Recording activity on the system (or of a particular program) for later reporting and analysis. Logins, logouts, web server page requests, etc might all be logged.

learn more… | top users | synonyms (2)

0
votes
1answer
15 views

I erased haproxy.log with old content but this file hasn't appeared again

I have a load balancer with HAProxy in Ubuntu 14.04. I did all configurations for turn on log and it works well. However, I erased haproxy.log file and that hasn't appeared again. Can someone help me? ...
0
votes
0answers
5 views

How can I process auditd logs on the fly using ausearch?

I want to ship off logs into centralized logging (ELK). Because of the way things are, I need to do the processing on the machine that creates the logs. How can I get each new auditd event to ...
0
votes
1answer
7 views

OSX Server - Logging POP Mail Connections

I am trying to keep a running record of the users that are accessing our OSX 10.6.8 Mail Server using POP instead of IMAP. The Server Admin application features a running list of Mail connections ...
0
votes
1answer
40 views

Is there any way to log entered password from ssh?

My server is under attack and some one try to run brute force attack on my ssh port, I know that I can block the IPs which are illegal,with iptables,fail2ban, ... but I want to know which password ...
0
votes
1answer
24 views
+50

How to get logwatch to filter dates in celery logs?

I'm a newbie to Logwatch and have it set up to watch log files created by celery, a distributed task queue popular in the Python world. My logwatch.conf "Range" is set to "between yesterday 4am and ...
0
votes
0answers
11 views

Forward to remote syslog in CoreOS

I want to aggregate CoreOS logs to Papertrail service, which basically provides a syslog endpoint for aggregate logging. Common advice for this setup seems to be starting a service that does ...
1
vote
0answers
15 views

Mysql query log is empty after boot

I can't figure out why is general and slow query log empty after computer restart. After restarting the server with systemctl the logs get populated. After reboot the files are created just empty. $ ...
0
votes
0answers
14 views

Customizing httpd logs [closed]

I'm using directadmin on my centos 6 VPS. My server is logging every request for none existent urls to httpd logs(/var/log/httpd/domains) as errors. It's a big issue because the log file turns to a ...
0
votes
0answers
16 views

What does %t in Apache Log Format mean?

I have sever installations of the Apache web server where the Log Format is configured something containing the parameter %t. This documentation clearly states that it is the time the request was ...
2
votes
0answers
21 views

How to maximize utilization of fluentd server?

I have a fluentd server that is processing an average of 1000 req/s. This server is composed by 32 cpus. In this server are running 32 fluentd docker containers with the same configuration. The entry ...
0
votes
1answer
15 views

Field type not being honor in Kibana/Elasticsearch

I'm using a logstash plug-in for a Java app using logback to forward logs on to my logstash server. I've setup a filter definition as follows: input { tcp { port => 2856 codec => ...
0
votes
1answer
37 views

What do these logs mean? Am I attacking someone?

This night my server got put in an "anti-hack" mode where I could only use a read-only FTP to download my data. They told me that I was being a threat to the network, and that these were the logs ...
1
vote
0answers
10 views

Capping log file size: FIFO and maxsize

I am looking for a generic way to hard-cap erratically growing logfiles. The existing answers (linked below) suggest using a polling algo with logrotate, but that approach does not enforce a hard ...
2
votes
1answer
36 views

LDAP Remote Login Logs

How would I log who authenticated against my ldap system on Linux in my lab? I have a lab with several workstations, and one server running openldap. I would like to have similar functionality as with ...
1
vote
1answer
32 views

Forwarding specific logs rsyslog

TL;DR - send specific logs with rsyslog (to a redis server) : how to select the logs to be sent ? I want to forward to a redis server a set (and only that set) of logs, say for instance nginx logs in ...
2
votes
1answer
25 views

systemd journal and docker

I am using CoreOS which uses systemd and docker. One of the big issues with systemd and CoreOS is that it doesn't play 100% nice with docker. Or maybe docker doesn't play 100% nice either. Another ...
1
vote
1answer
17 views

Ubuntu 14.04. auth.log deleted

the log file auth.log has dissappeared on my ubuntu 14.04 server. Fail2ban log says that suddenly the file was gone: 2016-04-16 21:59:56,735 fail2ban.actions: WARNING [ssh] Ban 192.169.189.36 ...
1
vote
2answers
14 views

