As we saw in the previous scenario, the first point of attack was the externally-hosted application server. Let's see what sort of logs are generated by common application servers, such as Apache and NGINX, and what we can deduce from those logs:
In the preceding screenshot, we can see the Apache access logs file that reside mostly on the /var/log/apache2/access.log path. We can see a variety of incoming requests to the application. However, we can see that the logs are kept in a particular format, which is the IP address followed by the date and time, request type, requested resource file, HTTP version, response code, ...
