Recording activity on the system (or of a particular program) for later reporting and analysis. Logins, logouts, web server page requests, etc might all be logged.

learn more… | top users | synonyms (2)

0
votes
0answers
3 views

Log not readable after rotation by daemontools

I have a log, which looks perfectly fine. However, after the log rotation by daemontools, it is no longer human readable. What could be the problem?
0
votes
0answers
7 views

capturing data and logging on centos 6 server

good day I am running a VPS server with Centos 6 x64 For some reason my VPS is using atleast 3-4gb a day with ot without any clients connecting No torrenting is being done, only gaming and VoIP ...
0
votes
2answers
31 views

General webserver log and custom logs where to gather them

I am not trying to create an opinionated question here though it might sound like it. My problem is as follows. I have the normal apache2 access and error log on a bunch of servers. I also have ...
0
votes
1answer
19 views

Postfix - E-mails missing, no message in the log

I'm setting up a postfix + dovecot mail server for myself on a VPS. I plan to host a couple of domains with it and be able to manage the users via MySQL. It currently works as I would like to but it ...
0
votes
0answers
14 views

Ubuntu 12.04 crash analysis - strange binary data on all open files at the moment of crash

A couple of hours ago we got a system crash on Ubuntu 12.04. We checked all the log files and there is nothing suspicious to blame to. Last stuff that was logged was some dovecot activity. There are ...
0
votes
1answer
14 views

Bind Requested DNS Server IP Log

I have a DNS Server which runs on a virtual linux box with several IPs. Bind provides some pretty detailed debug logs, however, one piece of information that doesn't seem to be logged is the requested ...
0
votes
0answers
24 views

How to configure nDPI for iptables

I am new to nDPI, I have installed nDPI but when I add rules like; iptables -I OUTPUT -m ndpi --http -j REJECT it shows error iptables v1.4.7: Couldn't load match ...
0
votes
3answers
61 views

store log files in the cloud, when servers are not in the cloud

We're looking at a long-term migration towards the cloud. The plan is to start small, and gradually move less essential parts of the infrastructure into the cloud. All good so far. Part of this ...
-1
votes
1answer
19 views

Howto join ssl_access_log and access_log? [closed]

Recently I discovered in my /var/log/httpd files called ssl_access_log and ssl_error_log. Now I always looked and scanned the regular access_log and error_log. Questions are? Do ssl_error_log and ...
0
votes
0answers
9 views

OpenTSDB Web interface showing nothing other than header and footer

NOTE: I moved the question from stackoverflow to serverfault as this question didn't attract attention. I have a temporary OpenTSDB and hbase hosted on a aws micro server. http://54.72.180.169:4242/ ...
0
votes
1answer
23 views

Filter python messages with regex in syslog-ng

I have syslog-ng (v3.4.7) configured to catch almost all messages in their respective logs, but recently I've included some python scripts in crontab and their output just goes to messages or debug ...
0
votes
2answers
38 views

Logging detailed network activity on Windows Server 2008

One of my clients is experiencing internet delays and outages within their small network. They've verified with their cable company that the issue is not related to any cable company outages. The ...
0
votes
0answers
8 views

“Safely remove Device” logs

I would like to know if Windows Server 2003 logs somewhere when a device has plugged/unplugged. A network card disappeared from one of our virtual machines and I believe it was because somebody ...
0
votes
2answers
24 views

Tracking OpenVPN user login

Situatio is that each user login is loged in log file. Each Server start log file is erased and created new. Is any way to log user logins into antoher file or other place that when server start it ...
1
vote
1answer
34 views

Access log of nginx: why are foreign URLs logged?