IIS logs before written to file

I have an IIS version 8.5 web server running on Windows Server 2012 R2. Logging is configured on this server to write a new log file daily to %SystemDrive%\inetpub\logs\LogFiles. My "Log Event ...
1
vote
0answers
23 views

Nginx log to syslog on TCP port

I need to redirect Nginx access and error logs to a remote syslog server. From http://nginx.org/en/docs/syslog.html I saw that I can do: error_log syslog:server=192.168.1.1; However I need to ...
-1
votes
0answers
11 views

What should be the user set to , if i want to send the suricata log files to remote nxlog? [on hold]

I am stuck at a point , basically i have suricata installed on the machine & the same machine has rsyslog. I am wondering by which user:group should we run suricata such that it is able to produce ...
-1
votes
0answers
64 views

IPTables LOG doesn't store anything in logfile?

I have a bit strange situation: I have my VM with ubuntu where it works pretty good... Linux dev 3.19.0-51-generic #58-Ubuntu SMP Fri Feb 26 21:22:26 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux At the ...
-1
votes
1answer
30 views

Which Nginx log file is for fail2ban?

I have files in /var/log/nginx/ the log file /var/log/nginx/access.log is empty. But the /var/log/nginx/access.log.1 is being appended as always. In file /etc/fail2ban/fail2ban.conf, logtarget = ...
0
votes
0answers
33 views

investigate the cause of an instance reboot

I currently run an instance on AWS EC2 ( running Ubuntu 3.13.0-83-generic ), and I am trying to investigate a random shutdown event last night for which I have very little in my log files. Amazon's ...
0
votes
0answers
14 views

SSH not logging failed key authenticated logins from valid users [duplicate]

For some reason OpenSSH is not logging the failed logins in /var/log/btmp (lastb) of valid users when I am authenticating with an SSH Key. On the other hand It logs failed and successfull logins from ...
-2
votes
0answers
18 views

Log all .htaccess/.htpasswd logins? [duplicate]

I'm wondering how I can view/log all usernames and passwords that are used to attempt to access my directory on that is protected by htaccess basic authorization. How can I set this up on an ...
0
votes
0answers
3 views

Weblogic: ignoring error messages

In a project I'm working on we're having problems with Weblogic server logs being filled with BEA-090513 error messages: <BEA-090513> <ServerIdentity failed validation, downgrading to ...
-7
votes
1answer
63 views

We want capture all login user activity and keystroke [closed]

We use CentOS 6/7 we have use script which user are stop that process. So we don't get to see any log from such users. We want capture following: Timestamp when the user logs in to the OS Timestamp ...
0
votes
0answers
24 views

nginx set does not update log

Simple task, I'd like to dynamically set variable to log. First, quick check, set variable temp to a fixed string # nginx.conf http { log_format test_format 'body:$request_body, temp:$temp'; } ...
1
vote
1answer
30 views

How do I pipe stdout and std error to a file and back to stdout on Windows?

On Windows when running a batch script I want to record the output of I run: myprogram.bat 1> mylog.log 2>&1 Which is great - but I have to run a separate tail process to read the output ...
0
votes
0answers
28 views

Kerberos authentication failure with strange account name [closed]

Recently, I observed a lot of authentication failures(about 600 failures per day) coming from one of my company servers with account name "@@CyBAAAAUBQYAMHArBwUAMGAoBQZAQGA1B...."(about 150 characters ...
1
vote
0answers
22 views

BIND9 logging only specified view

For diagnosing purposes I need to log BIND9 queries. BIND9 is configured with two zones/views (internal/external). I've configured logging but there is a lot of unnecessary queries being logged - ...
0
votes
2answers
40 views

mod_authz_core.c Logging

So I'm pretty new to the whole server admin world and just got a fresh install of a server up and running. While looking at my apache2 logs, I've seen a lot of mod_authz_core.c lines. Another guy I ...
5
votes
2answers
61 views

Phone rings, but no call, and no log entries in Asterisk

We have one phone (123) that rings from time to time, displaying what seems like an internal number (6001), but it's not, because we don't use that number and nothing in that range. When you pick up ...
0
votes
0answers
16 views

Yum-cron output to both email and log

When configuring yum-cron on a CentOS (07 x64) host, i noticed the following option (/etc/yum/yum-cron.conf) - # How to send messages. Valid options are stdio and email. If # emit_via includes ...
0
votes
2answers
33 views

How to kill/close log files that are open through lsof grep deleted?

