<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type"> <title></title> </head> <body bgcolor="#ffffff" text="#000099"> I'd look into the various hardening and monitoring tools available (Bastille, Tripwire, chroot, etc). There's different tools for different purposes, obviously. We chroot all our BIND and Apache stuff. Bastille is great for hardening the environment. Tripwire monitors for changes to key files. Each program has its own logging mechanisms. So once you have your tool in place, you can use Nagios to watch the log file(s) and generate alerts based on keywords (ALERT, WARN, CRIT, etc). You can also dump your logs to an alternate server and have Nagios watch them from there, but in the case of DDoS attack, your bandwidth may be affected for remote syslog and/or Nagios network checks. <pre class="moz-signature" cols="72"> A. Davis Email: <a class="moz-txt-link-abbreviated" href="mailto:nccomp@gmail.com">nccomp@gmail.com</a> "There is no limit to what a man can accomplish if he doesn't care who gets the credit." - Ronald Reagan </pre> shadih rahman wrote: <blockquote cite="mid:6db4a4200906081506t74119c03t115743f37857414e@mail.gmail.com" type="cite">our web sites got hacked and we were subjected to ddos for last few days. I wanted to know what can I do for monitoring to find out if I am hacked or not. By the way, we were hacked by php exploits. Please advise on this. Thanks -- Cordially, Shadhin Rahman <pre wrap=""> <hr size="4" width="90%"> ------------------------------------------------------------------------------ Crystal Reports - New Free Runtime and 30 Day Trial Check out the new simplified licensing option that enables unlimited royalty-free distribution of the report engine for externally facing server and web deployment. <a class="moz-txt-link-freetext" href="http://p.sf.net/sfu/businessobjects">http://p.sf.net/sfu/businessobjects</a></pre> <pre wrap=""> <hr size="4" width="90%"> _______________________________________________ Nagios-users mailing list <a class="moz-txt-link-abbreviated" href="mailto:Nagios-users@lists.sourceforge.net">Nagios-users@lists.sourceforge.net</a> <a class="moz-txt-link-freetext" href="https://lists.sourceforge.net/lists/listinfo/nagios-users">https://lists.sourceforge.net/lists/listinfo/nagios-users</a> ::: Please include Nagios version, plugin version (-v) and OS when reporting any issue. ::: Messages without supporting info will risk being sent to /dev/null</pre> </blockquote> </body> </html>