A log file is a file, often in clear text, which is generated by a software process to record some specific details about the workings of this process.

learn more… | top users | synonyms

4
votes
1answer
809 views

Wildcard support for InputFileName in rsyslog?

We have log files with names that match a certain pattern but frequently change. Is there a way to specify a wildcard or pattern for rsyslog to include via InputFileName? Example: InputFileName: ...
0
votes
1answer
193 views

syslog-ng stopped and don't want to start

I noticed lately that my syslog is empty. I tried restarting it but i get this error: $ /etc/init.d/syslog-ng reload Reload system logging: syslog-ngsyntax error in /etc/syslog-ng/syslog-ng.conf at ...
0
votes
1answer
1k views

How can I automatically delete old apache error log files?

My /var/log/apache2 folder is getting out of hand. It has loads of old compressed error.log files that I want to get rid of before my server runs out of space and explodes. Firstly - Is it safe to ...
0
votes
1answer
96 views

How to split access and error logs in Parallels Plesk?

I have a site in PHP on Apache. Is there a way I can define settings in Parallels Plesk Panel for logging for e.g. it should create log file for each day? Currently my access_log file size is more ...
0
votes
1answer
767 views

How to check web server logs for SQL injection?

If I have a PHP site hosted on Apache and someone hacks it using SQL injection, is there a way I can find out exactly which script caused this by looking at my web server logs? Or using some other ...
1
vote
1answer
1k views

security_error_ring_buffer_recorded in system health log - what does it mean?

Our company is running a few servers for a couple of websites. The server are running Windows Server 2012 and for databases we have MS SQL Server 2012. Today I was checking the log files located in: ...
0
votes
1answer
44 views

Getting Webalizer to show URL stats for all time, not by month

The conf file has this section: AllSites yes AllURLs yes AllReferrers yes AllAgents yes AllSearchStr yes AllUsers yes ...which is great, but I don't see any way to show the same ...
0
votes
1answer
97 views

Webalizer shows only PART of the very first day in a log

I'm using webalizer-2.23-04-cygwin, the latest binary I could find, and it's doing the same thing an older version was also doing on a certain 900MB logfile I have. It only shows the first 411 hits, ...
-1
votes
1answer
48 views

HTTP request logs needed for anaylsis [closed]

I'm looking for detailed server logs of HTTP requests, so that I can find the most common HTTP request header values for fields such as User-Agent, Accept, Accept-Charset, etc.. I found a resource ...
0
votes
1answer
87 views

Large Number of 206 codes in Access Log

I'm finding a lot of 206 access codes in my Apache access log. After looking at the access log it seems that a number of IPs would hit the server multiple time for partial content on a number of large ...
4
votes
1answer
1k views

Is it possible to log additional HTTP headers in IIS logs?

I need to analyze logs for Exchange and would like to get additional headers saved such as MS-ASProtocolVersion Is is possible to configure IIS to log these additional headers? POST ...
0
votes
1answer
222 views

pptpd: log of unsuccessful authentication

I am using pptpd on Debian 6. I know that last shows the list of connections as well as the source IP. I am looking for the log of unsuccessful authentication, or any form of alert/ban for a source ...
1
vote
1answer
221 views

Trying to Setup Log Monitoring with Sentry

I am trying to setup a log monitoring application for monitoring Jboss Application logs. We have more than 50 Jboss Application servers in all our environments. My Requirement is below. The log ...
0
votes
1answer
134 views

the network dropped on ubuntu 12.04 server but came back

I have a ubuntu server, type 12.04 that serves as a mysql box and intranet server. Without notice it dropped all packets (www, ping and mysql). What logs should i check - the messages log is not in ...
4
votes
1answer
3k views

How to set up fail2ban to read multi log in a jail?

How can I configure multiple logpaths for the same rule? I'm trying to write a syntax like this: [apache-w00tw00t] enabled = true filter = apache-w00tw00t action = iptables-allports logpath = ...
1
vote
0answers
393 views

Monit check log file content

I am having a issue with Monits content check. I know I can check the log file like this check file test.log with path logs/test.log if not match "something" for 5 cycles then alert But the log ...
0
votes
1answer
4k views

Delete IIS log files

I do not find a way to disable and delete log file at C:\inetpub\logs\LogFiles\W3SVC2\u_extend1.log The file is extremely large about 50gb, I have tried to delete it as administrator, but got an ...
0
votes
1answer
64 views

Opening Windows NT evt files

Does anyone know of a tool which allows me to open Windows NT logs. I managed to get some results by using Window's 7 Event Viewer, but for some sources, it does not have the event's description. One ...
0
votes
3answers
1k views

Why is logrotate not rotating logs Tomcat access logs on aws centos 6.3?

