{"id":25528,"date":"2026-08-28T15:03:44","date_gmt":"2026-08-28T21:03:44","guid":{"rendered":"https:\/\/sada.services\/?p=25528"},"modified":"2026-08-28T15:49:22","modified_gmt":"2026-08-28T21:49:22","slug":"3-hpc-ejemplo-analisis-de-log","status":"publish","type":"post","link":"https:\/\/sada.services\/?p=25528","title":{"rendered":"3. HPC: ejemplo analisis de log"},"content":{"rendered":"\n<ul class=\"wp-block-list\">\n<li>para este ejemplo vamos a analizar un log real de tomcat del sistema sigesa<\/li>\n\n\n\n<li>Nos conectamos al servidor prod.sigesa-n01 y vamos al log de user tomcat<\/li>\n\n\n\n<li>Vemos los log vamos a trabajar con localhost_access como podemos ver pesa 15M<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-large\"><img fetchpriority=\"high\" decoding=\"async\" width=\"1024\" height=\"219\" src=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-128-1024x219.png\" alt=\"\" class=\"wp-image-25529\" srcset=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-128-1024x219.png 1024w, https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-128-300x64.png 300w, https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-128-768x164.png 768w, https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-128-1536x329.png 1536w, https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-128.png 1818w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li>este archivo tiene muchos chequeos del F5 verificando si el servicio esta arriba contestando 200 (si)<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>head -50 localhost_access_log.2026-08-19.txt<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" width=\"1024\" height=\"239\" src=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-129-1024x239.png\" alt=\"\" class=\"wp-image-25530\" srcset=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-129-1024x239.png 1024w, https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-129-300x70.png 300w, https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-129-768x179.png 768w, https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-129.png 1272w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Entonces vamos a separar el archivo para ver el ruido y datos reales<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code># Tr\u00e1fico \"ruido\" (health checks y monitoreo)\ngrep -E 'monitorf5\\.xhtml|\/health|\/ping|\/status' localhost_access_log.2026-08-19.txt &gt; tomcat_ruido.log\n\n# Tr\u00e1fico real (todo lo dem\u00e1s)\ngrep -vE 'monitorf5\\.xhtml|\/health|\/ping|\/status' localhost_access_log.2026-08-19.txt &gt; tomcat_real.log\n\n# Ver la proporci\u00f3n\nwc -l localhost_access_log.2026-08-19.txt tomcat_ruido.log tomcat_real.log<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" width=\"1024\" height=\"139\" src=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-130-1024x139.png\" alt=\"\" class=\"wp-image-25531\" srcset=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-130-1024x139.png 1024w, https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-130-300x41.png 300w, https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-130-768x105.png 768w, https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-130.png 1373w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"686\" height=\"64\" src=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-132.png\" alt=\"\" class=\"wp-image-25533\" srcset=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-132.png 686w, https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-132-300x28.png 300w\" sizes=\"(max-width: 686px) 100vw, 686px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"740\" height=\"163\" src=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-131.png\" alt=\"\" class=\"wp-image-25532\" srcset=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-131.png 740w, https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-131-300x66.png 300w\" sizes=\"(max-width: 740px) 100vw, 740px\" \/><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li>ahora por seguridad ya que vamos a subir el archivo a una infra que no es nuestra vamos a eliminar datos sensibles si es que existen<\/li>\n\n\n\n<li>Creamos el archivo<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>nano hpc_anonimizar_log_prueba_tavo.py<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>le pegamos<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code># anonimizar.py\nimport hashlib\nimport re\nimport sys\n\nIP_RE = re.compile(r'\\b(?:\\d{1,3}\\.){3}\\d{1,3}\\b')\n\ndef es_interna(ip):\n    p = ip.split('.')