Recording activity on the system (or of a particular program) for later reporting and analysis. Logins, logouts, web server page requests, etc might all be logged.

learn more… | top users | synonyms (2)

0
votes
2answers
73 views

Not getting anything written to my log files in ubuntu

I am not getting any logs in auth.log, kern.log, syslog or any other log files on my 12.04 ubuntu server. There is also no rsyslog.conf if it should be there by default. rsyslogd is not running as ...
0
votes
1answer
25 views

Disabling sentbox in postfix over Squirrelmail

I have installed POSTFIX over Squirrelmail on CentOS Linux... The services I have ran are: service httpd service ssl service mysql service postfix service saslauthd service dovecot I have ...
1
vote
1answer
48 views

Rsyslog: stopping after 1047 file descriptors opened on a centralized log server using TCP

We have heroku drains dumping to 1 log server. There are a lot of instances (~100) sending their logs to this server using TCP. The Server filters the logs based on hostname and puts them into a ...
1
vote
1answer
43 views

Snort logging mode - How to define subnets

I am using snort to log all traffic on an interface snort -i eth1 -l /interface/log/dir -b -U -m 112 With this command I manage to get ALL data which makes my log files very large. Is there any ...
0
votes
1answer
81 views

Will changing IIS Advanced Logging config restart app

I am using the IIS Advanced Logging module on a production server running IIS 7.5. I need to change some of the settings (specifically, which fields are logged) and cannot find anywhere that ...
0
votes
1answer
235 views

Compress and remove logs from jboss on linux with cron

I need to compress and remove log files after some time from serwer. I have never write scripts before. So far i have script logs.sh: #!/bin/bash LOGS=/usr/local/jboss/server/default/log/ ...
1
vote
1answer
111 views

Logcheck alternative for central syslog server [closed]

I have to setup some open source log monitoring on a centralized syslog server. A lot of machines (windows, linux) and some routers and switches sending their logs there. Many years ago when I had to ...
3
votes
1answer
147 views

What are the drawbacks to using mod_log_rotate and rotatelogs.exe together?

On Microsoft-based platforms, are there any drawbacks or hidden pitfalls to using rotatelogs.exe for ErrorLog directive(s) and allowing mod_log_rotate to handle CustomLog directives for rotation? As I ...
0
votes
1answer
30 views

Apache CustomLog for WSGI server is not filtered by LogLevel

I have a WSGI server which is served by an Apache proxy. I would like to have a log file dedicated to that server, so I added the following to the VirtualHost declaration: LogFormat "%h %l %u %t ...
1
vote
0answers
33 views

Using OSSEC HIPS alongside rsyslog, overkill?

I have been tasked to harden our company linux servers. One of the problems that was outlined was the fact that logs are stored on the server which poses two problems: Difficult to aggregate and ...
5
votes
4answers
66 views

sshd logging attempts to login without a private key

On my VPS, running Debian 7, I have ssh enabled on the default port 22 with only private key authentication enabled, all other ports are filtered with iptables. I am frequently getting login attempts ...
1
vote
1answer
186 views

rsyslog udp forwarding truncates at 2048 characters

Rsyslog on a RHEL 6 server is receiving messages locally on port 514 UDP. These messages are sometimes much larger than normal syslog message sizes. I am seeing rsyslog handle all of the messages ...
1
vote
1answer
43 views

IIS FTP server- log of file names transferred

The log files for my ftp server on iis 7.5 show DataChannelOpened and Closed events, but do not log what actual file was transferred. Is it possible to find this out, or add it to the logging?
1
vote
3answers
298 views

Is this a security breach?

I have a server running Ubuntu 10.04LTS (I know it is too old), which over the last couple of weeks has on occasion been unresponsive to network traffic, and needed a hard reset first thing in the ...
0
votes
1answer
297 views

ElasticSearch Multiple Indexes and Routing

Currently I have the following setup. Syslog --> Logstash --> ElasticSearch --> Kibana Logstash is creating a daily index ...
-1
votes
1answer
56 views

Could anyone explain the logs from my IPMI

my server is suffering freezing these days. I thought it was software problem. Then I found something strange from server log 113,System Event,02/12/2014 11:16:50 Wed,Memory,,Assertion: Memory| Event ...
0
votes
0answers
87 views

Amavis log clean passed mails to mail.log

I use amavis on my Ubuntu host to scan emails for spam. Unfortunately amavis log all clean passed mails to the 'mail.err' and the 'mail.log'. How to prevent the 'mail.err' logging? mail.err example ...
0
votes
0answers
199 views

How do I log the true client IP with Apache's CustomLog and the X-Forwarded-For header?