My access log is full of such entries: 178.207.40.219 - - [03/Apr/2014:17:34:37 +0200] "GET http://win.mail.ru/cgi-bin/auth?Login=nutyck@bk.ru&Domain=mail.ru&Password=241716 HTTP/1.1" 403 168 ...
0
votes
1answer
29 views

make nginx not log “no user/password was provided for basic authentication” in error logs

I've added password protection to a lot of my domain via nginx by adding: auth_basic "Restricted"; auth_basic_user_file /usr/ssl/htpasswd; to the nginx vhosts. I log all errors ...
0
votes
1answer
13 views

How to log mail client with Dovecot / Postfix

Does anyone know if it's possible to have Dovecot or Postfix output the mail client of a user? In Dovecot's variables list, I cannot find anything in that direction.
0
votes
0answers
18 views

Logparser - Getting average response time from microseconds

I have one month's worth of web server log files in the following format: #Fields: date time cs-uri-stem cs-uri-query c-ip cs(Referer) sc-status sc-bytes time-taken 2014-03-12 17:34:02 ...
0
votes
2answers
53 views

How do I see if user connected to mysql over ssh tunnel?

I imagined command last, would also give me mysql over ssh tunnels list. But I was wrong. Is there a place where this tunnels are logged? Ubuntu server 12.04.
0
votes
1answer
22 views

%systemdrive%\windows\temp deletion rules

What are the rules for which the files in %systemdrive%\windows\temp are removed? I am not referring to rules that System Administrator add to system. I am referring to the built-in processes that ...
0
votes
0answers
19 views

Tomcat 7 log file date format

Tomcat7 log entries use a date format: Mar 30, 2014 11:50:32 AM How do I change it use the format: 2014-03-30 11:50:32 This would make it much easier for Zabbix to parse the log file for ...
1
vote
1answer
57 views

How do I configure Linux to log when ulimits are hit?

For example, say I'm hitting nproc. I would expect a log message to appear /var/log/messages or similar, but it looks like that needs to be configured. How do I do that? I can't find anything relevant ...
0
votes
0answers
19 views

Apache microseconds logs

So, I'm trying to understand how the apache microseconds log format is working - I configured a custom log for my apache vhost including %D for microseconds and from my tests it seems that is working ...
1
vote
3answers
66 views

Parseable NGINX accesslog files with delimiters

The default NGINX format is this: log_format combined '$remote_addr - $remote_user [$time_local] ' '"$request" $status $body_bytes_sent ' '"$http_referer" ...
0
votes
0answers
16 views

Rsyslog with Nginx virtual hosts

I have an Nginx server with several virtual hosts, each of them generating log files. I'm sending all these logs to a remote server but don't know how to create one log file per virtual on this ...
1
vote
0answers
27 views

How can I configure IIS to save log files in a given folder without creating a W3SVCXXX folder under it?

You can configure IIS to save its logs in any folder you want; however, even if you configure this setting at the site level, it will always create another folder under the one you choose, called ...
0
votes
0answers
7 views

How can we log file download successes and failures from IIS7?

We have a dedicated server: IIS7 Windows Server 2012 R2 Standard This servers sole use is to serve files ~120MB in size. We're looking for the simplest way to log how many downloads were: ...
0
votes
2answers
27 views

Excluding clients from web logs?

Is it possible to exclude certain IP addresses from Nginx's access.log, for example where lots of the requests come from a monitoring server?
2
votes
2answers
44 views

How to log remotely without syslog

I have a bunch of logs which are not created using syslog. I would like to export them to another host. If possible using syslog or rsyslog. A pipe? how can I do that?
1
vote
1answer
57 views

Troubleshooting intermittent Apache 400 Bad Request errors

I'm trying to debug an issue in my app and looking for suggestions or troubleshooting tips. My app consists of a mobile app submitting data over HTTPS to apache (which is using mod_proxy to forward ...
0
votes
0answers
27 views

IIS 8 logging stops at midnight UTC

I have one IIS 8 server where the w3logsvc dies at midnight UTC (we're Central Time, so we're UTC -6). I have to manually start the service to get it back running again. I have the logging set to use ...
1
vote
0answers
24 views

“\xc2:\xc2” in HTTP proxy GET request

Recently I came across lines like these in an HTTP server's access_log (I've changed the real image to "someimage.jpg" - you can browse the images folder directly since directory listing is allowed, ...
0
votes
1answer
46 views

Analyze tons of Apache logs

I'm having an issue analyzing Apache logs - because there's a ton of them. Like first 5 days of March have resulted in about 50Gb of log files ( uncompressed ). How to analyze these? What tools to ...
1
vote
2answers
33 views

