Recording activity on the system (or of a particular program) for later reporting and analysis. Logins, logouts, web server page requests, etc might all be logged.

learn more… | top users | synonyms (2)

0
votes
0answers
7 views

Thoughts on a newly published Linux logging guide

I came across a Linux logging guide and wondered who else has checked it out. It's pretty comprehensive and I have to say, it's one of the better ones out there to help newbies and people with a basic ...
0
votes
0answers
28 views

How to log changes made in a particular file to syslog

How to log changes made in a particular file using syslog-ng. The log must contain the timestamp, hostname, user who modified the file and action performed. Is there any option other than audit in ...
0
votes
1answer
26 views

nginx log request before processing

I have nginx server serving a lot of big files. I can see plenty of connections on the server. As it iw know, file to the accesslog is written after the request is completed. Is there any way to log ...
0
votes
1answer
16 views

Maintaining rsync log file

I have a cron running rsync for backup purposes, and rsync logs the output to a file via --log-file. This script will keep on running for a quite long time and I am worried that the log file will keep ...
0
votes
1answer
18 views

Why does syslog-ng drop debug messages when logging remote?

In the local log output, I can see debug messages but these won't show up on the remote logging server. It seems to ignore these but it does print warning and error level messages just fine. These ...
0
votes
1answer
28 views

Logging into file doesn't write anything

I have got some script, which I want run after start computer. I set it in group policy and script is running after PC start (I checked it), but I have in script some logging to which doesn't work. I ...
2
votes
1answer
27 views

How to stop SQL Server from logging informational lines to SQLFT log files?

I checked on a SQL Server 2012 instance recently only to see that the HDD is full and after investigating what happened it was Full Text Search informational lines filling the log files and disk space ...
0
votes
0answers
19 views

Logging ALL actions inside SSMS

Any time one of the following actions occur in SSMS, I would like it to be logged in a SQL table/file. I tried different stuff but nothing seems to be perfect. I might use some funny terminology, ...
1
vote
1answer
24 views

Some (but not all) stuff still logged to /var/log/nginx/error.log despite being configured to log elsewhere

here is scee.conf - pid ./pid; error_log ./error_log debug; events { worker_connections 1024; } http { access_log ./access_log; server { listen 31415; } } I run it using nginx -c ...
-1
votes
1answer
25 views

Office365 User Activity Tracking

I have a situation where a user's mailbox on exchange online enterprise sign-in was disabled as employee was on a suspension, however the mailbox was re-enabled upon employee returning to the office. ...
2
votes
1answer
48 views

script not found or unable to stat: /var/www/html/r.php

I have just seen a new series of error in the /var/log/apache2/error.log [Thu May 07 17:12:35.433760 2015] [:error] [pid 3488] [client 190.79.132.215:51660] script '/var/www/html/r.php' not found or ...
0
votes
1answer
22 views

HAProxy log outgoing requests

Currently, my HAProxy logs have information about the incoming requests: HTTP version, method, host, path, and headers. I am trying to debug my HAProxy config, and need to know what the resulting ...
1
vote
2answers
33 views

Apache Server Log File Issue

I'm a programmer for a company and their server specs are off limits to me due to IT restrictions. I know it's an Apache server running off a Linux environment. I have permissions to add/remove files ...
0
votes
0answers
14 views

SFTP and rsyslog: log activities of specified users only?

After a lot of anguish, I finally managed to get chrooted SFTP logging working in Ubuntu 14.04. Relevant bits from /etc/ssh/sshd_config: Subsystem sftp internal-sftp Match Group sftp-only ...
0
votes
1answer
36 views

How to allow more than two simultanous sessions on Azure

One of our servers is on Azure and we are remotely connecting to it. Unfortunately Azure allows only two users to be logged in at the same time. When the third user tries to log in, he is given the ...
2
votes
0answers
33 views

SFTP logging configuration fails with an error (OpenSSH 5.1)

Adding following line to sshd_config Subsystem sftp /usr/libexec/openssh/sftp-server -f LOCAL5 -l INFO When i start sshd service it fails with error "garbage at the end of line : -f" My openssh ...
-1
votes
0answers
84 views

How to log uploaded files with nginx?