I am currently logging the contents of the X-Forwarded-For header using a CustomLog declaration in Apache. The problem is that every proxy and load balancer along the request path will add its IP to ...
0
votes
0answers
21 views

Advanced Windows Firewall - Strange logging behavior

I have created a GPO that set's several firewall rules to Windows Server 2008 R2 machines within a specific OU. The default behavior is set to block on inbound and outbound on all profiles. Also I did ...
1
vote
1answer
101 views

How to configure remote IP address audit logging for VPN clients on a Cisco 2801

We have a Cisco 2801 that also acts as a VPN Server for Cisco VPN Client. We would like to configure IP address logging so that each time a user connects using VPN we would like to log his IP Address. ...
2
votes
1answer
97 views

How can I log a message to the systemd journal from the command line?

Reading Where does logger log its messages to in Arch Linux?, it seems that syslog() messages and the 'logger' command line app only talk to the systemd journal if a socket for message forwarding is ...
4
votes
1answer
327 views

Why my nginx server receives requests targeting ads.yahoo.com?

I have a nginx proxy facing public internet. A few days ago, I started to receive a torrential amount of requests, targeting URLs that are invalid for my domain. An excerpt from nginx access.log: ...
0
votes
0answers
11 views

Changing an Apache CustomLog configuration line from within a conf.d file?

My Apache 2.2 httpd.conf file contains the following line: CustomLog logs/access_log common I want to instead use: CustomLog logs/access_log "a different log format that I prefer" But I only ...
0
votes
1answer
57 views

mysql.slow.log is not created even though it's configured in /etc/my.cnf , what could be the reason?

This is the relevant section from /etc/my.cnf: [mysqld] slow-query-log = ON long_query_time = 2 log_slow_queries = /var/log/mysql-slow.log The problem is that file is ...
4
votes
2answers
249 views

Cannot find upstart logs in syslog despite a log-priority of debug (ubuntu 13.04 & mint 16)

I've set upstart log level to "debug" sudo initctl log-priority debug But I still cannot see anything in /var/log/syslog. sudo initctl emit hello # no log sudo initctl start my-broken-service # ...
0
votes
0answers
51 views

Understanding parse, bind, execute entries in PostgreSQL logs

I am new to PostgreSQL logging and have a few questions. PostgreSQL is used as a database for a couple of comercial products (both on the same server). This is run on a Windows 2008 R2 server (as I ...
0
votes
0answers
28 views

rsyslog.conf only partly honored

I followed this description on how to enable audit for Samba (entry of Aug 10, 2009) and wanted to get all additionally enabled logging in a special log file (/var/log/samba/log.audit). The mentioned ...
2
votes
2answers
486 views

Block bots by their Java referrer or User-Agent string?

I have been getting a lot of web hits in my logs that crawl most top level pages of my site and show a referrer as a Java version. I see different variants of the Java versions in the referrer, i.e. ...
0
votes
1answer
9 views

Get referrer of requests currently listed by status module

Our server has on normal time 20 request/second, which can be seen constantly on server-status (status module) Sometimes we have 800 requests/second, and all these requests are shown on ...
0
votes
0answers
16 views

Scribe Log Auto Stopping?

We are running Scribe Log Service to collect Logs from Application Servers. (https://github.com/facebook/scribe/wiki/Scribe-Configuration) Scribe Log run smoothly for a long time. But Yesterday, I ...
0
votes
0answers
71 views

Why is SystemMaxFileSize in journald.conf not being honoured?

I have the following settings in journald.conf SystemMaxUse=100M #SystemKeepFree= SystemMaxFileSize=10M According to the documentation, SystemMaxUse controls how much disk space the journal may use ...
0
votes
0answers
16 views

How to suppress request string logging in App Engine to secure passwords

I am designing an app for Google App Engine. In my initial set up, I have the user submit their username and password to my app via AJAX. I then hash it and compare that to a stored hash without ...
1
vote
1answer
36 views

How to log both HTTP and HTTPS requests to the same file

Using recent Apache on Linux. It's inconvenient to have the two different kinds of requests sent to two different log files since I like to watch the log file scroll by live via the shell. I also ...
0
votes
1answer
31 views

How to check last FTP logins using SSH?

