Recording activity on the system (or of a particular program) for later reporting and analysis. Logins, logouts, web server page requests, etc might all be logged.

learn more… | top users | synonyms (2)

2
votes
3answers
777 views

Benefits of log rotation

I have been using logrotation for years and never thought too much of it being a problem until I came across a question on stackoverflow ...
2
votes
6answers
5k views

Get list of user-agents from nginx log

I have nginx log file, and I want to find out market share for each major version of browsers. I am not interested in minor versions and operating systems. I would like to get something like this: ...
1
vote
1answer
375 views

Logging and Log-viewing tool for cloud?

I have an app which simply logs to a file. I am planning to deploy this app on cloud. If I deploy it on AmazonEC2 instances (multiple), I would want to monitor logs of every instance. Something which ...
8
votes
1answer
2k views

Empty/Null Apache request entries in access log

This entry got logged in a Apache access log: IP ADDRESS - - [00/00/0000:00:00:00 -0000] " " 301 - "-" "-" It was detected by LogWatch as a null HTTP Response and also got marked as a successful ...
7
votes
6answers
4k views

Monitor the shell activity of a user on your Unix system?

Trust, but verify. Let's say I want to hire someone a sysadmin, and give them root access to my Unix system. I want to disable X windows for them, only allow shell usage (through SSH, maybe), so that ...
5
votes
5answers
17k views

How can I enable logging for requests going through mod proxy

Is there a way to log requests going through mod proxy? I need a way to debug my configuration, because I don't seem to be getting where I should be. I need the following information: headers of ...
5
votes
4answers
914 views

Log monitoring toolsets for Unix? [closed]

What are some good tools for monitoring logs on a system? I am currently using logsentry, which basically just runs grep on logs, ignores regexps I tell it to ignore, and mails me everything else, but ...
3
votes
1answer
379 views

Need help grepping postfix log

I'm trying to search for an unknown string (Message ID) in a log based on a known string (recipient address), and then grep the unknown string to output the entire relevant log information. I'm able ...
3
votes
3answers
2k views

Log commands executed over ssh

I would like to log all commands executed over SSH. Say, ssh something@server.com COMMAND I want to log "COMMAND" on server.com I did search extensively but could not find anything. There is ...
2
votes
3answers
150 views

Cron job unified logging

I have a series of cron jobs on a server machine. I know I can redirect their stdout/stderr output to a file. If I redirect several cronjob outputs to the same file, will that work even if some of the ...
1
vote
1answer
2k views

Logging Timeout'd Request in Apache 2.X

I am migrating some applications from Apache 1.3 to 2.2. We used to run some tests where attacker opens some HTTP connection to our server, and do nothing. Apache 1.3 would log the following 408 ...
1
vote
1answer
10k views

How to configure logwatch to monitor a custom log file

Ubuntu Server 9.10 Hi Guys, Could someone point me to some instructions for how to get logwatch to monitor a custom log file? I have a dropbox solution that documents uploads/downloads to a log ...
0
votes
1answer
378 views

rsyslog from Heroku drain creates empty log files

I'm sending logs from my Heroku app to an rsyslog server, but the resulting log files seem to come up empty. The rsyslog configuration for receiving remote messages is as follows: $template ...
0
votes
5answers
3k views

iptables logging not working?

OS: Ubuntu 10.04 Logging daemon: rsyslog For some reason i'm not getting any iptables logs, even thought i don't look through them very often i'd still like to get it working for the sake of it ...
10
votes
1answer
3k views

No more logging after upgrade to Debian Wheezy

Syslog, auth.log, kern.log and messages log files are not updated anymore after upgrading to Debian Wheezy (Debian Squeeze was previously running). How could I fix it?
9
votes
1answer
3k views

Is there a way to view an HP ProLiant server IML log from within ESXi?

I'm investigating a system outage on an HP ProLiant DL360 G7 server running VMware ESXi 5.1. While I'm a huge advocate of installing the HP-specific management agents for ESXi or using the ...
5
votes
2answers
12k views

script not found or unable to stat: /usr/lib/cgi-bin/php-cgi

I have just seen a new series of error in the /var/log/apache2/error.log [Thu Oct 31 06:59:04 2013] [error] [client 203.197.197.18] script not found or unable to stat: /usr/lib/cgi-bin/php ...
5
votes
3answers
2k views

How do I secure my Asterisk server?

