LogHunter

LogHunter is a modular Bash security log analyzer for Linux servers. It parses Apache, Nginx, SSH, auth, secure, journal, and compressed log sources; detects suspicious web activity and brute-force login behavior; and exports terminal, JSON, CSV, and standalone HTML reports.

LogHunter is a defensive log-analysis tool. Analyze only logs and systems you are authorized to access.

Features

• Apache and Nginx access-log statistics: source IPs, methods, URLs, status codes, user agents, referrers, transfer size, and hourly activity.
• SSH/auth analysis: failed logins, accepted logins, invalid users, targeted usernames, root attempts, and source-IP summaries.
• Rule-driven web detection for sensitive files, SQL injection, XSS, command injection, suspicious user agents, and unusual methods.
• Brute-force detection for repeated failures from one IP and username-spraying behavior.
• Optional GeoIP context with local/private IP protection and cache support.
• Large-file friendly line-by-line processing with --head, --tail, and --max-lines.
• Real-time monitoring with tail -F.
• Safe exports using jq for JSON plus CSV and escaped standalone HTML.

Quick Start

cd LogHunter
bash loghunter.sh --file examples/auth.log --type ssh --brute-force
bash loghunter.sh --file examples/apache_access.log --type apache --export-html apache-report.html

Installation

LogHunter runs directly from the project folder:

git clone https://github.com/your-name/LogHunter.git
cd LogHunter
chmod +x loghunter.sh install.sh tests/*.sh
./loghunter.sh --help

Optional system install:

sudo ./install.sh /usr/local/bin/loghunter

Dependencies

Required: bash, awk, sed, grep, sort, uniq, date, jq.

Optional: gzip, journalctl, geoiplookup, mmdblookup, curl, column, tput.

Install examples:

# Debian / Ubuntu
sudo apt update && sudo apt install bash gawk sed grep coreutils jq gzip curl geoip-bin

# Fedora
sudo dnf install bash gawk sed grep coreutils jq gzip curl GeoIP

# Arch Linux
sudo pacman -S bash gawk sed grep coreutils jq gzip curl geoip

# Alpine Linux
sudo apk add bash gawk sed grep coreutils jq gzip curl

# macOS
brew install bash gawk jq grep gnu-sed coreutils

Usage

./loghunter.sh --file /var/log/auth.log
./loghunter.sh --file /var/log/nginx/access.log --type nginx
./loghunter.sh --directory /var/log/nginx/
./loghunter.sh --journal ssh
./loghunter.sh --file access.log --geoip
./loghunter.sh --file auth.log --brute-force --threshold 10 --window 300
./loghunter.sh --file access.log --export-json report.json --export-csv report.csv --export-html report.html
./loghunter.sh --file /var/log/auth.log --watch

Options

Run ./loghunter.sh --help for the full option reference. Common controls include --file, --directory, --type, --journal, --since, --until, --ip, --username, --top, --geoip, --brute-force, --threshold, --window, --watch, --export-json, --export-csv, --export-html, --head, --tail, --max-lines, --quiet, --verbose, and --no-color.

Configuration

Defaults live in config/loghunter.conf. Command-line flags override matching configuration values.

Important settings include:

• BRUTE_FORCE_THRESHOLD
• BRUTE_FORCE_WINDOW
• USERNAME_SPRAY_THRESHOLD
• WEB_REQUEST_RATE_THRESHOLD
• ENABLE_GEOIP
• GEOIP_DATABASE
• CACHE_DIRECTORY
• REPORT_DIRECTORY
• MAX_LINE_LENGTH

Detection Rules

Rules live under rules/ and can be edited without changing the main script:

• sensitive_paths.txt
• sql_injection_patterns.txt
• xss_patterns.txt
• command_injection_patterns.txt
• suspicious_user_agents.txt
• ignored_ips.txt

Empty lines and # comments are ignored. Sensitive paths use conservative case-insensitive substring matching; injection and user-agent rules use extended regular expressions.

GeoIP

Use --geoip to enrich unique public IP addresses. LogHunter avoids external lookups for loopback, private, link-local, and reserved local ranges. It prefers local tools such as geoiplookup and falls back to curl only for public IPs.

GeoIP data is context only. LogHunter does not classify an address as malicious because of its country.

Reports

• JSON: structured analyzer, analysis, summary, top lists, hourly stats, and alerts.
• CSV: source IP, username, status, and alert summaries.
• HTML: standalone dark report with summary cards, severity badges, top tables, and printable styling.

Tests

bash tests/test_apache_parser.sh
bash tests/test_nginx_parser.sh
bash tests/test_ssh_parser.sh
bash tests/test_brute_force.sh

Project Structure

LogHunter/
  loghunter.sh
  config/
  lib/
  rules/
  tests/
  examples/
  install.sh
  LICENSE
  README.md

Security Notes

Log content is untrusted input. LogHunter avoids eval, avoids dynamically constructed shell commands, validates readable input files, bounds maximum line length, escapes CSV/HTML output, and builds JSON through jq. Keep rule files and configuration under trusted ownership on production servers.