Recording activity on the system (or of a particular program) for later reporting and analysis. Logins, logouts, web server page requests, etc might all be logged.

learn more… | top users | synonyms (2)

2
votes
1answer
13 views

Splitting MySQL General Query Log by Clients

I would like to know a solution to splitting very large MySQL general query logs by specific clients that have accessed the server. Ideally a separate log will be created for each client. Thanks
-1
votes
0answers
17 views

Apache log analyzer suggestions [on hold]

I've spent some time searching for a log analyzer but I'm having trouble finding one that meets my needs. Here's what I'm looking for and you guys know one that matches please let me know: I want ...
-1
votes
0answers
11 views

Audispd writing too much to /var/log/messages [on hold]

I have been trying to stop audispd syslog plugin from writing to /var/log/messages, but none of the recommended configs work. I have a SLES11 installation using the same configuration, without any ...
0
votes
0answers
12 views

JSON vs Key-Value for Splunk

Rolling out splunk I'm debating switching to JSON. Splunk supports spath now and even endorses JSON towards user friendliness (ref: http://dev.splunk.com/view/logging-best-practices/SP-CAAADP6 ) ...
0
votes
0answers
8 views

Linux: UFW blocks connections out via certain ports, how can i find which process initiated it?

I am noticing repeating attempts on my server to connect to a certain IP, UFW logs all the details, including the source port. Is there a way to log which process is initiating this? I am concerned ...
0
votes
1answer
17 views

Rotate log files with timestamp in file name

I have a log directory that my app writes into. It creates a log file like this: 2015-01-22-10-full-activity.log 2015-01-22-11-full-activity.log 2015-01-22-12-full-activity.log ...
0
votes
0answers
22 views

tail -f not following log file in Docker container

I am seeing some strange behavior running the tail -f command inside a Docker container in CoreOS. There are a number of variables I can think of that may be contributing to the problem but I am not ...
0
votes
1answer
19 views

Is Lync chat, or Persistent Chat a viable alternative to email based alerts? [on hold]

I'm dealing with an envrionment that mostly uses email for alerting. The issue I have is that all emails must be journaled by policy. In addition, each email is replicated via SMTP using SMTP ...
0
votes
1answer
14 views

Remote email send save log

I have a problem that I believe has no solution. A customer has a financial program that authenticates to the SMTP server and send emails. However, these outgoing emails are not saved in the "Sent" ...
0
votes
0answers
9 views

tomcat not logging to catalina.out

We have a server running a tomcat app that's not logging to catalina.out, we've checked the filesystem permissions, everything looks fine there. the logging.properties is the same (md5sum) as on ...
0
votes
1answer
21 views

Detailed logging of OS X [closed]

The company I work at is going from small business to medium along with new HR requirements. We mainly have OS X workstations. I'd like a solution where all of these workstations log to a local ...
1
vote
2answers
28 views

Why does my Apache access log timestamp sometimes go backwards?

I noticed that in my Apache log (actually Oracle's branded HTTP Server, which is really Apache) the timestamp of the lines sometimes goes down, instead of up. Here is an example: 1.2.3.4 - - ...
1
vote
1answer
17 views

Nginx Access.log status results according to different file

nginx access.log, I want to do status="200" access_log /var/log/access.log main; status="444" access_log /var/log/access444.log main; status="401" access_log /var/log/access401.log main; this can ...
0
votes
1answer
16 views

How do I find out when a MySQL root password was last changed?

I have looked for solutions to this. I am able to change it, but I need to find out when it was last done and preferably also seeing who was logged in when it was done. Need proof for a security ...
-1
votes
0answers
13 views

/goform/goform_get_cmd_process generated 404s

Server shows some 404s on the following odd request coming from a logged in trusted member of our website (thus, unlikely an attack/trojan). Trying to search the web for parts of that string yielded ...
-1
votes
0answers
6 views

How to create an event during a log entry in apache syslog?

