Recording activity on the system (or of a particular program) for later reporting and analysis. Logins, logouts, web server page requests, etc might all be logged.

learn more… | top users | synonyms (2)

0
votes
0answers
7 views

How do I capture unique id in haproxy logs?

I'm trying to capture the unique id for each request in my logs. I thought I could use capture request header X-Unique-ID len 16 on the header but its not working. Any suggestions? global log ...
0
votes
1answer
18 views

Unable to log into a rsyslog filter using logger

Ubuntu 64 14.04 comes with rsyslog (7) built-in. I've added test.conf to /etc/rsyslog.d with the following line: :syslogtag,isequal,"test" /var/log/test.log I then restart rsyslog and log ...
0
votes
0answers
13 views

LOG server - attack on my site? [duplicate]

have a problem. 3 days ago somebody clean my server, but I do not know how. My server support sent me to mail with LOGS: Friday Aug 21 03:55:47 2015 0 78.47.143.141 388 /home/stopmy/ftp/mark/site.htm ...
0
votes
1answer
18 views

How to enable slow query log in MySQL Galera?

I want to enable slow query logging in MySQL Galera. In order to do so, I have enabled it through my.cnf: log_slow_queries = /var/log/mysql/mysql-slow.log long_query_time = 1 ...
8
votes
2answers
58 views

How to configure a log aggregator to authenticate data?

Background: Remote log aggregation is regarded as a way to improve security. Generally, this addresses the risk that an attacker who compromises a system can edit or delete logs to frustrate forensic ...
3
votes
2answers
41 views

Nginx, log referrers from certain domain to separate log file

I have my nginx setup to block certain referers like so: if ($http_referer ~* (site_name) ) { return 403; } This works fine, however I'd like to also log the blocked referrer to a separate file. ...
0
votes
0answers
16 views

Where does elasticsearch store graylog2 logs?

I've setup fluentd to stream docker container logs to a centralized graylog2 server. I'm hoping to setup log rotate for these logs. From what I understand, graylog stores these logs in ...
0
votes
1answer
15 views

AD log message showing E-mail of user object creation

I am referencing the active directory log message (4720) which shows 'User Principal Name' as an email address. However there is another email address found when viewing the actual User Object ...
0
votes
0answers
25 views

Filter out PHP Notice from Apache2 logs while keeping verbose settings in php.ini [closed]

Is it possible to filter out PHP Notice entries from Apache2 logs before writing but without manipulating PHP logging levels? The rationale is: we need both reasonable Apache2 error logs and quite ...
3
votes
0answers
25 views

Office 365 Exchange client connection logs

We use Office 365 at our company and I was wondering if it is possible to see Exchange client connection logs in the admin panel anywhere? I want to identify what IP addresses outlook clients have ...
1
vote
0answers
23 views

Rotation and continuous writing of large log files with rsyslogd

I have an extremely busy log file (let's call it /var/log/service.log) that is also frequently searched for troubleshooting reasons. Output to it is nearly continuous and 24/7. It probably puts out ...
0
votes
3answers
25 views

Log pid than cpu higher than a value

I'm looking for a way to log the pid of process higher than a fixed value of cpu (ex 40%). I tried with command like this : ps -eo pcpu,pid,user,args | sort -k 1,2 -r | head -10 But, first, it sorts ...
0
votes
1answer
51 views

Why does my server running nginx/php-fpm keep losing session capability without generating any errors?

I am managing a server that has a couple dozen websites on it and they have all been working fine until last week when it was noticed that one site had seemingly lost the ability to maintain session ...
1
vote
0answers
52 views

What is wrong with my logstash configuration?

Background I have two types of log files: output from an ETL process, and then output from a downstream processor. We call these "ETL" and "Processor" logs. The ETL logs are in their own folder ...
3
votes
1answer
36 views

Windows Events for Remote Desktop logon failure

According to ref the logon types 10 and 3 in windows events are represnting Logon Type 10 = RemoteInteractive Logon & Logon Type 3 = Network Logon But when i tried to connect a Windows machine ...
0
votes
1answer
16 views

logrotation process stdout and stderr windows

I have a service on windows that's running another process that prints many lines to its STDERR and STDOUT. I'm capturing those lines and redirect them to some log file. I would like to logrotate on ...
-1
votes
1answer
47 views

Lots of mysql processes log error too many open files

I'm having problems with a CentOS server thats running slowly, htop shows about 40 lines of this which I think is causing the problem: 27218 mysql 20 0 17.7G 7449M 5088 S 0.0 46.8 0:00.24 ...
0
votes
2answers
36 views

Is this a user/pass connection or an email communication connection?