\n    return (\n        p&#91;0] == '10'\n        or (p&#91;0] == '192' and p&#91;1] == '168')\n        or (p&#91;0] == '172' and 16 &lt;= int(p&#91;1]) &lt;= 31)\n        or p&#91;0] == '127'\n    )\n\ndef anon(match):\n    ip = match.group(0)\n    prefijo = 'INT' if es_interna(ip) else 'EXT'\n    h = hashlib.sha256(ip.encode()).hexdigest()&#91;:8]\n    return f'{prefijo}_{h}'\n\nwith open(sys.argv&#91;1]) as f_in, open(sys.argv&#91;2], 'w') as f_out:\n    for linea in f_in:\n        f_out.write(IP_RE.sub(anon, linea))<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>lo ejecutamos<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code># Anonimizar solo tomcat_real.log\npython3 hpc_anonimizar_log_prueba_tavo.py tomcat_real.log tomcat_real_anon.log<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"52\" src=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-133-1024x52.png\" alt=\"\" class=\"wp-image-25534\" srcset=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-133-1024x52.png 1024w, https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-133-300x15.png 300w, https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-133-768x39.png 768w, https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-133.png 1099w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Verificar cu\u00e1nto pesa y cu\u00e1ntas l\u00edneas quedan<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>du -h tomcat_real_anon.log\nwc -l tomcat_real_anon.log<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"619\" height=\"118\" src=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-134.png\" alt=\"\" class=\"wp-image-25535\" srcset=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-134.png 619w, https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-134-300x57.png 300w\" sizes=\"(max-width: 619px) 100vw, 619px\" \/><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Como es tan peque\u00f1o lo vamos a inflar<\/li>\n\n\n\n<li>Inflar hasta ~500 MB (ajusta el multiplicador seg\u00fan el tama\u00f1o real)<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>for i in {1..100}; do cat tomcat_real_anon.log; done &gt; tomcat_big.log\ndu -h tomcat_big.log<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Queda de un 1GB<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"96\" src=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-135-1024x96.png\" alt=\"\" class=\"wp-image-25536\" srcset=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-135-1024x96.png 1024w, https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-135-300x28.png 300w, https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-135-768x72.png 768w, https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-135.png 1040w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Ingresamos a Helix al home de mis ejemplos<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>\/home\/gustavo.matamoros.gonzalez\/curso_hpc\/mios<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>creamos nueva carpeta<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>mkdir -p ej2_logs_reales<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>ingresamos<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>cd ej2_logs_reales<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>ahora de sigesa subimos el archivo<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>scp tomcat_big.log gustavo.matamoros.gonzalez@10.10.132.5:~\/curso_hpc\/mios\/ej2_logs_reales<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"956\" height=\"68\" src=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-136.png\" alt=\"\" class=\"wp-image-25537\" srcset=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-136.png 956w, https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-136-300x21.png 300w, https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-136-768x55.png 768w\" sizes=\"(max-width: 956px) 100vw, 956px\" \/><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Subimos los otros<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>scp tomcat_real_anon.log  gustavo.matamoros.gonzalez@10.10.132.5:~\/curso_hpc\/mios\/ej2_logs_reales\n\nscp tomcat_ruido.log   gustavo.matamoros.gonzalez@10.10.132.5:~\/curso_hpc\/mios\/ej2_logs_reales<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"128\" src=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-137-1024x128.png\" alt=\"\" class=\"wp-image-25538\" srcset=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-137-1024x128.png 1024w, https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-137-300x37.png 300w, https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-137-768x96.png 768w, https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-137.png 1355w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Primero verificamos si tenemos el modulo de python<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>module avail<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Pero no esta<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>module avail | grep pyth<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\"><\/ul>\n\n\n\n<ul class=\"wp-block-list\"><\/ul>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"323\" src=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-138-1024x323.png\" alt=\"\" class=\"wp-image-25543\" srcset=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-138-1024x323.png 1024w, https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-138-300x95.png 