I want to log names (with full paths) of all uploaded files. Is it possible to do this with only nginx? os: CentOS 7.1 nginx: 1.6.3 Parameters for sending files in nginx.conf: sendfile on; ...
0
votes
1answer
29 views

Debugging random SQL login failure from Web Server

This is a very basic level question, but it could really benefit from some extra help in the diagnosis. We have a 2005 SQL Server Named: SERVERNAME-PROD We have a Web Apps Server that's running IIS ...
-1
votes
0answers
18 views

Show historic hardware changes in windows 7 [migrated]

Brief question: In Windows 7, Is there a log where I can see the ram memory of the system at different dates? Explanation: A friend of mine have detected some missing hardware (ram sticks) on some ...
-1
votes
0answers
24 views

Bringing in single and multi-line App log records to ELK (some contain JSON objects) [migrated]

I'm trying to take log records from a custom (node.js) application that will be putting data into elastic search and then processed by Kibana. My environment is Ubuntu with ELK (Elasticsearch, ...
0
votes
0answers
19 views

Adding timestamps to supervisord logs

Is it possible to let supervisord add timestamps to the outputs in stdout_logfile and stderr_logfile? I couldn't find it anything about that in the documentation.
2
votes
1answer
38 views

How to log administrator activities in Red Hat Enterprise? [closed]

Is it better to use auditd or sudo logs to log root and other user activities on a Red hat enterprise machine?
1
vote
0answers
25 views

IDS (or similar) to query ELK logs and send alarms on strange situations [closed]

I have an ELK stack (that receives logs from mostly web services,web applications). I'd like to not only store and visualize some stats about the logs(features of ELK) but also to use them to detect ...
0
votes
0answers
8 views

Logging in IIS 7.5/8.0

I have an IIS 8.0 Server setup running ASP .NET applications. In addition to the normal logging like, Begin Request, End Request, Requests /Sec, etc., I also want to log some perfmon counters like ASP ...
0
votes
1answer
14 views

Graylog ignoring all HTTP logs

I've integrated our PHP web application using Monolog recently and added support for logging into Graylog. Until very recently I've used the Graylog VM and I've successfully logged all the information ...
1
vote
1answer
15 views

Logging data posted to a specific URL in Apache

I have been asked to create a logging solution for an AngularJS application on a large e-commerce site. The solution itself has been created but actual transmission of the log data to the server has ...
1
vote
2answers
21 views

Modifying LogFormat in Apache

I need to modify the LogFormat in Apache in order to add the X-Forwarded-For header and log clients' real IPs. I attempted to edit that in httpd.conf file but I then found two separate parts for the ...
1
vote
2answers
41 views

building a SIEM, should I send logs or get them from the gathering machine?

I am working in a Linux environment, I would like to gather all the logs from the machine pool on a unique machine X. There are several log files I need to move and I am not sure about the way I ...
0
votes
0answers
13 views

Non-domain log forwarding certificate types

I'm trying to set up a source initiated subscription (Log forwarding) where the event source server is not in the same domain as the event collector server. I'm following these steps. It states that ...
1
vote
1answer
33 views

Access to “Windows Security” logs for “eventlog” group

Security logs are not available for users in eventlog group. I've checked this down to security event log file. eventlog group has all permissions. Unfortunately I cannot add my user to ...
1
vote
2answers
34 views

nginx log when specific referrer is present

Because someone steals content from our website, I need to create additional log file, that logs only if http_referrer contains specific domain. Currently I have this: if ($http_referer ~* ...
0
votes
1answer
25 views

What's in the DNS Debug Log Message Fields

I've enable debug logging options on the DNS server, and I'm trying to parse through the output in dns.log. Here's a guide from technet on how to use server debug logging options, but I can't find ...
0
votes
1answer
19 views

How to monitor/log wireless events including failed authorization attempts?