I have the following file in /etc/logrotate.d: /usr/share/apache-tomcat/logs/*.access { nodateext copytruncate daily rotate 7 notifempty postrotate EXT=`date --date='-1 day' +%Y-%m-%d` /bin/gzip $1.1 ...
0
votes
1answer
99 views

Monitoring auth.log

Say you want to be able to easily see who's logged in to a system recently. auth.log has this information, but it's very cluttered with crontab entries and you have to use sudo to read it. ...
4
votes
1answer
626 views

I need to monitor a log file with monit if the file does not change monit will alert

I need help. I was looking in to Monit documentation and I need help. I could not find my answer there. I need to monitor a log file of a service, if that log file stops to increase in size or even ...
1
vote
1answer
3k views

Ubuntu EC2 Apache 2 : Access Log only shows Internal Dummy Connection

I'm running a micro instance on Amazon Cloud Services, and a recent spike made our web server unresponsive, I'm trying to do a little research to determine if this was a DOS attack, or which process ...
0
votes
2answers
32 views

Is there a free solution to count the number of context roots in an apache file?

I have an apache log file. I need to report how many rows (request) are from a specific context root. The apache logs already start with a slash and context root is to the second slash. Example ...
1
vote
1answer
120 views

Why are these requests in my Apache logs?

I've found the following lines in my Apache 2.2 logs (using the standard "combined" log format): 92.240.68.152 - - [10/Feb/2013:20:47:38 +0000] "GET http://8stepschools.com/images/8stances_tiger.jpg ...
3
votes
2answers
1k views

Tool to collect and read all linux logs in one place [duplicate]

I have two linux servers. I'm an administrator, and part of my daily routine is to check all the logs for errors or strange messages. So, every morning I check: On server #1: /var/log/syslog ...
0
votes
1answer
717 views

httpd error log : [client 127.0.0.1] Attempt to serve directory: /var/www/html/

I was looking through my server's error logs, because it has been crashing lately, and I noticed this error occuring constantly: [Mon Feb 04 17:26:09 2013] [error] [client 127.0.0.1] Attempt to ...
0
votes
1answer
176 views

What is the exmon equivalent in Exchange 2010? (to get detailed per user information)

Exmon was an Exchange 2003 utility that exposed the quantity of RPC calls and IO that each user consumed. I suspect that several users are downloading OSTs or manually importing other data into the ...
0
votes
2answers
354 views

How do I funnel all my EC2 apache logs to one server

Is the best way to get all my EC2 Web Server Instance Apache Logs in one place, to create a "LogServer" EC2 Micro instance and point all the Apache Configs to it? Not sure how to do this and ...
3
votes
3answers
370 views

Find out how long a user was logged into a Linux server

In my Debian Squeeze server, all user logins and logouts are recorded in the file /var/log/auth.log Jan 28 07:11:06 xen8 sshd[29826]: pam_unix(sshd:session): session opened for user root by (uid=0) ...
3
votes
2answers
170 views

Benefits of Separate Over Combined Apache Logs?

I was wondering if there are any benefits or common use-cases in which using separate Apache logs (access, agent, error, and referer) is better than using a single combined log file. I tried Googling ...
2
votes
2answers
506 views

Rotate a file that's open and being written at all times

I have an linux application that continually writes logging information into a log file, eg. /var/log/application.log. As the application does not rotate the file automatically, this log file can ...
2
votes
1answer
303 views

Large log management and storage

I'm constantly dealing with a quite large amount of logs (growing at around 1Gb a day), and I manage them the old way, dumping the logs before they rotate to a central server and then storing on tape. ...
0
votes
2answers
2k views

IIS Advanced Logging Forward to Syslog

I am looking for a method that would allow us to forward the IIS Advanced Logging logs to a centralized log source via syslog or something similar. We are able to perform this currently for the ...
1
vote
1answer
402 views

Apache Accessing System Environment Variables (for Log File Location)

Is there a way to let Apache access the system environment variables? I know it has its own environment and can pass them to spawned processes like PHP, but is there a way to let the server itself ...
2
votes
1answer
1k views

How do you force a process to flush the data written to an open file descriptor under Linux?