Rolling log file without losing any log event

I have an 8GB file called php.log with a running php script logging into it. It is important for me that I log every event, and I want to compress it and empty the current file without stopping the ...
0
votes
2answers
42 views

How to Change sysstat/sar logging folder

I have just enabled sysstat on one of my servers (Ubuntu 12.04), I have noticed it is logging all to /var/log/sysstat/sa04 /var/log/sysstat/sa05 /var/log/sysstat/sar04 How can I change the sysstat ...
0
votes
2answers
36 views

Not getting anything written to my log files in ubuntu

I am not getting any logs in auth.log, kern.log, syslog or any other log files on my 12.04 ubuntu server. There is also no rsyslog.conf if it should be there by default. rsyslogd is not running as ...
0
votes
1answer
17 views

Disabling sentbox in postfix over Squirrelmail

I have installed POSTFIX over Squirrelmail on CentOS Linux... The services I have ran are: service httpd service ssl service mysql service postfix service saslauthd service dovecot I have ...
1
vote
1answer
25 views

Rsyslog: stopping after 1047 file descriptors opened on a centralized log server using TCP

We have heroku drains dumping to 1 log server. There are a lot of instances (~100) sending their logs to this server using TCP. The Server filters the logs based on hostname and puts them into a ...
1
vote
1answer
25 views

Snort logging mode - How to define subnets

I am using snort to log all traffic on an interface snort -i eth1 -l /interface/log/dir -b -U -m 112 With this command I manage to get ALL data which makes my log files very large. Is there any ...
0
votes
1answer
26 views

Will changing IIS Advanced Logging config restart app

I am using the IIS Advanced Logging module on a production server running IIS 7.5. I need to change some of the settings (specifically, which fields are logged) and cannot find anywhere that ...
0
votes
1answer
71 views

Compress and remove logs from jboss on linux with cron

I need to compress and remove log files after some time from serwer. I have never write scripts before. So far i have script logs.sh: #!/bin/bash LOGS=/usr/local/jboss/server/default/log/ ...
1
vote
1answer
67 views

Logcheck alternative for central syslog server [closed]

I have to setup some open source log monitoring on a centralized syslog server. A lot of machines (windows, linux) and some routers and switches sending their logs there. Many years ago when I had to ...
3
votes
1answer
85 views

What are the drawbacks to using mod_log_rotate and rotatelogs.exe together?

On Microsoft-based platforms, are there any drawbacks or hidden pitfalls to using rotatelogs.exe for ErrorLog directive(s) and allowing mod_log_rotate to handle CustomLog directives for rotation? As I ...
0
votes
1answer
18 views

Apache CustomLog for WSGI server is not filtered by LogLevel

I have a WSGI server which is served by an Apache proxy. I would like to have a log file dedicated to that server, so I added the following to the VirtualHost declaration: LogFormat "%h %l %u %t ...
1
vote
0answers
13 views

Using OSSEC HIPS alongside rsyslog, overkill?

I have been tasked to harden our company linux servers. One of the problems that was outlined was the fact that logs are stored on the server which poses two problems: Difficult to aggregate and ...
3
votes
2answers
37 views

sshd logging attempts to login without a private key

On my VPS, running Debian 7, I have ssh enabled on the default port 22 with only private key authentication enabled, all other ports are filtered with iptables. I am frequently getting login attempts ...
1
vote
1answer
48 views

rsyslog udp forwarding truncates at 2048 characters

Rsyslog on a RHEL 6 server is receiving messages locally on port 514 UDP. These messages are sometimes much larger than normal syslog message sizes. I am seeing rsyslog handle all of the messages ...
1
vote
1answer
26 views

IIS FTP server- log of file names transferred

The log files for my ftp server on iis 7.5 show DataChannelOpened and Closed events, but do not log what actual file was transferred. Is it possible to find this out, or add it to the logging?
1
vote
3answers
271 views

Is this a security breach?

I have a server running Ubuntu 10.04LTS (I know it is too old), which over the last couple of weeks has on occasion been unresponsive to network traffic, and needed a hard reset first thing in the ...
0
votes
1answer
107 views

ElasticSearch Multiple Indexes and Routing

Currently I have the following setup. Syslog --> Logstash --> ElasticSearch --> Kibana Logstash is creating a daily index ...