300w, https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-138-768x242.png 768w, https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-138-1536x484.png 1536w, https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-138.png 1916w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Entonces vamos a utilizar Anaconda que es python + un mont\u00f3n de librer\u00edas cient\u00edficas<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>module load Anaconda\nwhich python\npython --version\npython -c \"import re, collections, sys; print('todo ok')\"<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"168\" src=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-139-1024x168.png\" alt=\"\" class=\"wp-image-25544\" srcset=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-139-1024x168.png 1024w, https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-139-300x49.png 300w, https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-139-768x126.png 768w, https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-139.png 1285w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Creamos el archivo<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>nano ~\/curso_hpc\/mios\/ej2_logs_reales\/parser.py<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Agregamos<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>#!\/usr\/bin\/env python3\n\"\"\"Parser serial de access log Tomcat. Reporta m\u00e9tricas \u00fatiles.\"\"\"\nimport re\nimport sys\nimport time\nfrom collections import Counter, defaultdict\n\n# Regex para el formato: IP1 IP2 - - &#91;timestamp] \"M\u00c9TODO URL PROTO\" c\u00f3digo bytes\n# Regex para el formato: IP1 IP2 - - &#91;timestamp] \"M\u00c9TODO URL PROTO\" c\u00f3digo bytes\nLINE_RE = re.compile(\n    r'^(\\S+)\\s+'                              # IP front (proxy)\n    r'((?:\\S+,\\s+)*\\S+)\\s+'                   # IP client (puede ser lista con comas)\n    r'\\S+\\s+\\S+\\s+'                           # identd y user (siempre \"-\")\n    r'\\&#91;(&#91;^\\]]+)\\]\\s+'                        # timestamp\n    r'\"(\\S+)\\s+(\\S+)(?:\\s+\\S+)?\\s*\"\\s+'       # m\u00e9todo + URL\n    r'(\\d+)\\s+'                               # c\u00f3digo HTTP\n    r'(\\S+)'                                  # bytes\n)\n\n\ndef parse_log(path):\n    ip_front  = Counter()\n    ip_client = Counter()\n    endpoints = Counter()\n    metodos   = Counter()\n    codigos   = Counter()\n    por_hora  = Counter()\n    bytes_por_endpoint = defaultdict(int)\n\n    total = 0\n    malformadas = 0\n\n    with open(path, 'r', encoding='utf-8', errors='replace') as f:\n        for linea in f:\n            total += 1\n            m = LINE_RE.match(linea)\n            if not m:\n                malformadas += 1\n                continue\n\n            ip1, ip2, ts, metodo, url, codigo, tam = m.groups()\n\n            ip_front&#91;ip1] += 1\n            ip_client&#91;ip2] += 1\n            endpoints&#91;url] += 1\n            metodos&#91;metodo] += 1\n            codigos&#91;codigo] += 1\n\n            # Hora del d\u00eda: extrae \"HH\" de \"19\/Aug\/2026:03:28:07 -0600\"\n            try:\n                hora = ts.split(':')&#91;1]\n                por_hora&#91;hora] += 1\n            except IndexError:\n                pass\n\n            if tam.isdigit():\n                bytes_por_endpoint&#91;url] += int(tam)\n\n    return {\n        'total': total,\n        'malformadas': malformadas,\n        'ip_front': ip_front,\n        'ip_client': ip_client,\n        'endpoints': endpoints,\n        'metodos': metodos,\n        'codigos': codigos,\n        'por_hora': por_hora,\n        'bytes_por_endpoint': bytes_por_endpoint,\n    }\n\ndef imprimir_reporte(r):\n    print(f\"\\n=== RESUMEN ===\")\n    print(f\"Total l\u00edneas:       {r&#91;'total']:,}\")\n    print(f\"L\u00edneas malformadas: {r&#91;'malformadas']:,}\")\n    print(f\"IPs front \u00fanicas:   {len(r&#91;'ip_front']):,}\")\n    print(f\"IPs cliente \u00fanicas: {len(r&#91;'ip_client']):,}\")\n    print(f\"Endpoints \u00fanicos:   {len(r&#91;'endpoints']):,}\")\n\n    print(f\"\\n=== TOP 10 ENDPOINTS ===\")\n    for url, n in r&#91;'endpoints'].most_common(10):\n        print(f\"  {n:>10,}  {url}\")\n\n    print(f\"\\n=== M\u00c9TODOS HTTP ===\")\n    for m, n in r&#91;'metodos'].most_common():\n        print(f\"  {n:>10,}  {m}\")\n\n    print(f\"\\n=== C\u00d3DIGOS HTTP ===\")\n    for c, n in sorted(r&#91;'codigos'].items()):\n        print(f\"  {n:>10,}  {c}\")\n\n    print(f\"\\n=== TOP 10 IPs CLIENTE ===\")\n    for ip, n in r&#91;'ip_client'].most_common(10):\n        print(f\"  {n:>10,}  {ip}\")\n\n    print(f\"\\n=== DISTRIBUCI\u00d3N POR HORA ===\")\n    for h in sorted(r&#91;'por_hora']):\n        n = r&#91;'por_hora']&#91;h]\n        barra = '\u2588' * int(n * 40 \/ max(r&#91;'por_hora'].values()))\n        print(f\"  {h}:00  {n:>10,}  {barra}\")\n\n    print(f\"\\n=== TOP 10 ENDPOINTS POR VOLUMEN (bytes) ===\")\n    top_bytes = sorted(r&#91;'bytes_por_endpoint'].items(), key=lambda