent brute force attacks on SSHD.

    There are lots of analyzers available, just google for IDS, but I can not recommend you specific until you give us more details mentioned above.

    • 0