A good administrator has ways to learn what people do with the system. The primary source of information is the access log, which mod_accesslog will write out. Additionally, Lighttpd writes error logs. These are of special interest, because an attacker will try to provoke errors in order to create system states that circumvent the usual restrictions.
There are many tools that visualize, filter, correlate or otherwise mangle the log entries that a web server emits. Luckily for us, Lighttpd writes it's logs in the standard web server log file format. So tools written for Apache logs will happily munch Lighttpd logs.
RRDtool is probably the easiest way to get a decent visualization of our Lighttpd access logs. RRD stands for Round-Robin Database, which in this case means that while new data enters the database, old data is discarded.
The neat thing about using RRDtool is that Lighttpd integrates the setup and the data collecting stage with mod_rrdtool. There are only two things...