Recording activity on the system (or of a particular program) for later reporting and analysis. Logins, logouts, web server page requests, etc might all be logged.

learn more… | top users | synonyms (2)

-1
votes
0answers
8 views

Server and tomcat log timings varrying [on hold]

All the servers are linux servers and are defined in UTC time zones, but the time in tomcat logs is in GMT. Please let me know how can I sync the timings of both.
0
votes
0answers
16 views

Recommended Storage for Domain Controller Collecting Audit Logs

I am currently working with a customer on getting their Windows audit logs to our SIEM. Since the customer is unwilling/unable to provide hostnames for each host in the environment, I have suggested ...
-1
votes
2answers
28 views

shell command to find common IPs on a specific url from error_log [on hold]

Is there a shell command to group all the most common IPs that requested a specific file via GET (or that came from a url)? For example with this command I can group requests from ip: cat ...
3
votes
0answers
11 views

IIS 7.5 not rolling over logs hourly

I have six IIS 7.5 web servers deployed using a Shared Configuration. The properties for the logging in the configuration are set to log Per Site, W3C, and on an hourly schedule: For five of the ...
1
vote
1answer
37 views

Windows Domain Controller Authentication Logon Logging and Forensics

This question does not take Windows Server 2003 and older OSes into consideration. I know that for local logon (event ID 4624) also the logon type is logged (interactive, remote, etc.). Is there a ...
1
vote
1answer
15 views

What does READ_CONTROL mean in the Security event log?

I have been asked to create audit record of file accesses. By the log is simply overwhelming. A single double click of a text file opening in notepad creates more than 10 log entries with Event Id ...
0
votes
0answers
7 views

Show blocked SMTP connections in Exchange 2010

Currently, I have an anonymous receive connector set up on my Exchange 2010 system that allows from an entire subnet. I'm looking to change this to only allow from specific IPs, but need to know when ...
0
votes
0answers
15 views

How can I detect mail servername used from my clients to my server?

I have a web and mail server with Ubuntu 10.04, Apache 2, courier, postfix, Ispconfig 3 and multiple sites hosted. The clients use mail from Outlook with a config like this: @domain1.com use pop and ...
1
vote
3answers
20 views

How to grep (or other command?) for first instance to last instance in a log?

How does one grep/search a text file so that the results show the first line with the string, and then every other line until the last line with the string? So, if I have a file that looks like this: ...
2
votes
1answer
27 views

What's the purpose of spammy HTTP referers?

In the logs of my website, there's a lot of visits with a HTTP referer set to spam-like websites (usually Russian sites, I've noticed). I assume what they're doing is just using a web crawler to visit ...
0
votes
1answer
14 views

Understanding syslog conf - targeting specific types / tags of logs

I'm combining log files from several docker containers on my host and sending them a remote logging service. I'm just redirecting the output to logger and tagging it: docker-compose logs 2>&1 ...
0
votes
1answer
29 views

Any easy way to find out what process creates files in specified dir?

I have a superuser ssh access to a third-party ubuntu 14.10 box with misconfiguration: some process creates lots of temp files in a dir (and does not clear them, depleting inode limit slowly). Is it ...
0
votes
0answers
20 views

Trouble filtering googlebot from apache access log

Though it seems like it should be pretty straightforward, I have been unable to configure apache so that googlebot's requests are not stored in the access log. I've tried the following lines: ...
2
votes
1answer
15 views

How are filters combined in syslog-ng

If I've got an entry in syslog-ng log { source (src); filter (filter1); filter (filter2); filter (filter3); filter (filter4); destination (all_log) } And, say filter4 is a very ...
0
votes
0answers
15 views

Sftp Log for every Jailed User

I've a sshd_config file like the following: Match user foo ChrootDirectory /mnt/foo-jail/ ForceCommand internal-sftp AllowTCPForwarding no AuthorizedKeysFile ...
0
votes
2answers
23 views

Multiple Apache error logs for one virtual host

I have poorly written PHP application that produces a lot of E_NOTICE and E_WARNING messages to error log. I can't do much about it, but it's hard to keep track of those real errors like E_ERROR and ...
-3
votes
1answer
26 views

