Cannot view web server logs in Server Admin

Question

It has been a terrible day.
First, the interesting part:
I woke up to find that 25 sites that are hosted on an XServe G5 running OS X Server 10.3.9 had been defaced. As the part-time, unpaid admin of this server, it was my responsibility to track down the vulnerability in the system and restore the defaced files from backups. The hacker had replaced the index.html file for each of the sites with his own, special version, in which he proudly declared that my server had been owned. I did a Nessus scan of the server and came up with nothing. I pulled what was left of my hair out looking for every vulnerability I could come up with, and still nothing.
I then decided to use Google to get more information about him, using the name he proudly posted on the defaced sites, and was able to get his IM address. I proceeded to have an awkwardly pleasant conversation with him, in which he declared that he has discovered a new vulnerability and decided to try it out on my machine for the challenge. He apologized, but would not reveal the vulnerability (although he hinted that it had something to do with mod_security). He also promised to leave my machine alone now ....
(Now for the not so interesting part, and the nature of my current problem)
Anyway, I did what I could to clean up the mess, and wound up viewing the access logs in the Console app via ARD. That led me nowhere, so I decided to call it a night and logged out of ARD. A few minutes later, I thought I would log into ServerAdmin and take another look at those logs, but alas, they could no longer be viewed through ServerAdmin! The log section is empty. I ssh'd into the machine to see if he had broken his promise and messed around some more, but the logs still existed where they had always been. I ran tail -f on them to make sure they are still being updated, and they are.
So after all that, it seems my big problem at the moment is viewing logs in ServerAdmin. I did not make any changes to httpd.conf (outside of disabling mod_security, which commented out the appropriate LoadModule and AddModule lines). I also disabled a few other unnecessary mods earlier in the evening via ServerAdmin, but I doubt that any particular mod controls whether or not I can view log files in ServerAdmin.
I apologize for the length of this post, but it has been quite a day. If anyone can provide any clues as to either the location of error logs for the ServerAdmin app or any sort of known resolution to this issue, I would name my first born after you.
Thanks.
XServe G5   Mac OS X (10.3.9)  

Answer 1

skvaish1 wrote:
What purpose you will solve by loading the web server logs into the database? I will not advice it. It will be much easier for you to manage these logs at file system level as well monitor these for any issues, rather than loading it into database and then running sone database job to dig into those logs for any errors. Loading logs into database will help if you need to keep them for long time (More than 1 Year time frame or for regulatory purpose), otherwise it is better for logs to keep it on file system and just get regular backups of these logs into tape.
My 2 cents
RegardsOverall, I agree but I don't understand your comment about "Loading logs into database will help if you need to keep them for long time". Even if needed for regulatory reasons, one can manage them quite nicely outside of the database.
Also to expand on this a bit for the OP .... if the need arose to use SQL to mine the logs for information that would be hard to get using the search feature of a simple text editor, one could always define an external table on an as-needed basis.