wtmpreport

Linux log analysis tool for wtmp and secure logs with HTML/PDF reporting.

Overview

Parses system authentication logs (wtmp and secure) into a structured SQLite database, then generates detailed HTML and PDF reports with matplotlib visualizations. Designed for system administrators and forensic investigators.

Features

• Log Parsing: Handles wtmp (binary) and secure (text) logs, including rotated and .gz compressed files
• Event Extraction:
  • Login sessions from wtmp (user, terminal, host)
  • Authentication attempts from secure (accepted/failed, IP, service)
  • Sudo command usage from secure (user, command, target)
• Reporting: HTML + PDF summary, monthly breakdowns, and error reports
• Visualization: Bar charts, pie charts, and login timeline via matplotlib
• Database: SQLite with WAL mode for safe, indexed storage

Installation

git clone https://github.com/arielarigossi/linux-wtmpreport.git
cd linux-wtmpreport

python -m venv venv
source venv/bin/activate

pip install -e .

Dependencies

• Python >= 3.9
• matplotlib >= 3.5
• weasyprint >= 57

Usage

# Via installed script
wtmpreport

# Via module
python -m wtmpreport

The tool will:

1. Prompt for the log directory (default: /var/log/)
2. Infer the time range from wtmp files (or let you specify one)
3. Parse all wtmp and secure files in range
4. Generate charts, reports, and a database in a timestamped output directory

Running as root

Reading wtmp and secure files typically requires root privileges:

sudo wtmpreport

Output Structure

report-YYYYMMDD-HHMMSS_PID/
  index.html              # Main report
  report_principal.pdf    # Main report (PDF)
  report_YYYY-MM.html     # Monthly reports
  report_YYYY-MM.pdf      # Monthly PDFs
  chart_*.png             # Visualization charts
  errors.txt              # Parsing errors
  analysis.db             # SQLite database

Project Structure

src/wtmpreport/
  __init__.py       # Package metadata
  __main__.py       # python -m entry point
  cli.py            # User interaction and workflow orchestration
  config.py         # Constants, data models, custom exceptions
  wtmp_parser.py    # Binary wtmp file parser
  secure_parser.py  # Secure log text parser
  database.py       # SQLite storage and queries
  charts.py         # Matplotlib chart generation
  reports.py        # HTML and PDF report generation

Database Schema

Table	Description
logins	User login sessions (user, time, terminal, host)
auth_attempts	Auth events (user, service, IP, result)
sudo_commands	Sudo usage (user, command, target, pwd)
errors	Out-of-range or malformed entries

License

MIT