x: -x&#91;1])&#91;:10]\n    for url, b in top_bytes:\n        mb = b \/ (1024 * 1024)\n        print(f\"  {mb:>10,.1f} MB  {url}\")\n\nif __name__ == '__main__':\n    if len(sys.argv) != 2:\n        print(f\"Uso: {sys.argv&#91;0]} &lt;archivo.log>\", file=sys.stderr)\n        sys.exit(1)\n\n    inicio = time.time()\n    resultados = parse_log(sys.argv&#91;1])\n    duracion = time.time() - inicio\n\n    imprimir_reporte(resultados)\n\n    print(f\"\\n=== TIEMPO ===\")\n    print(f\"Duraci\u00f3n parsing:  {duracion:.2f} s\")\n    print(f\"L\u00edneas por segundo: {resultados&#91;'total']\/duracion:,.0f}\")<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Dale permisos:<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>chmod +x parser.py<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>creamos el archivo<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>nano ej2_logs_reales.sbatch<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>contenido<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>#!\/bin\/bash\n#SBATCH --job-name=ej2_logs_reales\n#SBATCH --partition=debug\n#SBATCH --nodes=1\n#SBATCH --ntasks=1\n#SBATCH --cpus-per-task=1\n#SBATCH --time=00:30:00\n#SBATCH --output=ej2_logs_reales_%j.out\n#SBATCH --error=ej2_logs_reales_%j.err\n\necho \"=== INFO DEL JOB ===\"\necho \"Nodo:       $(hostname)\"\necho \"Job ID:     $SLURM_JOB_ID\"\necho \"CPUs:       $SLURM_CPUS_PER_TASK\"\necho \"Directorio: $SLURM_SUBMIT_DIR\"\necho \"Inicio:     $(date)\"\necho \"\"\n\nmodule load Anaconda\nwhich python\npython --version\necho \"\"\n\ncd $SLURM_SUBMIT_DIR\n\npython parser.py tomcat_big.log\n\necho \"\"\necho \"Fin: $(date)\"<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"530\" height=\"731\" src=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-140.png\" alt=\"\" class=\"wp-image-25545\" srcset=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-140.png 530w, https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-140-218x300.png 218w\" sizes=\"(max-width: 530px) 100vw, 530px\" \/><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Lanza el job<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>sbatch ej2_logs_reales.sbatch<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"81\" src=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-141-1024x81.png\" alt=\"\" class=\"wp-image-25546\" srcset=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-141-1024x81.png 1024w, https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-141-300x24.png 300w, https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-141-768x61.png 768w, https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-141.png 1026w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Ver progreso<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>squeue -u $USER<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"887\" height=\"70\" src=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-142.png\" alt=\"\" class=\"wp-image-25547\" srcset=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-142.png 887w, https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-142-300x24.png 300w, https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-142-768x61.png 768w\" sizes=\"(max-width: 887px) 100vw, 887px\" \/><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Podemos ver el contenido<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>cat ej2_logs_reales_39063.out<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>RESULTADO<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>=== INFO DEL JOB ===\nNodo:       n001.cluster.pssclabs.com\nJob ID:     39063\nCPUs:       1\nDirectorio: \/home\/gustavo.matamoros.gonzalez\/curso_hpc\/mios\/ej2_logs_reales\nInicio:     Fri Aug 28 14:19:55 PDT 2026\n\n\/opt\/miniconda3\/bin\/python\nPython 3.9.18\n\n\n=== RESUMEN ===\nTotal l\u00edneas:       6,996,300\nL\u00edneas malformadas: 116,400\nIPs front \u00fanicas:   3\nIPs cliente \u00fanicas: 268\nEndpoints \u00fanicos:   3,665\n\n=== TOP 10 ENDPOINTS ===\n     344,900  \/sigesa-webapp-1.0.0-SNAPSHOT\/pages\/boletaVacacionEditForm.xhtml\n     290,000  \/sigesa-webapp-1.0.0-SNAPSHOT\/pages\/loteEditForm.xhtml\n     275,800  \/sigesa-webapp-1.0.0-SNAPSHOT\/pages\/main.xhtml\n     216,400  \/sigesa-webapp-1.0.0-SNAPSHOT\/pages\/nombramientoEditForm.xhtml\n     199,400  \/sigesa-webapp-1.0.0-SNAPSHOT\/pages\/reintegroLiquidacionFondoEditForm.xhtml\n     156,000  \/sigesa-webapp-1.0.0-SNAPSHOT\/pages\/recepcionPedidoEditForm.xhtml\n     155,300  \/sigesa-webapp-1.0.0-SNAPSHOT\/pages\/registroBancarioEditForm.xhtml\n     144,900  \/sigesa-webapp-1.0.0-SNAPSHOT\/pages\/solicitudBienServicioEditForm.xhtml\n     129,400  \/sigesa-webapp-1.0.0-SNAPSHOT\/pages\/contratoBienServicioEditForm.xhtml\n     125,800  \/sigesa-webapp-1.0.0-SNAPSHOT\/pages\/analisisFormalOferenteEditForm.xhtml\n\n=== M\u00c9TODOS HTTP ===\n   5,434,700  POST\n   1,442,800  GET\n       2,400  OPTIONS\n\n=== C\u00d3DIGOS HTTP ===\n   6,659,000  200\n     129,700  