This study aims to detect intruders on a server computer used for Open Journal System (OJS) services. The server is connected to the internet via a router, making it vulnerable to external attacks. In this research, the tool used is Tripwire, installed on the server computer as the main object. Tripwire functions as a change detection tool for the file system, identifying suspicious activities and recording valid file hashes, verifying file integrity against this record periodically. The system is operated by journal managers from computers connected to the server within the same network address providing OJS services. The method used in this research is the Network Forensic Development Life Cycle (NFDLC), which consists of several stages: initiation, acquisition, implementation, operation, and disposition. Each stage is applied systematically to facilitate the forensic analysis of attacks. The research results show that the NFDLC method is effective in analyzing and detecting intruders in the network. Based on forensic analysis using Tripwire, 12 data losses were found in 7 attack incidents identified on the OJS service. This study successfully demonstrates that the NFDLC method and Tripwire tool are effective in detecting and analyzing intruders attempting to access the OJS service server computer.