- [narrator] Web Log Analysis is actually
the process to parse and analyze a log file
from a web server.
And you can actually use this to know about
indicators about when, how, by whom a web server
or website is actually visited.
Now the data extracted from the log files
can also be stored in a database allowing for many reports
to actually be generated on demand.
There are several security event management platforms
like Splunk and Graylog that can
collect and process web server logs.
And they actually do a lot of Discord type
of correlation for you in a very effective manner.
Now features supported by log analysis packages
may include things like "hit filters,"
which actually use pattern matching to
examine the selected log data.
Now there's different type of a log data that includes
things like the number of visits and number
of unique visitors, the visit duration,
and when was actually the last time that
the user or web service was actually visited.
And what are the actually authenticated users?
When they were actually last authenticated
to the system.
The days of the week and rush hours of that web server.
The number of webpages that actually were viewed.
The most viewed entries and exit pages
and also file types within the web server.
Also the operating systems and the browsers
that are used by the users, right?
The HTTP referrers and search engine, key phrases
and keywords used to actually find the analyzed website,
and many other things like HTTP errors.
Now, two very popular web servers are
the Apache HTTP server and NGiNX.
Now the Apache HTTP server provides a very comprehensive
and flexible logging capabilities.
NGiNX also provides a very similar log structure and
by default NGiNX and Apache writes activities
and information into two types of logs, the error log
and the access log.
The error log is where the web server records
any type of errors.
Anything that it doesn't think that is actually quite right.
Sometimes you will also see warnings in
there that don't indicate a problem, but advise you
that a particular event or configuration may actually cause
some problems later within the system.
Now the access log is where your web server records
all the visitors to your site.
And there you can actually see what files the user is
actually accessing, how the web server responded to request,
and other information, like what kind of web browsers
the visitors are using and also
the operating systems of those systems.
Now, before you can read your logs
you'll need to find them, right?
You need to know where those logs are.
So to find the error log, look in your main NGiNX
or Apache HTTP config files.
However, by default, all the logs typically are stored
under VAR log in your system.
So under the /var/log directory.
Here's an example of the Apache logs.
You can see the access and the error logs here.
And as we mentioned before, in the access log
you can see what files the users are accessing,
how the web server responded to request,
and other types of information, like what type of
web browsers the visitors are actually using.