Recording activity on the system (or of a particular program) for later reporting and analysis. Logins, logouts, web server page requests, etc might all be logged.

learn more… | top users | synonyms (2)

0
votes
0answers
44 views

Nagios check_log reset to OK after notification

Fail2ban is installed on one of the servers, I'm able to ban every IP that try to log in. I'm using the check_log plugin of Nagios to capture the last line of the fail2ban.log, it compares to the ...
0
votes
0answers
11 views

How do I change the log format for IIS8 ODBC Logging

With IIS8 (and 7) you can log directly to a database using ODBC logging. Unfortunately I can't find a way to customize which fields are logged using this method. In particular the referral link is not ...
0
votes
0answers
20 views

Generate guid in IIS logs

I am using Advanced Logging in IIS. I have a requirement where I need to generate GUID(correlation Id) for every log entry into the log. Is this possible in IIS, as I don't see GUID type columns in ...
0
votes
0answers
60 views

fcoemon: error response from lldpad: error

I have created and configured the red hat cluster and as I was just going through logs to see if every thing is fine, thats when I saw these errors. Not sure whats with these errors. Please advise. ...
-1
votes
1answer
39 views

is there a way to findout about a file history (create date / create directory / moved directory ) ? [duplicate]

so i found a shell deep in a directory of my website . my website doesn't have a upload section and i use a well known framework and it covers sql injection ( i use codeigniter active record to work ...
0
votes
0answers
54 views

Huge citadel log files

I noticed today that my mysql server was not starting up anymore. Checking the error logs, it showed that it didn't have enough disk space. I thought that's really weird since there's nothing on my ...
-1
votes
1answer
54 views

What is the difference between combined and combinedio Log Formats in Apache?

Essentially, the question is in the title. I am familiar with what the combined log format provides, however, I don't understand the difference when compared to the combinedio format. What do the %i ...
0
votes
1answer
42 views

logrotate frequency - when and from when

if have lograte in my daily cron /etc/cron.daily/logrotate -- assume cron.daily is run at 1.05am daily and if my logrotate config has a weekly settings Does it means that my logrotate will ...
2
votes
0answers
37 views

How to reliably capture Linux kernel log messages in case of a system debilitating crash (BUG, panic)?

I'd like to have access to the lines/tracebacks/whatever whispered by the kernel right before dying. This has proven problematic, because all interfaces I have access to become disabled. Post-reboot, ...
1
vote
0answers
51 views

Puppet missing deprecation warnings

I'm running a Puppet 3.4.3 master which I use to provision VMs. I noticed that a lot of deprecation warnings I can see when provisioning locally are missing when using the server as master. (For ...
0
votes
1answer
129 views

NXLog TCP Module Not Working

I am trying to use NXLog to forward logs from a file on one computer to a file on another computer. I am new to NXLog but feel like I now have a good handle on it after consulting the documentation. ...
0
votes
1answer
31 views

Pass arguements as parameter to -filterXPath get-wineventLogs

Hi I made powershell script in which I am taking three arguements(in param block) and passing them as parameters to -FilterXPath. But I am not able to get the result. $eventID=7036 $ServiceName=PW ...
0
votes
1answer
70 views

Cobian Backup: Incorrect parameter error

I have some Cobian Backup tasks to copy a file to an external hard drive. To prevent it from being compromised, the drive will not be mounted until the task is launched. We use the following ...
0
votes
1answer
35 views

Modsecurity Whitelist and keep logging

I am white listing a tag and I am curious if there is a way to white list this and keep the logging to this at the same time. SecRuleUpdateTargetByTag "OWASP_CRS/WEB_ATTACK/SQL_INJECTION" !ARGS:/^...
0
votes
0answers
29 views

Apache2: How to log the entire status line (including reason phrase)?

Apache logs the status code of the response if %s is in the log format, but I also need to log the reason phrase (the text to the right of the status code). How can I get Apache2 to log the entire ...
0
votes
0answers
25 views

IIS Log File Naming Scheme and Rollover

In IIS, you can configure logging to use different formats and different rollover schemes. You can also configure logging to be per-site (the default) or centralized (a single log for all configured ...
0
votes
1answer
21 views

Usage data from log file

Is there any way I can tell from the apache log files how many users are using an application and how often the use it? I kind of want the information that you would normally get from google ...
0
votes
0answers
28 views

How to forward logs and offenses from solarwinds to another server

There are several solarwinds servers in my Network. I want to aggregate some important logs and status from all of these different servers in a third party log server. I'v just searched but I didn't ...
2
votes
0answers
58 views

Analyzing squid3 access.log log files with a all-in-one shell script

I'm just going to write a shell script that me the essential functions such as SARG offers. Sort by URLs with most hits (Top100 in 10min out of 10k) Sum of status / error codes As well as sorting by ...
0
votes
0answers
24 views

rsyslog not filtering message field

Trying to remove ALL cron log stuff from auth/syslog but I cannot get it. Here is a snippet of my rsyslog. Not sure how to get this to format right, it keeps wanting to mess with my paste. But here ...
1
vote
0answers
32 views

Tomcat 7: how to log x509 cert dn with AccessLogValve

I have Tomcat7 running on RHEL6 with mutual authentication using x509 certificates for the entire container. From the user point of view in the browser, everything seems to work fine with a cert ...
0
votes
1answer
20 views

Apache 2.4 + PHP CGI SAPI: separate access_log of requests hitting PHP processing?