I've just bought a new VPS (its operating system is CentOS). As this is my first experience with VPS, I don't know everything about managing and ... One of my customers told me his website is not ...
-2
votes
1answer
142 views

Configure Protocols using iptables log file with ndpi [closed]

I am using iptables with ndpi to filter my network and add two rules to my iptables rules they are iptables -I INPUT -m ndpi --http -j LOG iptables -I INPUT -m ndpi --google -j LOG In my log file ...
1
vote
1answer
98 views

Why or who did reboot my server

One of our servers rebooted last night reboot system boot 2.6.32-5-amd64 Wed Jan 15 03:24 - 16:07 (1+12:42) Our hoster didn't do it, nor did I. syslog does not show any error Jan 15 03:17:01 ...
0
votes
1answer
24 views

Is there a way to detect what is modifying Active Directory user properties?

We use a display name format of first initial and surname, e.g. J Smith. Recently, something is changing this to show their full name. Is there any way to look through some logs to find out which ...
0
votes
1answer
352 views

How can I make apache give the config file path and line number for a 403 error

I'm running Apache 2.4.7 on debian unstable. I'm getting 403 errors when I try to run supysonic using the mod_wsgi module. I turned the LogLevel for wsgi and authz_core up to trace6, but I'm still ...
0
votes
1answer
210 views

Apache2 server (behind Zyxel USG 100 NAT/Firewall) with vhost does not log real clients ip addresses

SOLVED To allow the Zyxel USG 100's NAT to forward untouched packets to my web server i edited the policy route of the Zyxel. Zyxel -> Configuration -> Network ->Routing -> Policy Route ...
0
votes
1answer
25 views

Logging not getting disabled

Out Tomcat 8 is logging so much so that by the evening the catalina.out inflates to GBs of data. I followed the procedure given on the tomcat website to replace JULI logging with LOG4J. Now LOG4J has ...
1
vote
2answers
174 views

logging/capturing STDERR/STDOUT on Amazon EC2

I'm looking for a solution that would allow me to automatically capture the STDOUT/STDERR of a process running on Amazon EC2, and send it (remotely) to another server. Sound simple, except: I will ...
2
votes
0answers
17 views

Globally recording Bash history: Dealing with long-running commands [duplicate]

For security reasons, I'm trying to remotely log all commands that users enter into the shell. I've got it to work by using this in my global bashrc: PROMPT_COMMAND='history -a >(tee -a ...
0
votes
0answers
20 views

How do I get logman.exe to write to this path which contains an environment variable? [duplicate]

Looking at the registry keys which logman.exe uses to track its current log jobs (at HKLM:\SYSTEM\CurrentControlSet\Control\WMI\Autologger), I noticed that a number of the "default" Windows log ...
2
votes
1answer
252 views

How can I use perfmon/logman to set up logging on a master (Windows) VM, writing to another machine on the network?

I know how to set up logging to write to a remote location in the general case - just specify the output filename using the full UNC path (e.g. \\HOST-PC\directory\logoutput.etl) when creating the log ...
0
votes
0answers
44 views

What kind of messages are dropped when $OmitLocalLogging is on?

The new systemd journal was introduced some time ago. The following configuration is added in rsyslog to integrate this new module: $ModLoad imjournal # provides access to the systemd journal ...
0
votes
1answer
135 views

tried to spam postfix, doesn't log IP address

I've had some serious spam issues with my local postfix installation, until I found out that there was a postfix user wich was allowed to relay mails (I still don't know why this was possible in the ...
2
votes
1answer
50 views

Log Archiving Solution

What is the best solution for log archiving ? I have two application server (tomcat6) and I need to keep application log files for 7 years. Shipping, zipping and writing them on Bluray or DVD is time ...
0
votes
0answers
189 views

Message Structure Different Between Log Shipper — Logstash and nxlog

I have a Windows Server 2008 (ugh) system that I'm pulling messages from with Logstash and nxlog. With nxlog as the log shipper, messages as they appear in the log file are sent to the parser: ...
0
votes
1answer
262 views

Log Rotation Causing nxlog Failure

I'm using nxlog to watch two vCenter log files on a Windows Server 2008 system and I have a very simple config to ship messages to Logstash. Nxlog began failing yesterday after a file was rotated. ...
2
votes
4answers
182 views

Use logger in shell script

How can I use logger in a shell script? If I run ntpd -qnp pool.ntp.org 2> >(logger) in console, it works as expected. If I put it into a shell script #!/bin/sh ntpd -qnp pool.ntp.org ...