Tagged Questions
0
votes
1answer
63 views
security_error_ring_buffer_recorded in system health log - what does it mean?
Our company is running a few servers for a couple of websites. The server are running Windows Server 2012 and for databases we have MS SQL Server 2012.
Today I was checking the log files located in:
...
0
votes
0answers
14 views
Securing Windows 2008, moving logs ocation to other system [duplicate]
Our company want to put out VM with Windows Server 2008 to the Internet.
The thing is, we need to provide maximum security of this system. How to do that?
I know the password should be very long and ...
1
vote
1answer
65 views
Need a tool to monitor apache logs for suspicious requests and ban users via htaccess
Do you know any tool that monitors apache logs for suspicious actions (for example, several blocks by mod_security from one IP) and after it blocks this IP using .htaccess?
1
vote
3answers
97 views
What consequences to take from what i read in logfiles?
Since some weeks i manage my first Webserver, a Seaside application behind an Apache proxy on Linode, and i installed logwatch to send me daily logs.
Where can i get information on when i have to act ...
1
vote
1answer
249 views
Why is FunWebProducts flooding my server?
I have received 47 000 hits in the past couple of hours from a single domain. I researched FunWebProducts but it seems to be some kind of a plugin, not sure how this is possible?
89.70.25.120 - - ...
3
votes
2answers
583 views
/var/log/btmp is 6GB, how to trim it down?
I know that /var/log/btmp is for failed login attempts. Typically having a file this large indicates brute force attempts. The 6GB is an accumulation over the past 3 years. I've taken steps to hide ...
1
vote
3answers
600 views
Break-in attempts on Ubuntu VPS box [duplicate]
Possible Duplicates:
Is it normal to get hundreds of break-in attempts per day?
What should I do if I find someone is brute forcing my server password?
I have an Ubuntu 10.04 VPS box. ...
0
votes
2answers
327 views
Mac OS X Server Secure Log full of failed SSH attempts
Whenever one of our server's admins tries to access our machine running Mac OS X Server 10.5 via SSH, I get the following error exactly every 10 seconds in the security log:
sshd[32575]: ...
2
votes
2answers
355 views
My server's security was breached… I need help - Ubuntu/Linux
I'm using Ubuntu 10.04. An unknown person has logged in several times through SSH using postgres user account.
I'm having a hard time finding logs with any related acitivty, probably because such ...
0
votes
5answers
1k views
Is my dns server being attacked? And what should I do about it?
I've been having some intermittent dns problems with a web server, where certain isp's dns servers don't have my hostnames in cache and fail to look them up. At the same time, queries to opendns for ...
3
votes
2answers
240 views
What is a quick way to report login/logout times on Windows 2003?
I have about a dozen servers, and I am looking to quickly find out all of the login/logout times, for a subset of users, for all servers, during January.
Is there a quick, easy way to get this ...
1
vote
2answers
234 views
Anyone else being hit by traffic on TCP port 11370
I've been watching my logs (Ubuntu 9.10 server) and dunno about any of you but I am getting a ton of traffic from sources like Russia, Romania, etc.. on port 11370 (my iptables are logndrop'ing it. ...
2
votes
1answer
158 views
What fields need to be included when configuring IIS web logging according to PCI compliance regulations?
From what little I know about PCI compliance I need to be logging all web site activity and keeping said logs online for at least 3 months. What I have not been able to get a straight answer on, ...
0
votes
2answers
256 views
I found a Ukranian spammer and have the exact query, IP and access time. What next?
Before I turned on comment moderation, these guys would leave comments meant to steal my Google juice (by getting an inbound link). I can still see them visit... the question is
what should I do ...
2
votes
3answers
20k views
ASP.net user account permissions in IIS 7 on Windows 2008 server
I set up a global error handler in my ASP.net application, using Log4Net and a RollingLogFileAppender which has worked quite nicely up until.
I'm in the middle of an upgrade to IIS 7 on Windows 2008 ...
0
votes
1answer
1k views
Strange Centos 5 Lighttpd access log
I've investigated my Lighttpd access log and found some strange things listed below. I do not know if it's good or bad, but bearshare? I was never or these sites I use my Centos only for website ...
4
votes
5answers
1k views
Send email when anyone logs on
My CentOS/RHEL system may have been hacked, I'm not sure. But I'm playing it safe by creating a new slice from scratch.
I've installed tripwire, but I'd also like to be emailed when anyone logs in. I ...
4
votes
6answers
468 views
Linux Log permissions
What is the best practice for allowing linux logs to be viewed by other users besides root?
1
vote
3answers
645 views
Auditing on UNIX System
I'm working on a project which requires some auditing of read/write/modifications to various files. Additionally I must log ftp access, user logins, NTP/system time changes etc. Is there a nice tool ...
4
votes
3answers
325 views
How to keep logs secure?
If log files (or log data) contain sensitive information which needs to be protected from being deleted, manipulated or prevented from "log injection", what safety measures are considered ...
