Recording activity on the system (or of a particular program) for later reporting and analysis. Logins, logouts, web server page requests, etc might all be logged.

learn more… | top users | synonyms (2)

0
votes
0answers
16 views

GET requests for foreign domains in NGINX access logs

So I just bought a shiny new VPS and I've installed a LEMP stack (NGINX) and WordPress. It's been up for a couple of days now and I decided to browse the access logs. Inside, I found several rather ...
0
votes
0answers
29 views

Tomcat access log - body of a request shows in the next request

I have a weird behavior in my tomcat (7). An external app sends a bunch of DELETE requests with a body to my TomCat WebApp. The body is being neglected in the webapp (I dont know why the app sends ...
0
votes
1answer
37 views

Linux excessive USER_ACCT and USER_AUTH entries in /var/log/messages

I am running a Fedora 23 email server using sendmail & dovecot and am getting a daily flood of success entries like the ones below. Is there any way to shut off the success and only log the fail? ...
0
votes
0answers
19 views

Logrotate does not work daily, but the status file says it does

This is my logrotate script: /var/log/pyApi.log /var/log/runGet*.log { daily missingok rotate 7 compress notifempty nocreate su } Already checked ...
0
votes
1answer
20 views

Requests with .php5 extension in server logs

Taking a look at access logs and I see a stream of requests from the same IP address that are making requests to files and appending .php and .php5 to the URLs. The logs look something like: ...
0
votes
0answers
39 views

How to identify Access Denied in event ID 5145 : shared object in Win 2012 R2 server

In a Windows 2012 R2 that is serving CIFS folders, how to spot when a file or directory access has been denied? I had activate GPO "Detailed File Share Audit" ID 5145 to both cases 'Success' and ...
0
votes
0answers
19 views

500 errors in php application not logged

I have set up a server with Debian Jessie and Virtualmin. One of my websites is producing 500 errors. I can see the status code 500 in the virtualhost's access log but there is nothing in the error ...
0
votes
1answer
49 views

MySQL logs different time than NOW()

MySQL server logs entries with different time than system or mysql itself: mysql> select @@global.time_zone; +--------------------+ | @@global.time_zone | +--------------------+ | SYSTEM ...
0
votes
1answer
31 views

How can I know why my dedicated server froze or crashed ? (Unix-like)

Recently, my dedicated server froze for around 50 minutes on Sunday. It did not respond to ping or any command. In the end, it was hard rebooted by the hosting company and everything works fine since ...
0
votes
0answers
26 views

nginx access log and $connection variable

!Hi, guys! I've added $connection variable to output of nginx access log and everything seemed working fine. But i've noticed that sometimes different client IP's assigned to the same connection. Up ...
0
votes
2answers
47 views

How to securely send logs from your application?

I am currently setting up logging with graylog for my system and have a problem, that the logs can potentially contain sensitive information. The standard behaviour is to send the logs unencrypted via ...
0
votes
0answers
35 views

iptables doesn't recognize --log-prefix

I'm having difficulty getting iptables to log. Here are the relevant commands: /usr/sbin/iptables -N LOG_DROP /usr/sbin/iptables -A LOG_DROP -m limit --limit 2/min -j LOG --log-prefix "iptables ...
0
votes
1answer
16 views

Tomcat7 fails to restart and log issue

I have a CentOS (CentOS release 6.7 (Final)) server running Tomcat7. I ran some updates using yum and now Tomcat will not restart. etc/rc.d/init.d/tomcat restart Stopping tomcat: ...
0
votes
0answers
30 views

How to configure rsyslog to forward all log files from specific directory?

