A web server log on the web server which contains all the activities of a web-based application. Activity stored in the log contains request and response from a web server to a web-based application that user accessed. This activity is an important data and can be used to search for occurrence of attack if there are problems on a web-based application. This paper uses a dataset of web server logs to analyze data using dataset which is taken from the event forensics contest because the web server log dataset has a record of activity form attack on a web-based application. Baum-Welch algorithm is used to search a web server log data so that the characteristics of the data are considered as attacks can be classified according to the level of success based on the records stored in the log. The results of the analysis based on dataset used calculated that the amount of data related to the attack were identified as many as 1.120 incidents of a total 202.145 records of data in web server log file.