Apache Access Log Detections Mod for Powerpipe

View dashboards, run detections and scan for anomalies across your Apache access logs.

Documentation

• Dashboards →
• Benchmarks and detections →

Getting Started

Installation

Install Powerpipe (https://powerpipe.io/downloads), or use Brew:

brew install turbot/tap/powerpipe

Install the mod:

mkdir dashboards
cd dashboards
powerpipe mod install github.com/turbot/tailpipe-mod-apache-access-log-detections

This mod also requires Tailpipe with the Apache plugin.

Install Tailpipe (https://tailpipe.io/downloads), or use Brew:

brew install turbot/tap/tailpipe
tailpipe plugin install apache

Configuration

Configure your log source:

vi ~/.tailpipe/config/apache.tpc

partition "apache_access_log" "test" {
  source "file"  {
    paths = ["/Users/mscott/apache_access_log"]
    file_layout = "%{DATA}.log"
  }
}

Log Collection

Collect logs:

tailpipe collect apache_access_log

When running tailpipe collect for the first time, logs from the last 7 days are collected. Subsequent tailpipe collect runs will collect logs from the last collection date.

You can override the default behaviour by specifying --from:

tailpipe collect apache_access_log --from 2025-01-01

You can also use relative times. For instance, to collect logs from the last 60 days:

tailpipe collect apache_access_log --from T-60d

Please note that if you specify a date in --from, Tailpipe will delete any collected data for that partition starting from that date to help avoid gaps in the data.

For additional examples on using tailpipe collect, please see tailpipe collect reference documentation.

Browsing Dashboards

Start the dashboard server:

powerpipe server

Browse and view your dashboards at http://localhost:9033.

Running Benchmarks in Your Terminal

Instead of running benchmarks in a dashboard, you can also run them within your terminal with the powerpipe benchmark command:

List available benchmarks:

powerpipe benchmark list

Different output formats are also available, for more information please see Output Formats.

Open Source & Contributing

This repository is published under the Apache 2.0 license. Please see our code of conduct. We look forward to collaborating with you!

Tailpipe and Powerpipe are products produced from this open source software, exclusively by Turbot HQ, Inc. They are distributed under our commercial terms. Others are allowed to make their own distribution of the software, but cannot use any of the Turbot trademarks, cloud services, etc. You can learn more in our Open Source FAQ.

Get Involved

Join #tailpipe and #powerpipe on Slack →

Want to help but don't know where to start? Pick up one of the help wanted issues:

• Powerpipe
• Tailpipe
• Apache Access Log Detections Mod