I have already configured and working setup of centralized log server with web interface. But i need to forward all log files from specific directory in remote host "/Volumes/path/to/dir" to my ...
0
votes
1answer
51 views

AWS ELB logs missing requests

We are trying to match requests made to our backend instances with logs from our ELB. Our application server logs clearly indicate that certain requests are coming in, but the matching requests are ...
0
votes
1answer
17 views

Huge /var/log directory inode in ext3 after creating and removing many files

I have Debian Jessie, /var/log on root partition of type ext3 (rw,relatime,data=ordered). Four days ago logrotate dumped tens of thousands files, this was fixed and files deleted. After this: # du ...
-1
votes
1answer
26 views

How to restart system-wide logging on a Linux server? [closed]

I am running a Centos 7 Linux server. I tried to install rsyslog. Because of a misconfiguration, we had to uninstall it. Since then, I see that all logs are truncated and no new logs are being ...
1
vote
1answer
68 views

How to read sar file from different ubuntu system

I am using two different version on ubuntu one is 14.04 and other is 15.10. I want to read 14.04 systems sar files from ubuntu 15.10 system. I have transferred the sar files but can't read it.
1
vote
1answer
59 views

Add timestamp to apache error log

So I keep getting the following error in apache logs: sendmail: fatal: open /etc/postfix/main.cf: No such file or directory And I'm trying to figure out where/when it's being attempted, but I can't ...
0
votes
0answers
26 views

How do I forward Common Access Card information from a Blue Coat proxy to an Apache server?

I suspect I will have to forward a header from the proxy to the Apache server and then log it to the Apache logs using %{X-Forwarded-Common-Name}i or something to that effect. I've found Blue Coat's ...
0
votes
0answers
19 views

Service httpd went down, rsyslogd was HUPed

I have an M2 server on amazon ec2 with (amazon's default ami). I have the default php stack installed with wordpress running on it. The server has been working fine for a few months now without any ...
2
votes
0answers
35 views

How to add a prefix / label for services to supervisor stdout output

I'm using supervisor in docker images when I have to run multiple services in one image e.g. postfix and other mail services. When I redirect the stdout/stderr from all services to supervisor and ...
0
votes
0answers
9 views

Linux at command logging [duplicate]

For Linux, specifically CentOS, is the command executed by 'at' logged anywhere? If so, in what file would the command be logged? I looked under /var/log.
0
votes
0answers
37 views

fail2ban doesnt read log if file being used

My environment is Ubuntu 14.04, LAMP stack all from apt. implemented fail2ban and configured jail.local with backend = auto [ssh] enabled = true port = ssh filter = sshd logpath = /var/log/auth.log ...
0
votes
1answer
35 views

mod_security: How to log POST requests for specific URI?

I'm trying to set up mod_security to log POST requests payload for a specific URI, as it seems that a customers webpage is used as a spam relay and these requests corrupt the server side cache. I ...
0
votes
1answer
21 views

mod_security: What's the point of action auditlog?

I'm fiddling around with mod_security to log POST request payloads for a specific URI. As stated in this response http://serverfault.com/a/729079/292993 to a similar question mod_security's ...
0
votes
1answer
56 views

How to make svlogd send logs via UDP

I am currently using runit + svlogd for supervising some applications, but when deploying to multiple machines, I have the need to centralize/unify the logs in a single place in order to simplify ...
0
votes
2answers
101 views

IPTables: How to log and set a specific log file

Is it possible log all dropped connections by IPTables and set a iptables.log file for logging in /var/log/?
0
votes
0answers
42 views

mail.log file is growing too quickly

my mail.log file is currently growing out of all proportion. It's logged over 15Gb of content today and most of that seems to be down to spamassassin. There are a few questions that I can't ...
0
votes
0answers
38 views

Nagios check_log reset to OK after notification

Fail2ban is installed on one of the servers, I'm able to ban every IP that try to log in. I'm using the check_log plugin of Nagios to capture the last line of the fail2ban.log, it compares to the ...
0
votes
0answers
8 views

How do I change the log format for IIS8 ODBC Logging

With IIS8 (and 7) you can log directly to a database using ODBC logging. Unfortunately I can't find a way to customize which fields are logged using this method. In particular the referral link is not ...
0
votes
0answers
20 views

Generate guid in IIS logs

I am using Advanced Logging in IIS. I have a requirement where I need to generate GUID(correlation Id) for every log entry into the log. Is this possible in IIS, as I don't see GUID type columns in ...
0
votes
0answers
57 views

fcoemon: error response from lldpad: error

I have created and configured the red hat cluster and as I was just going through logs to see if every thing is fine, thats when I saw these errors. Not sure whats with these errors. Please advise. ...
-1
votes
1answer
39 views

is there a way to findout about a file history (create date / create directory / moved directory ) ? [duplicate]

so i found a shell deep in a directory of my website . my website doesn't have a upload section and i use a well known framework and it covers sql injection ( i use codeigniter active record to work ...
0
votes
0answers
44 views

Huge citadel log files

I noticed today that my mysql server was not starting up anymore. Checking the error logs, it showed that it didn't have enough disk space. I thought that's really weird since there's nothing on my ...
-1
votes
1answer
41 views

What is the difference between combined and combinedio Log Formats in Apache?

