Facebook
TwitterI first posted this in a forum thread – Resources seems the better home for it. Discussion and questions are welcome there or here of course:
talk.plesk.com
What it is
A single bash script that runs via cron and writes a short report on what happened on your Plesk server since the last run. It only reads logs and system state – it never changes your server.
Optionally it uploads the reports with rclone (e.g. to Google Drive) – and that's where it really shines: an AI assistant reads the latest report and a 24-hour summary every morning and tells you in a few lines whether anything needs your attention. The reports are written for exactly that. The README has an example prompt.
What it catches (a few examples)
- A compromised mailbox: mass sending, logins from new countries (also IMAP/POP3), sender different from login
- Delivery problems: Gmail/Microsoft/Apple/GMX/T-Online rejections and rate limits, blocklists, deliveries per provider
- A customer banned by fail2ban because of an old password on some device – they vanish from the logs exactly when they can't fetch mail any more
- Hacked websites: PHP files in upload folders, backdoor code patterns, config files and backups reachable from the web, WordPress brute force with successful logins
- Daily: certificates, SPF/DKIM/DMARC, HSTS and http to https, DNS, backups, pending updates
Works with Dovecot and Courier. Tested on Debian with Plesk Obsidian; Ubuntu and RHEL-based should work (feedback welcome).
Installation takes one command and needs no configuration – see the README for install, cron, upload and all options:
github.com
Input - I built a plesk-server-report for hourly analysis, maybe someone finds it useful
After php2shell, I built a server report that runs every hour to monitor whats going on. I am not sure yet if this really detects malicious code on my server (I haven't been hacked) but I think it should. At least, it should recognize hacked wordpress installs or misused email accounts. Maybe...
talk.plesk.com
What it is
A single bash script that runs via cron and writes a short report on what happened on your Plesk server since the last run. It only reads logs and system state – it never changes your server.
Optionally it uploads the reports with rclone (e.g. to Google Drive) – and that's where it really shines: an AI assistant reads the latest report and a 24-hour summary every morning and tells you in a few lines whether anything needs your attention. The reports are written for exactly that. The README has an example prompt.
What it catches (a few examples)
- A compromised mailbox: mass sending, logins from new countries (also IMAP/POP3), sender different from login
- Delivery problems: Gmail/Microsoft/Apple/GMX/T-Online rejections and rate limits, blocklists, deliveries per provider
- A customer banned by fail2ban because of an old password on some device – they vanish from the logs exactly when they can't fetch mail any more
- Hacked websites: PHP files in upload folders, backdoor code patterns, config files and backups reachable from the web, WordPress brute force with successful logins
- Daily: certificates, SPF/DKIM/DMARC, HSTS and http to https, DNS, backups, pending updates
Works with Dovecot and Courier. Tested on Debian with Plesk Obsidian; Ubuntu and RHEL-based should work (feedback welcome).
Installation takes one command and needs no configuration – see the README for install, cron, upload and all options:
GitHub - cmelius/plesk-monitoring-server-Report: A single bash script for a Plesk server on Linux that writes an hourly health and security report (optionally) uploads it to cloud storage with rclone.
A single bash script for a Plesk server on Linux that writes an hourly health and security report (optionally) uploads it to cloud storage with rclone. - cmelius/plesk-monitoring-server-Report
github.com