Whenever there is a log entry in apache syslog, I want to trigger an event and send the log message to some http or https server as a request. How can I do that ?
-2
votes
0answers
10 views

Apache access_log file missing info [closed]

The cPanel "lastest visitors" log display option shows detailed info (page loaded, user-agent, etc), but as far as I can determine, the only raw access log is: /usr/local/apache/logs/access_log ...
-2
votes
0answers
16 views

Logstash with multipule indexes, best set up

I am wondering what is the best way to set up logstash if i am reading a file with multipule 'styles' of logs in them. I am using grok to match and process lines in the logs, but i have several ...
2
votes
1answer
17 views

Elasticsearch index much larger than the actual size of the logs it indexed?

I noticed that elasticsearch consumed over 30GB of disk space over night. By comparison the total size of all the logs I wanted to index is only 5 GB...Well, not even that really, probably more like ...
0
votes
1answer
22 views

amavis log email hash

I want to log a hash value of all emails handled by my mail-server. I found in amavis README.customize.gz the following line: The substitution text for the following simple macros is built-in: [...] ...
0
votes
0answers
25 views

Why doesn't logstash grab or index the files from the mapped drive?

I don't understand why logstash is so finicky with network resources. I shared a folder on another machine and then mapped it as Z: under Windows Explorer. I've verified the path and everything. I can ...
0
votes
1answer
40 views

How to get php-fpm to log to stdout / stderr when running in a docker container

I have php-fpm in a docker container and in the Dockerfile I edit the fpm config file (/etc/php5/fpm/pool.d/www.conf) to set up access logs to go to /var/log/fpm-access.log and error logs to go to ...
0
votes
1answer
73 views

Nginx: How to use docker log collector when nginx is running under supervisord

The official nginx docker image (Dockerfile) uses the following trick to hand off its logs to stdout and stderr so that they are captured by the docker log collector and viewable using docker logs ...
0
votes
0answers
20 views

Apache: Regex to log only last IP in X-Forwarded-For

I'm attempting to set up Apache 2.2's logging to record the last IP passed to it by the X-Forwarded-For header. I want to record the last IP from the X-Forwarded-For header if it exists and the ...
1
vote
1answer
18 views

Fluentd not writing apache access log to mongodb

I'm following the instructions from this link to write apache access logs to mongo db- http://docs.fluentd.org/articles/apache-to-mongodb. But nothing is getting written to mongo DB. I'm checking ...
0
votes
2answers
67 views

What is the purpose of elasticsearch logs? How to manage them?

As I understand indexes(or data) are being stored in /var/lib/elasticsearch by default, this folder contains nodes with 0 and 1 folders and overall size of these folders is 376M. The logs are ...
0
votes
2answers
23 views

Can I prevent some of the UFW messages from being logged?

My router broadcasts (sends to 224.0.0.1) something every forty seconds. This is caught by UFW which stores a log entry in syslog: Jan 5 03:49:02 log kernel: [ 1184.788900] [UFW BLOCK] IN=eth0 ...
0
votes
0answers
12 views

BIND logging to find “resolved address”

Currently my logging is set up like this : logging { channel query_log { file "/var/log/named/query.log"; severity info; }; category queries { query_log; }; Which results in: client ...
0
votes
0answers
38 views

Python logger stops logging

On an application server (CentOs 6.4), python's native logger will stop writing to a log file after about 48 hours of continuous operation. This started occurring when we added fluentd (td-agent) to ...
0
votes
2answers
79 views

How to pipe all log files entries to a database on linux?

I am thinking about building an application that would read my different server log files, save the parsed data to a database, and then remove the line from the log file. This is my programer side ...
-1
votes
1answer
39 views

Weird subdomains in access log? [closed]

I have Lighttpd on an Ubuntu server. I just checked the access logs from lighttpd for a particular domain. This domain only has a very simple index.html file that basically says "coming soon". Below ...
2
votes
1answer
75 views

Why is logrotate deleting my logs?

This is my conf: /var/log/apache2/*.log { weekly missingok rotate 52 compress delaycompress notifempty create 640 root adm ...
2
votes
2answers
51 views

How does one manually rotate log without logrotate on open/live file?