302\n      11,300  304\n       1,200  400\n         100  401\n      28,700  403\n      48,200  404\n       1,700  500\n\n=== TOP 10 IPs CLIENTE ===\n     346,700  INT_1239bd83\n     282,500  EXT_f8e7083b\n     260,600  EXT_bdcfaa83\n     234,100  INT_4e7dbf23\n     193,900  INT_558e1d40\n     176,700  EXT_35ca3320\n     170,600  INT_47cf6f38\n     156,900  INT_491fe2bc\n     149,100  EXT_926fc875\n     133,300  -\n\n=== DISTRIBUCI\u00d3N POR HORA ===\n  03:00      32,500  \u2588\n  05:00       9,800  \n  06:00      45,100  \u2588\n  07:00     157,800  \u2588\u2588\u2588\u2588\u2588\u2588\n  08:00     497,700  \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\n  09:00     804,100  \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\n  10:00     939,800  \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\n  11:00     586,800  \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\n  12:00     202,900  \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\n  13:00     902,700  \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\n  14:00     929,900  \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\n  15:00     601,900  \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\n  16:00     631,800  \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\n  17:00     198,100  \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\n  18:00     151,000  \u2588\u2588\u2588\u2588\u2588\u2588\n  19:00      58,900  \u2588\u2588\n  20:00      50,700  \u2588\u2588\n  21:00      25,600  \u2588\n  22:00      39,500  \u2588\n  23:00      13,300  \n\n=== TOP 10 ENDPOINTS POR VOLUMEN (bytes) ===\n    16,241.3 MB  \/sigesa-webapp-1.0.0-SNAPSHOT\/pages\/nombramientoEditForm.xhtml\n    14,763.0 MB  \/sigesa-webapp-1.0.0-SNAPSHOT\/pages\/reintegroLiquidacionFondoEditForm.xhtml\n    14,144.5 MB  \/sigesa-webapp-1.0.0-SNAPSHOT\/pages\/boletaVacacionEditForm.xhtml\n    14,007.5 MB  \/sigesa-webapp-1.0.0-SNAPSHOT\/pages\/loteEditForm.xhtml\n    10,944.6 MB  \/sigesa-webapp-1.0.0-SNAPSHOT\/pages\/solicitudBienServicioEditForm.xhtml\n    10,014.1 MB  \/sigesa-webapp-1.0.0-SNAPSHOT\/pages\/recepcionPedidoEditForm.xhtml\n     9,976.3 MB  \/sigesa-webapp-1.0.0-SNAPSHOT\/pages\/contratoBienServicioEditForm.xhtml\n     9,415.4 MB  \/sigesa-webapp-1.0.0-SNAPSHOT\/pages\/registroBancarioEditForm.xhtml\n     7,508.6 MB  \/sigesa-webapp-1.0.0-SNAPSHOT\/pages\/analisisFormalOferenteEditForm.xhtml\n     7,439.3 MB  \/sigesa-webapp-1.0.0-SNAPSHOT\/pages\/main.xhtml\n\n=== TIEMPO ===\nDuraci\u00f3n parsing:  29.60 s\nL\u00edneas por segundo: 236,323\n\nFin: Fri Aug 28 14:20:25 PDT 2026<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"847\" src=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-143-1024x847.png\" alt=\"\" class=\"wp-image-25548\" srcset=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-143-1024x847.png 1024w, https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-143-300x248.png 300w, https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-143-768x635.png 768w, https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-143.png 1099w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Ver errores si hubo<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>cat ej2_logs_reales_39063.err<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1001\" height=\"70\" src=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-144.png\" alt=\"\" class=\"wp-image-25549\" srcset=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-144.png 1001w, https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-144-300x21.png 300w, https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-144-768x54.png 768w\" sizes=\"(max-width: 1001px) 100vw, 1001px\" \/><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Metricas de ejecucion<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>sacct -j 39063 -o JobID,JobName,State,Elapsed,MaxRSS,AllocCPUS,NodeList<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"94\" src=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-145-1024x94.png\" alt=\"\" class=\"wp-image-25550\" srcset=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-145-1024x94.png 1024w, https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-145-300x28.png 300w, https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-145-768x71.png 768w, https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-145.png 1413w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>sacct -j 39063 --format=JobID,JobName,State,Elapsed,TotalCPU,CPUTime,MaxRSS,ReqMem,AllocCPUS,NodeList<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"76\" src=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-148-1024x76.png\" alt=\"\" class=\"wp-image-25553\" srcset=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-148-1024x76.png 1024w, https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-148-300x22.png 300w, https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-148-768x57.png 768w, https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-148-1536x114.png 