I have a binary process (with no sources available) running on an embedded Linux system. The process opens a log file (/tmp/dmaosd.log) where it logs what it's doing. The problem is the log gets ...
0
votes
3answers
435 views

Is this a denial of service attack?

I have my kern.log flooded by these lines: Jan 4 03:00:57 myhost kernel: [9040601.809740] iptables denied: IN=eth0 OUT= MAC=10:00:25:09:e7:40:00:21:5e:3f:c4:04:08:00 SRC=178.33.217.13 ...
1
vote
3answers
439 views

What is the simplest way to monitor log files for (a) string/regex matches AND (b) lack of output?

On a single Linux server, there are often lots of independent (perhaps interlinked) services outputting numerous logs to files at known paths. Sometimes bad stuff happens and is written about, to the ...
0
votes
1answer
4k views

CRON opens and closes sessions continuously

I'm seeing a huge amount of these lines in my auth logs: Dec 31 03:45:01 xxxxxxx CRON[17259]: pam_unix(cron:session): session opened for user root by (uid=0) Dec 31 03:45:01 xxxxxxx CRON[17259]: ...
2
votes
1answer
250 views

Restrict file access to append only

I have a directory with log files and I'm putting logs from script launched by users into them. Logging with syslog isn't possible in this case. I want the users to have only write permissions on ...
1
vote
1answer
109 views

Need a tool to monitor apache logs for suspicious requests and ban users via htaccess

Do you know any tool that monitors apache logs for suspicious actions (for example, several blocks by mod_security from one IP) and after it blocks this IP using .htaccess?
0
votes
2answers
134 views

How to process logs and debug information generated by applications running on spot instances

I am using Amazon Spot Instances to crawl a lot data. Most of them run until Amazon terminates them once the current price exceeds our max bid. I need to monitor and mainly archive the logs generated ...
1
vote
1answer
224 views

Make logwatch reports more interesting?

Is it possible to improve the quality of reports from logwatch? Like make it not just report disk usage which doesn't even change much in daily operation, but report significant changes in usage or ...
6
votes
4answers
127 views

How to measure rate of new lines in file (log file)

I'm trying to get a measure of log file line writes over time, ideally a current rate and 1-, 5-, and 15-minute averages. I could do something like this: watch wc -l /var/log/<my_file> .. ...
0
votes
1answer
63 views

create log file ssh (only ssh)

I use ubuntu 10.04, contained ssh. I want to create a log file that stores all the activity on ssh (only ssh). Like in /var/log/auth.log but only for ssh. Like/var/log/ssh.log. So, file ssh.log will ...
1
vote
2answers
97 views

Exchange 2010 Message Tracking

I was wondering if when i use the get-messagetrackinglog command i would also see rejected emails. Like if external user A sends an email to internal user B and got rejected for spam, could i see the ...
0
votes
1answer
224 views

IIS logs status code 590

Background: Trying to chase a bug where resources occasionally won't load. Only happens on mobile devices. Last five columns in IIS logs are cs(User-Agent) sc-status sc-substatus sc-win32-status ...
2
votes
1answer
149 views

How can I remove old log entries from a log file and archive them somewhere else in Linux?

CentOS 4.x I apologize in advance if this is not the appropriate place to ask this question. It pertains to a linux server / IT admin task. I've got a log file on an old CentOS 4.x server and I ...
1
vote
1answer
127 views

Unable to log iptables

I'm having trouble getting iptables to log to any file. My iptables looks like: Chain INPUT (policy ACCEPT 1366 packets, 433582 bytes) pkts bytes target prot opt in out source ...
0
votes
1answer
139 views

Is my webserver being abused for banking fraud?

Since a few weeks i'm getting a lot of 403 errors from apache in my log files that seem to be related to a bank frauding scheme. The relevant log entries look like this (The ip 1.2.3.4 is one I made ...
2
votes
1answer
101 views

Split big Apache log to folder structure

I just changed my Apache log behavior because it was making me having very BIG files... So I now use cronolog to split my logs to log/httpd/2012/11/access_2012.11.30.log for exemple, pattern : ...