My Google-Fu is getting me so close but just not quite there, and I guess I'm too green in Linux to put the pieces together. I have a very large >200GB log file, still being written to. Logrotate ...
1
vote
3answers
480 views

Apache logs full URL rather than URI

My Apache web server logged following messages to access.log: 46.22.173.131 - - [23/Dec/2014:15:34:54 +0100] "GET http://pl.wikipedia.org/wiki/Special:Search?search=&go=Go HTTP/1.1" 302 482 "-" ...
0
votes
1answer
40 views

Syslog-ng loghost - filter not-match

I've got a problem with receiving remote logs from syslog-ng OSE to syslog-ng OSE. I am configuring loghost and at now - i how no idea what i am doing wrong. It seems like filters are not working for ...
2
votes
1answer
31 views

How to make Ossec aware of logrotate

I installed Ossec in a monitor/agent configuration on a few servers of mine. Everything works greats. The only thing that annoy me is that I keep receiving alerts after logrotate rotates the log I ...
0
votes
2answers
40 views

Automatic archiving of log files [closed]

I look at my various log files, and I believe the operating system will periodically archive the log by appending a datestamp to it. I've created some custom logs in my httpd.conf file, however, ...
0
votes
1answer
37 views

Centralised log monitoring for linux servers [closed]

I've read several QA on this site about monitoring servers, but I found out, that none of them centralises all the logs I want to watch. To describe my situation: 10 linux hosts Using logwatch to ...
0
votes
0answers
91 views

Logging user and power activity Synology DiskStation (v5)

Is there any practical way of logging user activity and power state changes on a Synology NAS? I'm not looking for anything very extensively detailed, but I would like to log e.g. Video Station usage ...
15
votes
4answers
555 views

Need a technique to coerce sysadmins to log the reason for accessing a prod server

My company requires that any time a user logs into a production server the reason that person logged in and the changes the user intends to make must be logged. My team wants to do this, but its easy ...
1
vote
1answer
32 views

User blocked in AD by some windroid device

We have a user that is constantly blocked. We checked the logs in the domain controllers and all the information shown is that a WINDROID device is the source. How can I know which device is causing ...
2
votes
3answers
22 views

Use iptables to log connections except for two addresses

We would like to use iptables to log all network connections except if the connecting address is A.B.C.D or the connecting address is E.F.G.H. These two addresses cannot be combined into a single CIDR ...
1
vote
0answers
10 views

Log to file in Asterisk: append with newline

(I am testing on Asterisk 11.7.0~dfsg-1ubuntu1) I am using the following format to append to a logfile, according to the documentation: same => n,Set(FILE(/tmp/mylog.txt,,,a)=my-log-message) ...
0
votes
0answers
37 views

Solaris SSH Server Log Destinaton IP Address

To stay compliant, it's required that my Solaris 10 SSH server log the destination IP address in addition to the existing port logging. Is it possible to add the destination IP address in the authlog? ...
0
votes
1answer
39 views

Sudo-io log output shows garbled text

We have set up in our servers sudoers config the following configuration in order to log the console output for auditoring purposes Defaults:%administrators log_output Defaults logfile=/var/log/sudo ...
0
votes
1answer
104 views

MySQL/MariaDB stops running. How do I find out why?

Today I've seen MySQL/MariaDB stop running on a CentOS VPS. When I check the status I get: # service mysql status ERROR! MySQL is not running, but lock file (/var/lock/subsys/mysql) exists So I ...
0
votes
0answers
16 views

WinServer 2003 R2: Socket Error#10060

So I inherited a legacy in-house application, that is supposed to have printing functionality. However, whenever a user prints, it conks out with the following error, "Message: Socket Error #10060, ...
0
votes
1answer
15 views

Output server and other logs to the browser

I am facing a challenge with my current project.We have it on an ec2 instance and we have a dev and a production server.Now the challenge is,whenever a team member encounters an error on the server I ...
-1
votes
2answers
34 views

How disabled log apache for image file missing?

How can we specify extensions file to filter it in log error of apache? My error.log fills with : [Thu Nov 27 22:42:42 2014] [error] [client 42.42.42.42] File does not exist: ...
0
votes
1answer
82 views

Haproxy not logging requests?

So, I configured Haproxy so the logging would go through rsyslog and, for now, be all dumped in one file. It's definetly logging, as I get those "starting" messages on startup, but no HTTP requests ...