Log Analyzer

About the Project

Log Analyzer is a Bash-based tool for monitoring and analyzing SSH login attempts on Linux servers.
It detects brute-force attempts by checking failed SSH login entries in /var/log/auth.log and can automatically block suspicious IPs using UFW or iptables.
Optionally, it can send Telegram alerts when a brute-force attack is detected.

Features

• Detects repeated failed SSH login attempts
• Counts frequency of suspicious IP addresses
• Blocks malicious IPs using:
  • UFW (Uncomplicated Firewall)
  • iptables
• Sends real-time notifications via Telegram (optional)
• Stores analysis logs in the logs/ directory
• Fully configurable via config.conf

Requirements

Before running the script, make sure you have:

• A Linux server (Debian/Ubuntu recommended)
• Bash shell
• curl installed
• Either ufw or iptables installed and active
• Optional: Telegram bot for receiving alerts

Setup

1. Clone the repository

git clone https://github.com/YOUR_USERNAME/log-analyzer.git
cd log-analyzer

2. Edit the configuration file

Open config.conf and set your preferences:

nano config.conf

You can configure:

• LOG_FILE → SSH authentication log path
• THRESHOLD → number of failed attempts before blocking
• FIREWALL → choose ufw or iptables
• OUTPUT_LOG → output log file
• Optional Telegram settings:
  • TELEGRAM_TOKEN
  • TELEGRAM_CHAT_ID

Ensure curl, iptables, or ufw are installed and active on the server.

Run the Analyzer

bash log-analyzer.sh

Telegram Bot Setup (Optional)

1. Create a Telegram bot
   1. Open Telegram
   2. Search for BotFather
   3. Send /newbot
   4. Choose a bot name + username
   5. Copy the bot token shown by BotFather:

1234567890:ABCDEF-YourTokenHere

Place it inside config.conf:

TELEGRAM_TOKEN="your-bot-token"

2. Find your Telegram Chat ID
   1. Send a message (like /start) to your new bot
   2. Run this command on your server:

curl -s "https://api.telegram.org/botYOUR_TOKEN/getUpdates"

3. Look for:

"chat":{"id":123456789}

Add the ID to config.conf:

TELEGRAM_CHAT_ID="123456789"

Now your bot will send notifications whenever a brute-force attempt is detected.