1536w, https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-148.png 1713w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"614\" height=\"155\" src=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-149.png\" alt=\"\" class=\"wp-image-25554\" srcset=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-149.png 614w, https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-149-300x76.png 300w\" sizes=\"(max-width: 614px) 100vw, 614px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"725\" height=\"172\" src=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-146.png\" alt=\"\" class=\"wp-image-25551\" srcset=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-146.png 725w, https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-146-300x71.png 300w\" sizes=\"(max-width: 725px) 100vw, 725px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"643\" height=\"27\" src=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-147.png\" alt=\"\" class=\"wp-image-25552\" srcset=\"https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-147.png 643w, https:\/\/sada.services\/wp-content\/uploads\/2026\/08\/image-147-300x13.png 300w\" sizes=\"(max-width: 643px) 100vw, 643px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Perfecto momento para cambiar de sombrero. Antes del cat\u00e1logo de ideas, hay una correcci\u00f3n importante sobre la intuici\u00f3n \u00abHPC alimenta fail2ban\u00bb:<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">HPC no es para fail2ban en tiempo real, pero S\u00cd para hacer que fail2ban sea inteligente<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">fail2ban reacciona en segundos, lee el log local, aplica reglas simples. Si intentaras \u00abcorrer fail2ban en HPC\u00bb, el job entra en cola, espera 30-60 segundos, arranca, procesa, y para cuando decide bloquear ya pas\u00f3 el ataque completo. Mala arquitectura.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Lo que s\u00ed es una arquitectura ganadora:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&#91;servidor Tomcat\/Apache]                     &#91;Helix HPC]\n      \u2502                                            \u2502\n      \u2502 fail2ban local con reglas SIMPLES          \u2502 an\u00e1lisis batch NOCTURNO\n      \u2502 (5 fallos de login en 60s \u2192 banea)         \u2502 7M l\u00edneas del d\u00eda, correlaciones\n      \u2502                                            \u2502 modelos de anomal\u00edas, ML\n      \u2502                                            \u2502\n      \u2502\u25c4\u2500\u2500\u2500\u2500 blocklist enriquecida diaria \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n      \u2502      (IPs con patrones sofisticados        \u2502\n      \u2502       que fail2ban solo no ve)             \u2502<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">fail2ban local caza lo obvio y en tiempo real. HPC caza lo sutil, lo lento, lo distribuido, lo que solo se ve mirando el d\u00eda completo \u2014 y le devuelve al firewall una lista de IPs para banear preventivamente. Es lo mejor de los dos mundos.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Lo que YA descubrimos hoy es evidencia del proyecto<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Fijate qu\u00e9 cosas \u00fatiles salieron de un log de un solo d\u00eda con parsing simple:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Errores operacionales detectables:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>1,700 respuestas 500 \u2192 hay bugs o problemas de infra que est\u00e1n pasando ahora mismo.<\/li>\n\n\n\n<li>Un balanceador que reporta la misma IP dos veces en X-Forwarded-For \u2192 misconfiguration real.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Se\u00f1ales de comportamiento an\u00f3malo:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>48k respuestas 404 \u2192 o hay muchos links rotos (mala UX) o alguien est\u00e1 escaneando.<\/li>\n\n\n\n<li>28k respuestas 403 \u2192 o la UI muestra botones que no deber\u00eda o hay probing de permisos.<\/li>\n\n\n\n<li>Una IP interna con 347k requests \u2192 \u00bfes un servicio no catalogado? \u00bfes un usuario con macro?<\/li>\n\n\n\n<li>Tr\u00e1fico a las 3 AM cuando la app es de RRHH y compras \u2192 sospechoso por definici\u00f3n.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>M\u00e9tricas de gesti\u00f3n:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Pico de 260 req\/s a las 10 AM \u2192 dimensionamiento.<\/li>\n\n\n\n<li>16 GB\/d\u00eda en un solo endpoint \u2192 optimizaci\u00f3n pendiente.<\/li>\n\n\n\n<li>Ventana de mantenimiento clara antes de las 6 AM.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Todo esto sali\u00f3 gratis del Ejercicio 2.<\/strong> Con solo agregar heur\u00edsticas de detecci\u00f3n encima, ya tienes un proyecto real.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Cat\u00e1logo de detecciones factibles sobre logs de acceso<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Divido en tres tiers seg\u00fan complejidad. Los tres caben en el proyecto; el punto es empezar por los de alto valor y baja complejidad.