Essentially, the question is in the title. I am familiar with what the combined log format provides, however, I don't understand the difference when compared to the combinedio format. What do the %i ...
0
votes
1answer
40 views

logrotate frequency - when and from when

if have lograte in my daily cron /etc/cron.daily/logrotate -- assume cron.daily is run at 1.05am daily and if my logrotate config has a weekly settings Does it means that my logrotate will ...
2
votes
0answers
33 views

How to reliably capture Linux kernel log messages in case of a system debilitating crash (BUG, panic)?

I'd like to have access to the lines/tracebacks/whatever whispered by the kernel right before dying. This has proven problematic, because all interfaces I have access to become disabled. Post-reboot, ...
1
vote
0answers
45 views

Puppet missing deprecation warnings

I'm running a Puppet 3.4.3 master which I use to provision VMs. I noticed that a lot of deprecation warnings I can see when provisioning locally are missing when using the server as master. (For ...
0
votes
1answer
101 views

NXLog TCP Module Not Working

I am trying to use NXLog to forward logs from a file on one computer to a file on another computer. I am new to NXLog but feel like I now have a good handle on it after consulting the documentation. ...
0
votes
1answer
28 views

Pass arguements as parameter to -filterXPath get-wineventLogs

Hi I made powershell script in which I am taking three arguements(in param block) and passing them as parameters to -FilterXPath. But I am not able to get the result. $eventID=7036 $ServiceName=PW ...
0
votes
1answer
60 views

Cobian Backup: Incorrect parameter error

I have some Cobian Backup tasks to copy a file to an external hard drive. To prevent it from being compromised, the drive will not be mounted until the task is launched. We use the following ...
0
votes
1answer
29 views

Modsecurity Whitelist and keep logging

I am white listing a tag and I am curious if there is a way to white list this and keep the logging to this at the same time. SecRuleUpdateTargetByTag "OWASP_CRS/WEB_ATTACK/SQL_INJECTION" ...
0
votes
0answers
27 views

Apache2: How to log the entire status line (including reason phrase)?

Apache logs the status code of the response if %s is in the log format, but I also need to log the reason phrase (the text to the right of the status code). How can I get Apache2 to log the entire ...
0
votes
0answers
24 views

IIS Log File Naming Scheme and Rollover

In IIS, you can configure logging to use different formats and different rollover schemes. You can also configure logging to be per-site (the default) or centralized (a single log for all configured ...
0
votes
1answer
21 views

Usage data from log file

Is there any way I can tell from the apache log files how many users are using an application and how often the use it? I kind of want the information that you would normally get from google ...
0
votes
0answers
27 views

How to forward logs and offenses from solarwinds to another server

There are several solarwinds servers in my Network. I want to aggregate some important logs and status from all of these different servers in a third party log server. I'v just searched but I didn't ...
2
votes
0answers
54 views

Analyzing squid3 access.log log files with a all-in-one shell script

I'm just going to write a shell script that me the essential functions such as SARG offers. Sort by URLs with most hits (Top100 in 10min out of 10k) Sum of status / error codes As well as sorting by ...
0
votes
0answers
21 views

rsyslog not filtering message field

Trying to remove ALL cron log stuff from auth/syslog but I cannot get it. Here is a snippet of my rsyslog. Not sure how to get this to format right, it keeps wanting to mess with my paste. But here ...
1
vote
0answers
28 views

Tomcat 7: how to log x509 cert dn with AccessLogValve

I have Tomcat7 running on RHEL6 with mutual authentication using x509 certificates for the entire container. From the user point of view in the browser, everything seems to work fine with a cert ...