Software Map

SRG (Squid Report Generator) is a log file
analyzer and report generator for the Squid Web
proxy. It was created to allow easy integration
with authentication systems such as those that are
used for squid itself. It is fast and flexible,
and can report details down to the individual
files fetched.

lwatch is a log parser/analyzer written in C with the PCRE library. It is small and efficient. You are able to define your own colors using regexp patterns. The biggest advantage compared to other tools written in Perl is its speed.

NISCA (Network Interface Statistics Collection Agent) is a more flexible PHP4-based MRTG replacement. It supports both SNMP and reading localhost's /proc/net/dev device file directly for statistics gathering. It uses MySQL to store collected data in, and stores statistics for bytes transferred, packets transferred, transfer errors, and dropped packets separated into a per interface incoming and outgoing set. It generates both graphs and a textual report table using the data from any timeframe contained in the database. The entire package runs using PHP4; it uses the CGI binary version of PHP for stats collection (running in the background as a "daemon") and either the CGI or Apache module versions to generate the GUI form and reports. It can also import existing MRTG logfiles.

Qmail-Scanner Statistics (QSS) uses the Qmail-Scanner Logfile to generate
daily, monthly, and yearly statistics. It also shows a complete list of viruses
stopped by Qmail-Scanner, the top five domains from which the viruses came, as
well as the countries of origin.

Pathalizer is a tool for visualizing the paths
most users take when browsing a Web site.
This information can be used to decide how to
improve the navigation of the site, and for
determining which parts are most worth
improving and keeping up to date. It
generates a directed, weighed graph from an
Apache log, but could easily be modified to
analyze any list of events.

The msn-proxy is a lightweight transparent proxy
for MSN Messenger clients. It allows you to
control and monitor the use of Messenger on your
network.

Stager is a system for aggregating and presenting
network statistics. Though tailored for using NetFlow data from the flow-tools package, it is generic and can be
customized to present and process any kind of
network statistics. The backend collects data with
flow-tools and stores reports in a database,
automatically handling the aggregation of hourly
statistics into days, weeks, and months. The Web
frontend presents data in tables, matrices, or plots.
The reports are fully customizable, and their
definitions are stored in the database.

Petit was developed to quickly analyze syslog and Apache log files in large environments. It can also be used for word discovery within log data. It is a general purpose tool that can do hashing, word counts, and command line graphing of Apache and syslog files. It is designed to be a standard Unix tool that can be employed with pipes or by opening files. Petit works by sifting data with standard patterns and allows for custom filters and fingerprints. This leaves the analyst with data that is both varied and interesting.

ttyrpld is a multi-OS kernel-level tty key and screen logger. Recorded sessions can be followed live or replayed at a later time. Supported platforms are Linux, Solaris, FreeBSD, NetBSD, and OpenBSD.

Qmrtg is a modular tool to help monitoring the
activity of software processes. It's intended to be
used with MRTG. It was originally written for monitoring qmail servers, but its modules are general enough to parse any kind of log file passed through multilog (see daemontools). QMRTG is modular. Each module carries out a different log analysis. A super-module lets the user easily request any analysis without having to know anything about the modules themselves. QMRTG is a modern alternative to qmailmrtg7.

Nmap Parser is a Perl module to ease the pain of
developing scripts or collecting network
information from nmap scans. Nmap::Parser does its task by parsing the information in the output of an nmap scan by using the XML-formatted output. This module can perform an nmap scan and parse the output automagically using parsescan(). It can parse an nmap XML file. This module was developed to speed up network security tool development when using nmap.

stdnoj is a cross-platform C++ class library that
includes classes for using portable strings,
databases, SMTP, POP, NNTP, arrays, files,
directories, logging, email, and sockets. While
templates are used, no reliance upon STL or other
(traditionally error-prone) technologies has been
used, which increases portability between
compilers.

Fido is a multi-threaded file watcher which searches files in real time for user-defined patterns. When it locates a match, it runs a user-defined program. It is useful for monitoring log files for issues and responding to them. It was designed to recognize log file rotation and start monitoring from the beginning of the new file.

MySQL Squid Access Report, "mysar" for short, is a system for near-realtime monitor of user Web activity, using Squid's log file.