I have lines like these in /var/log/messages: Jul 12 01:26:00 h2 xinetd[1596]: START: smtp pid=11253 from=::ffff:221.219.213.54 I need to know if that is an email connection like the ones being made ...
0
votes
0answers
15 views

How to make name resolving faster when querying a huge iptables log file

My daily iptables log files are 1-1.5 GB, which as you see is a huge size. And the amount of logs will get more and more each day. I often need to extract source and destination ip addresses, resolve ...
1
vote
1answer
26 views

Logrotate script not uploading to s3

I am trying to use logrotate to upload log files from my rails and nginx commands once a day. When I run the logrotate command manually the files successfully upload, but it never does it on its own. ...
0
votes
2answers
34 views

SFTP logging doesn't work

I have some problemas trying to log sftp actions. I've configured some files but it doesn't write in the log file. I'm using Debian 7. User configuration: ...
0
votes
1answer
22 views

Central Logging Options - need flat file as well as elastic search

I would like to have ephemeral ec2 instances push logs to a central flat-file store for archiving and manual perusing, as well has have that data pushed to elastic search. Is there a single agent ...
2
votes
1answer
22 views

Does AppEnforce.log really log the context used for installation incorrectly?

I have a deployment type with the following attributes: Technology: MSI Installation behavior: Install for system Logon requirement: Whether or not a user is logged on Installation program ...
0
votes
2answers
28 views

logrotate not workig as expected

I am setting up logrotate & realized that a few of the options are either incorrectly explained/understood. My logrotate rotate 52 keyword is creating 52 files of the same log every time it ...
0
votes
0answers
13 views

Log specific info from request in Apache

I need to login whether X-PDONE-SESSION-ID come on each request being made to my server or doesn't. First I have enabled mod_forensic_log and I setup this at my virtual host logging: <VirtualHost ...
0
votes
0answers
17 views

Solaris run rsync after logadm

I'm trying to get this logadm configuration running. '/dir1/*/*/alert*.log' -C 8 -c -s 10m -t '$file_%Y-%m-%d' -z 0 -a '/usr/bin/rsync -qp /dir1/*/*/alert*.gz ...
0
votes
1answer
37 views

What is this error in apache error.log

What is this error in apache error.log and how to fix that problem?: [Sat Jul 25 09:23:11.961977 2015] [proxy_fcgi:error] [pid 4448:tid 140445816444672] [client 127.0.0.1:57067] AH01068: Got bogus ...
0
votes
1answer
12 views

Which log file can I use for server port analytics?

Ideally I'd like to use piwik to track conversions from ads to server connections on port 5000 and port 5001 but I highly doubt that is even possible. I'm willing to settle for [ipaddress,time ...
1
vote
0answers
21 views

fluentd modular configuration

Is there any way to setup fluentd/td-agent in a way that it's configuration will be modular? I know there is @include directive but this works only if every time I add something new I modify main ...
1
vote
1answer
55 views

Audit Logs for Environment Path Changes

Something (or someone) keeps changing our environment path variables on several of our servers. I have the Audit Policy (under local sec pol) set to Success, Failure for all but Process Tracking ...
0
votes
1answer
40 views

How can I log a linux command's process tree?