I have a deleted a large log file from our servers. so I executed this command to validate. lsof -nP | grep '(deleted)' and this showed up. how can I permanently delete the results fo this lsof? ...
0
votes
0answers
11 views

rsyslog 8.17 char changing

My rsyslog configuration do not want to work properly Here is my example log: Mar 10 10:57:35 servername log_tag ...
0
votes
1answer
15 views

Weird journalctl Lines

I'm managing my tiny vps and was working on a script to send the logging log to my email. I'm using journalctl to list the logging tentative with: journalctl -u sshd >> ./connection.log ...
1
vote
1answer
42 views

nginx - How often was accessed to specific file or path? [closed]

I'm looking for a command/line to get the information how often was a specific file/path accessed from the web-server. (source: default access-log from nignx) It should check all logs (current and ...
1
vote
1answer
21 views

Log backup clashes with log rotation

On my servers I have log rotation and a backup script which, besides all, backs up the entire log directory. For log rotation I use logroatate on Linux and newsyslog is used on BSD. For log backup I ...
0
votes
0answers
12 views

What would stop apache2 for writing in error log

I usually test my under development website on my own machine, running apache2, and for debug, I type tail -f /var/log/apache2/error.log, and it always did good, until a few days ago. Most of the ...
2
votes
1answer
27 views

Do any OpenSSH 6.7 `preauth` error log entries warrant specific human attention?

A Linux (specifically Debian Jessie) server that needs to be exposed to the Internet is spitting out various OpenSSH 6.7 preauth errors in the logs. For example, I'm getting (timestamps elided for ...
0
votes
0answers
19 views

Optimizing log file size on Ubuntu VM

This is a fact-finding question. I'm implementing fail2ban to keep some unscrupulous elements out of my Django website's experience. Note that my webserver is nginx (reverse proxy) with gunicorn as ...
0
votes
0answers
12 views

Can logadm name rotated logs with yesterday's date?

I've to set crontab to run logadm at 00:00hs, so I can keep every last second of yesterday's log divided by day. I've managed to configure logadm to name my rotated log with today's date, using: ...
0
votes
0answers
16 views

GET requests for foreign domains in NGINX access logs

So I just bought a shiny new VPS and I've installed a LEMP stack (NGINX) and WordPress. It's been up for a couple of days now and I decided to browse the access logs. Inside, I found several rather ...
0
votes
0answers
20 views

Tomcat access log - body of a request shows in the next request

I have a weird behavior in my tomcat (7). An external app sends a bunch of DELETE requests with a body to my TomCat WebApp. The body is being neglected in the webapp (I dont know why the app sends ...
0
votes
1answer
31 views

Linux excessive USER_ACCT and USER_AUTH entries in /var/log/messages

I am running a Fedora 23 email server using sendmail & dovecot and am getting a daily flood of success entries like the ones below. Is there any way to shut off the success and only log the fail? ...
0
votes
0answers
18 views

Logrotate does not work daily, but the status file says it does

This is my logrotate script: /var/log/pyApi.log /var/log/runGet*.log { daily missingok rotate 7 compress notifempty nocreate su } Already checked ...
0
votes
1answer
20 views

Requests with .php5 extension in server logs

Taking a look at access logs and I see a stream of requests from the same IP address that are making requests to files and appending .php and .php5 to the URLs. The logs look something like: ...
0
votes
0answers
29 views

How to identify Access Denied in event ID 5145 : shared object in Win 2012 R2 server

In a Windows 2012 R2 that is serving CIFS folders, how to spot when a file or directory access has been denied? I had activate GPO "Detailed File Share Audit" ID 5145 to both cases 'Success' and ...
0
votes
0answers
15 views

500 errors in php application not logged

I have set up a server with Debian Jessie and Virtualmin. One of my websites is producing 500 errors. I can see the status code 500 in the virtualhost's access log but there is nothing in the error ...