Our asterisk server was compromised. some calls were made to Asia countries last weekend. Thought we have improved our network configuration, we still want to determine how the intrusion was done, we ...
5
votes
1answer
453 views

When does IIS log a request?

This sounds silly, but when do they log requests? I have a web application, and about 500 HTTP proxies that will load up that application. But problem is sometimes (and this morning a lot), the proxy ...
5
votes
2answers
8k views

Why is Syslog Not Writing Logs To The Designated Files?

I've been trying to route Apache's logs through Syslog (for some reason log rotation had stopped, and using Syslog and logrotate seemed a reasonable solution). I have sent Apache's error logs to ...
4
votes
1answer
1k views

Newsyslog wildcards - rotate all logs in a directory

I am running FreeBSD 8.1. I am trying to make newsyslog rotate logs defined by a dynamic path: # logfilename [owner:group] mode count size when flags [/pid_file] [sig_num] ...
4
votes
2answers
2k views

Why are external domains appearing in my apache logs?

I've got several log entries that refer to an external domain - mainly a Russian search engine (http://www.yandex.ru/) How are these appearing in my logs? 82.146.58.53 - - [10/Jun/2010:00:49:11 ...
3
votes
2answers
5k views

init script that logs output of the script

How can this be done? I know it's pretty simple and includes appending something like & or &> to the actual command that starts the init script. But, what is the best approach and how can ...
3
votes
3answers
441 views

apache log analyzer with IP information is needed

I am not sure if here is the right place for asking my question or not... anyway... I need a apache log analyzer that shows number of each IP request separately. I want to view what IPs have visited ...
3
votes
1answer
11k views

Log LDAP access of the Active directory

I am looking for a method to log ldap access of a Active Directory domain controller. I want to be able to log the username and source IP address access to both 389, and 636(encrypted). A simple ...
2
votes
1answer
305 views

Strange HTTP request in Apache Logs

I've discovered some strange HTTP requests in my apache logs, but I'm unsure as to whether I should be concerned by them or not? [Sun Nov 02 19:45:43 2014] [error] [client 80.82.64.122] script not ...
2
votes
1answer
1k views

Timzone incorrect for log files only?

I have a small server running centos 6.4 and it is working quite nicely for some time. One thing that still bugs me is that the time in my log files is different then the time the 'date' command ...
2
votes
1answer
232 views

Per-user vhost logging

I have a working per-user virtual host configuration with Apache, but I would like each user to have access to the logs for his virtual hosts. Obviously the ErrorLog and CustomLog directives don't ...
2
votes
2answers
472 views

Nginx 400 errors due to random encoded string starting with “\x” from random IP addresses

I assume these are some sort of bots, but would like to know what are they trying to do to my server. The logs in questions are below and the IP address has been changed from the original. ...
2
votes
2answers
5k views

Separate Nginx access log file for certain requests only

As far as I can see Nginx supports by default 2 log files: error_log (tracks issues related to the Nginx server itself) and access_log (tracks requests processed by Nginx). Whilst it is possible to ...
2
votes
1answer
274 views

using syslog-ng and patterndb, how do I specify an “empty” pattern?

When I receive kernel traces in my logs, the last line is empty. I'd like to filter/ignore these empty kernel messages using syslog-ng and patterndb. Here is the pattern I have so far that is not ...
2
votes
2answers
1k views

Preventing logrotate's dateext from overwriting files

I'm working with a system where I would like to use the dateext function of logrotate (or some other way) to add the date to a logfile when it is rotated. However in this system it is important that ...
2
votes
1answer
489 views

Server installation logging / logbook / diary?

Are there some ways field-tested ways to keep a kind of logbook for a server? Including: software installations (and de-installations) custom configurations (e.g. of a webserver, ssh daemon, etc.) ...
2
votes
3answers
927 views

Postfix custom log

Is there any way to customize postfix logging? I'm trying to get some reports out of it and I find it almost impossible to parse on it's default. Probably a XML like logging would be perfect. Thanks. ...
2
votes
3answers
6k views

Why did my CentOS 5 production server reboot?

