There are events from different web server logs (see below). What can you tell about each row? What is happening in each row? What might be interesting in case of incident investigation? timestamp="09/Mar/2016:11:14:34 +0300" client_ip="73.9.84.166" user_agent="Debian APT-HTTP/1.3 (0.8.16~exp12ubuntu10.26)" url="/precise-security/stable/amd64/Packages.bz2" [09/Mar/2016:11:14:35 +0300] wiki-api.company-realm.ru 25.255.240.122 "GET /_api/frontend/.is_readonly?=&__uid=1120000000006167 HTTP/1.1" 200 "-" "-" "ivanovaa" "companyuid=5986251411438764783" - 717 0.022 0.022 [09/Mar/2016:11:14:35 +0300] fml.company-realm.ru 202a:6b8:b010:2048:0:d0c0:5:12 "GET /rest/v2/call/collectPoolFromQueriesRatings/32b86116-e409-11e5-bdc7-0025909427cc?ticket=3201127 HTTP/1.1" 414 "-" "Apache CXF 3.0.4" "-" [09/Mar/2016:11:14:35 +0300] 127.0.0.1:443 127.0.0.1 "GET /ping HTTP/1.0" 200 "-" "KeepAliveClient" "-" "companyuid=-" - 273 0.146 0.146 [09/Mar/2016:11:14:34 +0300] st.company-realm.ru 127.0.0.1 "GET /ping HTTP/1.0" 200 "-" "KeepAliveClient" "-" "companyuid=-" - 236 0.000 0.000 2002:6b8:0:2807:e18e:6d1d:86a9:400f - shishkin [09/Mar/2016:11:00:17 +0300] "GET /relev/relev.pl?action=show&ncrnd=4555 HTTP/1.1" 200 200 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:44.0) Gecko/20100101 Firefox/44.0"
There are events from different web server logs (see below).
What can you tell about each row? What is happening in each row? What might be interesting in case of incident investigation?
timestamp="09/Mar/2016:11:14:34 +0300" client_ip="73.9.84.166" user_agent="Debian APT-HTTP/1.3 (0.8.16~exp12ubuntu10.26)" url="/precise-security/stable/amd64/Packages.bz2"
[09/Mar/2016:11:14:35 +0300] wiki-api.company-realm.ru 25.255.240.122 "GET /_api/frontend/.is_readonly?=&__uid=1120000000006167 HTTP/1.1" 200 "-" "-" "ivanovaa" "companyuid=5986251411438764783" - 717 0.022 0.022
[09/Mar/2016:11:14:35 +0300] fml.company-realm.ru 202a:6b8:b010:2048:0:d0c0:5:12 "GET /rest/v2/call/collectPoolFromQueriesRatings/32b86116-e409-11e5-bdc7-0025909427cc?ticket=3201127 HTTP/1.1" 414 "-" "Apache CXF 3.0.4" "-"
[09/Mar/2016:11:14:35 +0300] 127.0.0.1:443 127.0.0.1 "GET /ping HTTP/1.0" 200 "-" "KeepAliveClient" "-" "companyuid=-" - 273 0.146 0.146
[09/Mar/2016:11:14:34 +0300] st.company-realm.ru 127.0.0.1 "GET /ping HTTP/1.0" 200 "-" "KeepAliveClient" "-" "companyuid=-" - 236 0.000 0.000
2002:6b8:0:2807:e18e:6d1d:86a9:400f - shishkin [09/Mar/2016:11:00:17 +0300] "GET /relev/relev.pl?action=show&ncrnd=4555 HTTP/1.1" 200 200 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:44.0) Gecko/20100101 Firefox/44.0"
Step by step
Solved in 8 steps