Is it possible to log wireless events including failed authorization attempts? I have two access points and also would like to see, which one is serving which client and see when client is connected ...
3
votes
0answers
25 views

MongoDB Oplog Security

We are using a MongoDB replica set for sharing sessions and other (potentially sensitive) data in a web farm. All the data we store uses TTL indexes to expire documents after a relatively short ...
0
votes
2answers
33 views

Is there a way to backup logs to tape without mounting a NAS?

The traditional way to send logs to tape backup as I understand it is to mount a NAS which has the ability to do tape backups (or maybe send to a syslog server which in turn mounts a NAS). Is there a ...
-1
votes
2answers
32 views

shell command to find common IPs on a specific url from error_log [closed]

Is there a shell command to group all the most common IPs that requested a specific file via GET (or that came from a url)? For example with this command I can group requests from ip: cat ...
3
votes
0answers
19 views

IIS 7.5 not rolling over logs hourly

I have six IIS 7.5 web servers deployed using a Shared Configuration. The properties for the logging in the configuration are set to log Per Site, W3C, and on an hourly schedule: For five of the ...
1
vote
1answer
109 views

Windows Domain Controller Authentication Logon Logging and Forensics

This question does not take Windows Server 2003 and older OSes into consideration. I know that for local logon (event ID 4624) also the logon type is logged (interactive, remote, etc.). Is there a ...
1
vote
1answer
28 views

What does READ_CONTROL mean in the Security event log?

I have been asked to create audit record of file accesses. By the log is simply overwhelming. A single double click of a text file opening in notepad creates more than 10 log entries with Event Id ...
0
votes
0answers
22 views

Show blocked SMTP connections in Exchange 2010

Currently, I have an anonymous receive connector set up on my Exchange 2010 system that allows from an entire subnet. I'm looking to change this to only allow from specific IPs, but need to know when ...
0
votes
0answers
16 views

How can I detect mail servername used from my clients to my server?

I have a web and mail server with Ubuntu 10.04, Apache 2, courier, postfix, Ispconfig 3 and multiple sites hosted. The clients use mail from Outlook with a config like this: @domain1.com use pop and ...
1
vote
3answers
25 views

How to grep (or other command?) for first instance to last instance in a log?

How does one grep/search a text file so that the results show the first line with the string, and then every other line until the last line with the string? So, if I have a file that looks like this: ...
2
votes
2answers
32 views

What's the purpose of spammy HTTP referers?

In the logs of my website, there's a lot of visits with a HTTP referer set to spam-like websites (usually Russian sites, I've noticed). I assume what they're doing is just using a web crawler to visit ...
0
votes
1answer
20 views

Understanding syslog conf - targeting specific types / tags of logs

I'm combining log files from several docker containers on my host and sending them a remote logging service. I'm just redirecting the output to logger and tagging it: docker-compose logs 2>&1 ...
0
votes
1answer
33 views

Any easy way to find out what process creates files in specified dir?

I have a superuser ssh access to a third-party ubuntu 14.10 box with misconfiguration: some process creates lots of temp files in a dir (and does not clear them, depleting inode limit slowly). Is it ...
0
votes
0answers
38 views

Trouble filtering googlebot from apache access log

Though it seems like it should be pretty straightforward, I have been unable to configure apache so that googlebot's requests are not stored in the access log. I've tried the following lines: ...
2
votes
1answer
23 views

How are filters combined in syslog-ng

If I've got an entry in syslog-ng log { source (src); filter (filter1); filter (filter2); filter (filter3); filter (filter4); destination (all_log) } And, say filter4 is a very ...
0
votes
0answers
23 views

Sftp Log for every Jailed User

I've a sshd_config file like the following: Match user foo ChrootDirectory /mnt/foo-jail/ ForceCommand internal-sftp AllowTCPForwarding no AuthorizedKeysFile ...
0
votes
2answers
31 views

Multiple Apache error logs for one virtual host

I have poorly written PHP application that produces a lot of E_NOTICE and E_WARNING messages to error log. I can't do much about it, but it's hard to keep track of those real errors like E_ERROR and ...
-3
votes
1answer
29 views

Logging traffic in a file? [closed]

today I'm looking for a tool that allows me to log any traffic that goes in and out. It would be perfect if it would store that data in text files on the server. Does anyone have a tool like this? ...