Where can I find documentation on analyzing user behavior from logs?

Question

Nginx

Suggest articles for studying the topic on analyzing Nginx or Apache logs to detect abnormal client behavior. To identify robots / parsers / scriptkiddies
I would like to take a ready-made solution for analysis or read methods for determining to implement such a program.

Answer 1

As far as I know, such decisions are usually based on realtime, not logs. Are you sure this is a required requirement?

Answer 2

To analyze user behavior, you need to collect statistics on the actions of these users. Example: A user has registered and made a payment. You cannot remove such a status from the web server logs. There are smarter trackers like piwik. For complex cases - logging is done manually.

Answer 3

The task was set incorrectly. Try to reformulate from "I want to find something strange in the logs" to "I want to find such and such specific anomalies in the logs."
In general, there are a lot of articles on the topic of anomaly detection, choose according to the task.