I'm trying to track the usage of a certain command so I want to log its parents (to see what is actually using it) Solaris has "ptree" which would be pretty easy to parse and log: # ptree 4198 4198 ...
1
vote
0answers
42 views

Event Log trigger configuration for scheduled tasks not working despite working with the eventviewer

I'm trying to start a task that gets triggered by specific events. The XML configuration for the filter I'm using is the following: <QueryList> <Query Id="0" Path="Security"> ...
0
votes
0answers
6 views

centralized logging when clients have an intermittent connection

I'm working on a project where we'd like to monitor remote embedded clients running Ubuntu Trusty. We are planning to start by just centralizing critical and error log messages on one cloud server. ...
0
votes
1answer
30 views

Logs during rpm installation

I'm able to obtain logs in /var/log/message while installing a package using yum, but I'm not able to find logs when a package is installed using rpm. Is there any option to log rpm ...
0
votes
0answers
47 views

how to set up logging-files ubuntu 14.04

Im having some trouble to correctly configure my mail logs. How can i configure the following needs? I have a mail server and the log result should be 7 different files mail.sunday, mail.monday, ...
0
votes
1answer
33 views

Send user level messages to syslog

I currently have syslog.conf like so to send INFO logs to /var/log/messages *.info;mail.none;authpriv.none; /var/log/messages; I have an application that uses python libraries LOG_USER facility to ...
0
votes
1answer
32 views

How to find out what is being accesed in Apache logs

I am managing a dedicated server with hundreds of websites, in which there is a main log for Apache. The server has spikes in Apache CPU usage once every 4 or 5 hours and after a review I found in ...
0
votes
1answer
53 views

Event viewer missing logs following unexpected reboot

One of our Server 2012 boxes lost power unexpectedly recently. We're still not sure how it happened, but given its suddenness I suspect someone in the data centre tripped over a power cable. I went ...
0
votes
1answer
45 views

Logging when cisco switch restarts, shuts down, or starts up

Is it possible to log events like restart,shutdown and start in cisco catalyst 3750. Also need to log when a new user is created. I'm forwarding the logs from the cisco switch to the syslog server and ...
0
votes
0answers
31 views

Fetch logstash-forwarded auth logs from elasticsearch database

In my logstash-forwarder, i have configured to ship /var/log/auth.log messages under the files section as, { "paths": [ "/var/log/syslog", "/var/log/auth.log" ], ...
0
votes
0answers
9 views

How to log any connection request from statically banned IPs with shorewall?

So I'm banning IPs with shorewall drop IP. How do I get shorewall to log connexion requests from those IPs ?
1
vote
1answer
31 views

Constant server pings

I've got a Python/Django app hosted on Heroku, monitored on New Relic, with logging tracked on Logentries. I've noticed a large amount of logs that are of the form: at=info method=HEAD ...
0
votes
0answers
16 views

prevent rsyslog to duplicate logs

my rsyslog writes on secure and on messages i have this *.info;mail.none;authpriv.none;cron.none /var/log/messages authpriv.* ...
0
votes
0answers
51 views

Acount Logon events not getting on domain controller

We have windows domain running with 2012R2 DC, We have enabled logging through GPO for all member servers and DCs, but I dont see any Account logon/logoff events (4624/4634) being logged, neither on ...
0
votes
3answers
50 views

How to make a cron script for cleaning up a log file? [closed]

I don't usually do this kind of stuff, so I just have to ask. How do I make a script which checks a log file, lets say it's named log.txt, grabs everything but the first 100 000 lines from it to a new ...
2
votes
1answer
132 views

Forwarding structured data with rsyslog

We have a Java application logging structured data (MDC with log4j) via syslog to rsyslog (7.6.3) on localhost. localhost should then forward these log messages to a central logging host (also running ...
0
votes
0answers
35 views

rsyslog syntax error on non existent line

I get a syntax error message for my rsyslog configuration file at line 61. But my configuration only got 60 lines. I checked the last line in my configuration and it seems correct since it is the ...
-3
votes
1answer
40 views

How do you restart logging after deleting an NGINX log? [closed]

I deleted my NGINX log because it was very large, thinking that NGINX would automatically create a new one in its place. It didn't, and now I don't have logs. The file was previously located at ...
0
votes
1answer
39 views

nginx log entries out of sequence, possible to fix?

I have an nginx log parser which relies on fact, nginx log entries placed in sequential order. But from time to time I have log like this: [2015-07-01T08:41:59-07:00] https "GET ... ...
0
votes
2answers
78 views

rsyslog (local) and remote logging

I have several linux servers that I want to monitor the log files. I thought it would be great to setup a central log server that can capture incoming rsyslog packets. Each hostname would have its own ...