I have a CentOS 5.2 box running my production web server (Apache 2 + Mongrel_cluster) for a Ruby on Rails project. The machine is hosted by GoDaddy.com and is a "virtual private server". The system ...
1
vote
1answer
246 views

Access log of nginx: why are foreign URLs logged?

My access log is full of such entries: 178.207.40.219 - - [03/Apr/2014:17:34:37 +0200] "GET http://win.mail.ru/cgi-bin/auth?Login=nutyck@bk.ru&Domain=mail.ru&Password=241716 HTTP/1.1" 403 168 ...
1
vote
1answer
2k views

Can't configure PHP error log

I'm running apache2 with php5 on Linux Mint 13 Maya. I have defined a virtual host and these two entries there: ErrorLog ${APACHE_LOG_DIR}/error.log CustomLog ${APACHE_LOG_DIR}/access.log combined ...
1
vote
4answers
2k views

Rsyslog not logging from remote server

I am trying to set up a centralized log server. I have central server (A) receiving logs via a remote server (B) on port 514. I know it is receiving these. Here are a few entries from a tcpdump on ...
1
vote
3answers
252 views

What consequences to take from what i read in logfiles?

Since some weeks i manage my first Webserver, a Seaside application behind an Apache proxy on Linode, and i installed logwatch to send me daily logs. Where can i get information on when i have to act ...
1
vote
4answers
710 views

Make cron log rsync only if there was transfer

I have this crontab running every 5 minutes: date >> ~/18/rsync.log rsync -vaz user@r18:~/assets ~/18 >> ~/18/rsync.log 2>&1 It adds this to the log file every 5 minutes: Thu ...
1
vote
1answer
881 views

Logging DNS requests on a windows DNS resolver

How can i log DNS requests sent by clients to a windows DNS resolver without using the debug log file technique? It can be a windows 2008+ only solution edit 1 - some additional background: i ...
1
vote
1answer
755 views

Mysql remote connections logging

I need to allow remote connections to my mysql server running on latest stable CentOS. I don't like this idea at all so I want at least to collect as much relevant information as possible. To be ...
1
vote
2answers
6k views

Remote Desktop failed logon event 4625 not logging correctly on 2008 Terminal Services server

When I use the new remote desktop with ssl and try to log on with bad credentials it logs a 4625 event as expected. The problem is, it doesn't log the ip address, so I can't block malicious logons in ...
1
vote
2answers
813 views

httpd access log, ip logged is reversed proxy how to find actual proxy

Check access log and found out that the IP that was logged from users came from the reversed proxy server. The setup is like this www.abc.com -> reversed proxy to my server 123.123.123.123 Is ...
1
vote
2answers
569 views

How do I ensure no duplicates when using LogParser to load IIS logs into SQL Server every fifteen minutes?

I would like to set up a scheduled task to run every fifteen minutes on a work web server that will run LogParser on today's IIS log file and insert it into a SQL Server database table. How would I ...
1
vote
5answers
828 views

log rotation tool that keeps only a specified amount of logs and discards everything else

I'm looking for a cronolog-like tool that will keep only last n lines or last x minutes of logs piped to it and discard everything else Is there such a beast? UPDATE: I know about logrotate and it ...
1
vote
3answers
3k views

Logging behind a reverse proxy?

I am currently running Varnish as a reverse proxy in front of our development website, testing before deployment into production. One of the things I've had to come to grips with is logging: in a ...
0
votes
2answers
228 views

AWStats LogFormat for AWS Elastic Load Balancer

Hoping someone can point out what is wrong with the LogFormat I'm attempting to use with the access logs generated by Amazon ELB. Multi-line for ServerFault readability: %time5 %elb %host %host_port ...
0
votes
1answer
2k views

How can I automatically delete old apache error log files?

My /var/log/apache2 folder is getting out of hand. It has loads of old compressed error.log files that I want to get rid of before my server runs out of space and explodes. Firstly - Is it safe to ...
0
votes
1answer
126 views

Apache reports status 200 but file doesn't exist in the server

In Apache access log I have these lines repeating all over the file: 186.44.190.132 - - [22/Feb/2013:23:41:34 +0100] "POST /includes/wishlistcwh.php HTTP/1.1" 200 42416 "-" "Mozilla/5.0" ...