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Tier 1 \u2014 Reglas deterministas (heur\u00edsticas expl\u00edcitas)<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Fuerza bruta a login<\/strong>: N POSTs a <code>\/login.xhtml<\/code> con 302\u2192login o 401 desde misma IP en X segundos.<\/li>\n\n\n\n<li><strong>Enumeraci\u00f3n\/scanning<\/strong>: >M respuestas 404 desde misma IP en Y minutos con paths distintos (patr\u00f3n dirbuster\/gobuster\/nikto).<\/li>\n\n\n\n<li><strong>Session hijacking<\/strong>: mismo <code>JSESSIONID<\/code> (si lo hubiera loguado) usado desde IPs geogr\u00e1ficamente distantes.<\/li>\n\n\n\n<li><strong>M\u00e9todos inusuales<\/strong>: OPTIONS\/TRACE\/PUT\/DELETE contra endpoints donde no aplican.<\/li>\n\n\n\n<li><strong>Payloads sospechosos en URL<\/strong>: patrones <code>' OR 1=1<\/code>, <code>&lt;script><\/code>, <code>..\/<\/code>, <code>%00<\/code>, <code>union select<\/code>, <code>${jndi:<\/code> (log4shell).<\/li>\n\n\n\n<li><strong>Scraping<\/strong>: mismo endpoint hit miles de veces por minuto sin variar par\u00e1metros.<\/li>\n\n\n\n<li><strong>Off-hours an\u00f3malo<\/strong>: actividad transaccional a las 3 AM en un sistema de horario administrativo.<\/li>\n\n\n\n<li><strong>User-agent scanning<\/strong>: si logras loguear el UA, patrones de sqlmap, nikto, burp, curl automatizado.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Tier 2 \u2014 Estad\u00edstica sobre baseline<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Perfil horario por endpoint<\/strong>: aprendes el patr\u00f3n normal de las \u00faltimas 4 semanas por endpoint y hora; alarma si hoy se desv\u00eda > 3\u03c3. Esto detecta cosas que ninguna regla expl\u00edcita ve (ej. \u00abde repente el endpoint X est\u00e1 recibiendo 10x tr\u00e1fico un martes por la tarde\u00bb).<\/li>\n\n\n\n<li><strong>Perfil por IP<\/strong>: cada IP habitual tiene un patr\u00f3n (endpoints que toca, volumen, horas); nuevas IPs que emulan alto volumen son sospechosas.<\/li>\n\n\n\n<li><strong>Tasa de errores por endpoint<\/strong>: si un endpoint pasa de 0.1% de 500s a 5% de un d\u00eda para otro, alarma antes de que los usuarios reporten.<\/li>\n\n\n\n<li><strong>Ratio POST\/GET por sesi\u00f3n<\/strong>: bots suelen tener ratios raros; humanos son m\u00e1s equilibrados.<\/li>\n\n\n\n<li><strong>Distribuci\u00f3n de tama\u00f1os de respuesta<\/strong>: exfiltraci\u00f3n se ve como respuestas an\u00f3malamente grandes de endpoints normalmente peque\u00f1os.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Tier 3 \u2014 Machine Learning<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Isolation Forest<\/strong> sobre features horarias (requests, c\u00f3digos, bytes, endpoints \u00fanicos por IP) para detectar d\u00edas\/horas\/IPs an\u00f3malas sin decirle qu\u00e9 buscar.<\/li>\n\n\n\n<li><strong>Clustering (DBSCAN\/K-means)<\/strong> para agrupar IPs por comportamiento y descubrir \u00abgrupos\u00bb de atacantes coordinados.<\/li>\n\n\n\n<li><strong>Modelo de secuencias (LSTM ligero o Markov)<\/strong>: aprende secuencias normales de navegaci\u00f3n de usuarios; secuencias raras (login \u2192 editar_admin \u2192 dump_datos) son alarma.<\/li>\n\n\n\n<li><strong>Detecci\u00f3n de UA falsos<\/strong>: si logras loguear UAs, un clasificador simple distingue Chrome real de Chrome falseado.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Arquitectura del proyecto (propuesta)<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>\u250c\u2500 Servidores SIGESA (Tomcat) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n\u2502  Cada uno con fail2ban local (reglas Tier 1      \u2502\n\u2502  b\u00e1sicas: brute-force, log4shell obvio, etc.)    \u2502\n\u2502  Rsync\/rsyslog env\u00eda logs a un buz\u00f3n compartido   \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n                   \u2502\n                   \u25bc\n\u250c\u2500 Helix HPC \u2014 job nocturno (03:00 AM) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n\u2502                                                   \u2502\n\u2502  1. Ingesta paralela (job array):                 \u2502\n\u2502     un job por servidor de origen                 \u2502\n\u2502                                                   \u2502\n\u2502  2. Parseo + normalizaci\u00f3n + separaci\u00f3n de ruido  \u2502\n\u2502     (health checks, assets est\u00e1ticos)             \u2502\n\u2502                                                   \u2502\n\u2502  3. Detecci\u00f3n Tier 1 (reglas)  \u2500\u2510                 \u2502\n\u2502     Detecci\u00f3n Tier 2 (baseline) \u251c\u2500 en paralelo   \u2502\n\u2502     Detecci\u00f3n Tier 3 (modelo)   \u2500\u2518                \u2502\n\u2502                                                   \u2502\n\u2502  4. Consolidaci\u00f3n (job con --dependency):         \u2502\n\u2502     - reporte diario (PDF\/HTML)                   \u2502\n\u2502     - blocklist enriquecida (IPs a banear)        \u2502\n\u2502     - eventos para revisi\u00f3n manual (SIEM-lite)    \u2502\n\u2502                                                   \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n                   \u2502\n        \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n        \u25bc                     \u25bc              \u25bc\n\u250c\u2500 fail2ban \/ firewall \u2500\u2510  \u250c\u2500 Control IP \u2500\u2510  \u250c\u2500 Email\/Slack \u2500\u2510\n\u2502  Blocklist actualizada\u2502  \u2502 (NocoBase):  \u2502  \u2502  Alertas de   \u2502\n\u2502  autom\u00e1ticamente cada \u2502  \u2502 dashboard    \u2502  \u2502  eventos      \u2502\n\u2502  ma\u00f1ana antes de 6AM  \u2502  \u2502 operacional  \u2502  \u2502  cr\u00edticos     \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518  \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518  \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Mapeo \u2014 c\u00f3mo los ejercicios construyen el proyecto<\/h3>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Ejercicio<\/th><th>Concepto<\/th><th>Componente del proyecto<\/th><\/tr><\/thead><tbody><tr><td><strong>Ej 2<\/strong> (hecho)<\/td><td>Parser serial, l\u00ednea base<\/td><td>M\u00f3dulo de parsing base<\/td><\/tr><tr><td><strong>Ej 3<\/strong><\/td><td>multiprocessing en un nodo<\/td><td>Detectores Tier 1 corriendo en paralelo por regla<\/td><\/tr><tr><td><strong>Ej 4<\/strong><\/td><td>Job arrays entre nodos<\/td><td>Ingesta multi-servidor (un job = un servidor de origen)<\/td><\/tr><tr><td><strong>Ej 5<\/strong><\/td><td>Dependencias<\/td><td>Job de consolidaci\u00f3n que espera a todos los ingest<\/td><\/tr><tr><td><strong>Ej 6<\/strong><\/td><td>Contenedores<\/td><td>Empaquetar todo en un .sif reproducible<\/td><\/tr><tr><td><strong>Extra<\/strong><\/td><td>ML con scikit-learn<\/td><td>Modelos Tier 3 sobre features del baseline<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Cuando termines los 6 ejercicios, tendr\u00e1s <strong>el 70-80% del c\u00f3digo del proyecto ya escrito<\/strong>. El proyecto final es integrarlos + agregar detectores + reporte + blocklist.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">M\u00e9tricas de \u00e9xito (para tu presentaci\u00f3n)<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Cosas concretas que podr\u00edas mostrar:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Tiempo:<\/strong> \u00abprocesamos 24h de logs de 5 servidores (~35M l\u00edneas) en X minutos, vs Y horas si lo hici\u00e9ramos secuencialmente en un solo servidor.\u00bb<\/li>\n\n\n\n<li><strong>Detecciones reales:<\/strong> \u00aben la primera semana el sistema detect\u00f3 Z eventos accionables que fail2ban solo no vio.\u00bb<\/li>\n\n\n\n<li><strong>Baneos preventivos:<\/strong> \u00abaportamos N IPs a la blocklist por d\u00eda con precisi\u00f3n >95% (bajos falsos positivos).\u00bb<\/li>\n\n\n\n<li><strong>Reducci\u00f3n de incidentes:<\/strong> \u00abcorrelacionamos el aumento de 500s en el endpoint X con el pico de 403s del atacante, ahorrando W horas de investigaci\u00f3n.\u00bb<\/li>\n\n\n\n<li><strong>Costo evitado:<\/strong> \u00abun SIEM comercial equivalente cuesta $$$\/a\u00f1o, este corre sobre infraestructura que ya tienen.\u00bb<\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"<p>Perfecto momento para cambiar de sombrero. Antes del cat\u00e1logo de ideas, hay una correcci\u00f3n importante sobre la intuici\u00f3n \u00abHPC alimenta fail2ban\u00bb: HPC no es para fail2ban en tiempo real, pero S\u00cd para hacer que fail2ban sea inteligente fail2ban reacciona en segundos, lee el log local, aplica reglas simples. Si intentaras \u00abcorrer fail2ban en HPC\u00bb, el [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-25528","post","type-post","status-publish","format-standard","hentry","category-sin-categoria"],"blocksy_meta":[],"_links":{"self":[{"href":"https:\/\/sada.services\/index.php?rest_route=\/wp\/v2\/posts\/25528","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sada.services\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sada.services\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sada.services\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/sada.services\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=25528"}],"version-history":[{"count":5,"href":"https:\/\/sada.services\/index.php?rest_route=\/wp\/v2\/posts\/25528\/revisions"}],"predecessor-version":[{"id":25556,"href":"https:\/\/sada.services\/index.php?rest_route=\/wp\/v2\/posts\/25528\/revisions\/25556"}],"wp:attachment":[{"href":"https:\/\/sada.services\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25528"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sada.services\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25528"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sada.services\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25528"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}