Input I built a plesk-server-report for hourly analysis, maybe someone finds it useful

[Mehl]

Server operating system version

Debian, Ubuntu, RHEL

Plesk version and microupdate number

18.0.81 #4

After php2shell, I built a server report that runs every hour to monitor whats going on.
I am not sure yet if this really detects malicious code on my server (I haven't been hacked) but I think it should.
At least, it should recognize hacked wordpress installs or misused email accounts.
Maybe some of you find it useful. Grab it here:

GitHub - cmelius/plesk-monitoring-server-Report: A single bash script that writes an hourly health and security report for a Plesk server and (optionally) uploads it to cloud storage with rclone.

A single bash script that writes an hourly health and security report for a Plesk server and (optionally) uploads it to cloud storage with rclone. - cmelius/plesk-monitoring-server-Report

github.com

There, you can see an example-report and instructions on how to install.

I use a planned task in my claude (daily) to analyze and send me a report if something suspicious is happening on my server, but the reports are also nicely readable in plain text.

have fun ...

 

[Mehl]

The script is evolving and now does a lot more than security. It checks SPF, DKIM and DMARC (including SPF errors that cause hard rejects), reverse DNS, the mail server’s TLS certificates, and whether each domain’s DNS still points to the server. It also tracks mail sent through Roundcube webmail with the sender’s real IP. New since the first release: WordPress brute-force analysis (it even spots a successful login after failed attempts), a local country and network lookup for every login with alerts for unexpected countries, checks for CAA, broken DNSSEC and domain blocklists (Spamhaus DBL/SURBL), and optional IPv6 support. Users of other CMSs can help add support through an issue template on GitHub.

 

[Mehl]

Update: the script has grown up a bit since my last post – it's now at v1.2.0, v1.3.0 follows in the next days.

Not sure if this is overengineered, but I learned a lot about my server while developing it. Yes, there are extensions that actively block, but I wanted a read-only tool that only reports. A daily review by my AI agent (reading latest.txt and summary.txt) helps me react faster and fix things before a client complains about emails not being delivered.

The biggest change is under the hood: the script is now safe to run unattended on servers that differ from mine. Every external command and file scan has a time limit, a cron run can't hang or overlap, log reading is capped, and it runs with low CPU/IO priority. If anything goes wrong (timeout, missing log, unknown log format), the report says so instead of silently showing "0".

New since my last post:

Mail
- Courier IMAP/POP3 support. Until now only Dovecot's log format was recognized, so on Courier servers failed IMAP/POP3 logins showed as 0. Worth checking on your own server: Plesk's default fail2ban jails cover Dovecot, but the plesk-courierimap jail was switched off on mine. Before you switch it on, look for your customers' IPs in the failed logins – a phone with an old password retries every few seconds and gets the whole office banned.
- Country check for successful IMAP/POP3 logins. A mailbox logging in from a new country outside your allowed list raises one alert per mailbox and country (not in every run while someone is on holiday), forgotten after 30 days.
- Outgoing deliveries per provider (Microsoft, Google, Apple iCloud, GMX/web.de, T-Online, Yahoo, …) with sent / deferred / bounced, plus detection of the rejection wording of the big providers (rate limiting, "likely unsolicited", DMARC rejections, …). You see reputation problems before customers complain.
- Watched recipient domains: every deferral or bounce to a business-critical recipient (e.g. your customers' accounting service) raises an alert with the remote reply.
- Spam filter line: mails above SpamAssassin's size limit are not scanned at all – the report shows how many and what the limit is.

Logins
- Plesk panel logins are now read from the panel's access log (httpsd_access_log). panel.log doesn't contain login events, so my earlier version never saw them. Successful logins with IP and country, alert for unknown IPs, count of failed attempts.

Reviewing
- summary.txt: a condensed summary of the last 24 hours next to latest.txt. A daily review (by you or an AI assistant) needs two files instead of every report.

It still needs no configuration – install, add the cron job, done. Everything else is optional.

Changelog: plesk-monitoring-server-Report/CHANGELOG.md at main · cmelius/plesk-monitoring-server-Report

Repo: GitHub - cmelius/plesk-monitoring-server-Report: A single bash script that writes an hourly health and security report for a Plesk server and (optionally) uploads it to cloud storage with rclone.

Feedback welcome – especially from servers with a different OS or setup than mine (Debian 13, Plesk Obsidian, Courier).