Logging traffic in a file? [closed]

today I'm looking for a tool that allows me to log any traffic that goes in and out. It would be perfect if it would store that data in text files on the server. Does anyone have a tool like this? ...
-2
votes
1answer
27 views

How do we extract ftp client information from proftpd logs [closed]

using proftpd 1.3.4. Needs to see which FTP client is being used by end user any idea where it will be logged. or what configuration changes it will need
0
votes
0answers
14 views

Warnings in Tiger auditing reports (process is listening on socket)

I get email logs like the ones below emailed daily from my server. I don't really know what does it mean and thinking about disabling them, but I guess this is not a good idea and it's better to learn ...
-1
votes
0answers
6 views

PuTTy log started to consolidate characters

PuTTy has started behaving very oddly recently. I use the logging facility regularly, and lately it's started to show log entries like this: Mar 29 19:10:33.472infosshd-debug: Accepted ...
0
votes
0answers
18 views

Why would kern.log stop logging after crash & reboot

Server: Ubuntu 12.04 I recently noticed that my servers kern.log had stopped logging. I've not separated iptables from the kern.log so it used to be very active, however recently it's been logging ...
-1
votes
0answers
12 views

mysql slow log filling up without queries

I have slow query logging turned on but have noticed it just fills up with this repeated. It's in there close to 5000 times since yesterday when I reset the log file. There are no slow queries on the ...
0
votes
2answers
43 views

ssh pass original user to environment on server [closed]

First off, i do not know wether passing the information to the environment is the best approach, so i will start by detailing what i actually want to achieve. on a corporate scale, there are servers ...
0
votes
0answers
19 views

Folder keeps getting deleted and I can't find out why

I have a Joomla based website running on CentOS, Apache, PHP, MySQL. I am using plupload file uploader to upload the files. I'm uploading the files to /tmp/uploads directory where they are processed ...
0
votes
0answers
12 views

Recording API Requests from Heroku Application [migrated]

We have a PHP application running on Heroku. The application makes several API calls to different external resources. We know some of these API calls are slow and cause the application's response ...
0
votes
1answer
30 views

Do DFS logs contain folder permission changes?

I have a DFS server sharing files and want to see when an admin gave read/write/full control to a user in a DFS share. Is there any way I can view this? I have checked in C:\Windows\Debug but the log ...
0
votes
0answers
73 views

nginx error log Grok pattern

I am having trouble getting the following nginx error log message to parse in the grok debugger. I have a feeling there is a stupid trick that I should use but can't figure out what it may be. ...
0
votes
0answers
17 views

Stop PostgreSQL from logging statements on error [migrated]

My postgresql 9.3 logs are sprinkled with entries like these (redacted to protect the guilty): STATEMENT: INSERT INTO table (key, value) VALUES ($1, $2) ERROR: duplicate key value violates unique ...
0
votes
0answers
17 views

Runit logging not working

I created a service with runit. Service starts and falls without logging. I need information about STDOUT of service for error detection (service starts without runit properly). I created a ...
0
votes
0answers
29 views

systemd logcheck rule not working

given is this logcheck rule: ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ systemd-logind\[[[:digit:]]+\]: New session [[:digit:]]+ of user [^[:space:]]+\.$ and this log entry: Mar 19 09:16:09 horst ...
2
votes
1answer
61 views

logging SSLv3-handshaking failure on nginx

I have website server by Nginx in FreeBSD. Last week we decided to drop support for SSLv3 connection for our site. However I wondering if nginx has logs of all client who can't do SSL-handshake ...
0
votes
1answer
91 views

Ubuntu 14.04.2 LTS - RSysLog 8.8.0 - omusrmsg not working

I have been trying for two days to get RSysLog to alert all [or specified] users of certain Facilities/Priorities hitting RSysLog. rsyslog.d/50-default.conf: ... *.emerg ...
0
votes
1answer
49 views

Read only permissions on some Linux logs

I would like to limit a certain user (let's call it logger) to be able to only read some (not all) logfile (web, php framework, radius,etc).I am not sure how to do it the "best" way. So far I have a ...
0
votes
1answer
44 views

How can solve this error in nginx logs?

nginx version: nginx/1.6.2 /usr/logs/nginx-error.log [ uest: "GET /server-status HTTP/1.1", host: "127.0.0.1" 2015/03/14 05:21:24 [error] 23068#0: *8616047 openat() ...
2
votes
1answer
38 views

How to log a hash of the session cookie with Apache HTTPD?

So, I want to log an information that is equivalent to a session cookie (called session_id) in the Apache logs. I do not want to simply put the cookie in the log format (%{sid}i) because a compromise ...
-2
votes
1answer
34 views

sql server: best practice for log backup in full recovery mode [closed]

I have a development sql 2014 environment. I need to put all db in full recovery mode in order to test availability groups, so I need to manage logs to avoid excessive growth. I don't need to keep log ...
0
votes
1answer
29 views

Lighttpd stops writing to access.log

I have this issue with my lighttpd installation where logging to access.log will cease once the default log-rotating software erases my access.log after copying it to access.log-YYYYMMDD. I have to ...
1
vote
0answers
54 views

Fortigate 60D - Empty log and report

Environment: Fortigate 60D Forti OS 5.0 I can not see any log or report in the firewall. I have already activated forticloud and I recieve empty reports. Is there something that we have to ...
1
vote
0answers
15 views

Possible to have FQDN in Debian Logfiles?

Is it possible to have instead the hostname the fqdn inside debian log files? Example: Now its: Mar 2 18:00:12 www rsyslogd: [origin software="rsyslogd" swVersion="5.8.11" x-pid="2442" ...
0
votes
0answers
103 views

sending tomcat catalina.out to syslog

we're on tomcat 6.4 on centos. I've been trying to get the catalina.out logs in tomcat to syslog. For reasons it's very important that I don't send the raw logs, they have to be tagged with OURTOMCAT: ...
0
votes
0answers
35 views

Turn off error and access logs for one virtual host (Apache HTTP Server 2.4 on Windows) [duplicate]

How to turn off error and/or access logs for one virtual host in Apache HTTP Server 2.4? OS: Windows (There is a question about that but it is about Linux.)
0
votes
0answers
48 views

Can't setup Apache CustomLog to directly import in Piwik

I configured apache just like this article (https://github.com/piwik/piwik/tree/master/misc/log-analytics#setup-apache-customlog-that-directly-imports-in-piwik) explains but nothing happens during ...
0
votes
0answers
8 views

Error Reporting for File Copy Process

I have a rather complex process in place which runs a java program to retrieve service records from our CRM and export them into an excel spreadsheet, which gets placed onto a server in our data ...
0
votes
0answers
50 views

IIS 7, LogStash and flushing IIS logs

I'm using LogStash to import IIS logs into ElasticSearch. It's done by pointing the LogStash to the folder with IIS logs which contains several log files each per day. Currently I don't use the ...
0
votes
1answer
42 views

how to monitor multiple log files?

I have to monitor multiple logs. By now I have a iTerm on my mac with several windows. So I have all logs on one sight. The idea is now to have a RaspberryPie with an extra monitor. By now after a ...
0
votes
1answer
143 views

Windows Event ID 4624 Repeating With Resource Not Available

We've recently started logging 4624 event IDs on our domain controllers to help track user activity. Overall this has been fine, but recently started getting these messages over and over again. ...
0
votes
2answers
19 views

Lighttpd error log increases too fast

I am using lighttpd v1.4.35 and I have developed a simple web page with some links to test. After some clicks I have noticed the error log is increasing too fast. In /etc/lighttpd/lighttpd.conf I ...
0
votes
1answer
20 views

How to set up a global CustomLog on Apache2 for every virtualhost

Actually I got some issue with file descriptors on Debian Wheezy with 3.2.13 kernel and Apache/2.2.16. I would like to reduce this limit, actually each virtualhost got a CustomLog and an ErrorLog, I ...
0
votes
1answer
218 views

Logstash: Failed to flush outgoing items

First of all, I'm a total newbie to logstash. Despite the fact that I've managed to achieve some basic logging (trying to parse an apache log file without the build in COMBINEDAPACHELOG). However, I ...
1
vote
2answers
68 views

My site is suddenly getting slammed, not legitimate traffic

I run a site with about 700 registered users. On a typical day, there are 30-50 hits. In the last three days, the traffic has increased insanely fast (according to Google Analytics). I got 7,287 hits ...