It's hard to tell from Apache general access_log which requests are processed by PHP, because direct file hits muddy the waters. PHP FPM SAPI has a super useful access_log directive, but how do I get ...
2
votes
1answer
90 views

Why isn't my SELinux logging anything?

I have a sneaking suspicion it has something to do with me mucking about with my rsyslog.conf, but I'm not 100% sure about that. I am running Centos 7, and SELinux has been working A-OK. However, I ...
0
votes
1answer
70 views

centos 7 : nginx givers error when enabling log

In CentOS 7, if I put the following line in my nginx.conf: error_log /usr/share/nginx/wordpress.itzgeek.com/logs/error.log; I get the following error when restarting nginx: nginx: [emerg] open() "/...
1
vote
1answer
80 views

Apache piped logging failing

I am trying to write a simple apache piped logging directive and I am getting a failure. I just want to grep out 200 response codes for centralizing my log files to ELK. This is the custom log format ...
0
votes
1answer
44 views

Tomcat crashing with no error

I am running tomcat 7 on debian 7.9 dedicated server with several applications running on it and last time tomcat behavior is really strange. First after tomcat starts it takes all the assigned RAM (...
2
votes
0answers
157 views

How does one separate log data sent to a remote rsyslog server?

I have messages from multiple apache2 web servers logging to a rsyslog server. I've used a template to separate each /var/log/syslog file into its own folder based off of the ip address of the server ...
1
vote
0answers
76 views

Filebeat and downstream availability

I read here and there that a broker (like Redis) might not be required in the log pipeline (typically ELK) when Filebeat is used. From Filebeat's official page: [Filebeat] is intelligent enough ...
0
votes
0answers
27 views

How to show email addresses in Outlook 2013 SMTP logs?

I need to troubleshoot some client-side issues while sending SMTP messages using Outlook 2013; I've turned on diagnostic logging, however the sender and recipient addresses are hidden in the logs: ...
1
vote
1answer
102 views

What is the default retention and archiving mechanism for Windows 2012 Event Logs?

How does Windows 2012 manage event logs retention? Does it 'rotate' logs like *NIX systems? Does it automatically delete old logs when disk is full. Any way to define log retention period? (e.g. ...
0
votes
1answer
20 views

logrotate saves content to old file

I used logrotate to rotate my log files. The conf file look like this: /data/log/web/12114.log { daily rotate 10 copytruncate } But logrotate doesn't cut the log file properly. The ...
2
votes
1answer
576 views

How to log original value of $remote_addr when using Real-IP

My environment has user requests passing through a number of systems: [Client] --> [ELB] ---> [nginx] --> [web] (ELB = AWS Elastic Load Balancer) Thanks to this answer, I have nginx determining and ...
3
votes
1answer
33 views

Handling log files across mulitple Windows Servers

I have an application that at any time could be running on 1 of 4 windows servers. Hence, if I am looking for a specific log item, it could be in any of the 4 log files. What I am looking to do is ...
3
votes
1answer
18 views

Apache log HTTP code dispatch

I would like to get warned by email when some HTTP codes are triggered, so I wanted to dispatch log between different file depending of the request HTTP code. Like that i can put a watchers on those ...
1
vote
0answers
113 views

Excessive Windows Security Event Logs

I'm working on modifying our current Windows log setup and have ran across an issue I can't quite seem to find the answer to. We currently have nxlog configured on each DC to send windows event IDs ...
1
vote
0answers
58 views

php-fpm error log is trucated

I'm setting up test environment where I have nginx and php-fpm on centos 7. I have successfully setup everything and I can run php code. This is my configuration: nginx version: nginx/1.9.9 ...
0
votes
1answer
13 views

Log access to cached content by 3rd party

The question is pretty much the same as this one: How to log a request to apache access log if it's cached by Varnish but instead of varnish let's say I am using CloudFlare. Is there any way to ...
2
votes
1answer
160 views

Disable Nginx Logging for “forbidden by rule”

In my Nginx config I have some IP blocks in place, to fight off spammers & bots. This is very effective, but as a result, my error logs get filled up super fast with error messages like these: ...
2
votes
1answer
43 views

Ignoring Healthchecks With Graylog-Collector

I have a log file with a mix of health checks and actual hits in it. I'd like to collect all the logs except the /healthcheck hits. Can graylog-collector handle this for me? I've read through the ...
2
votes
0answers
106 views

AWS Cloudwatch Agent not picking up changes

I'm stumped. I have two log files being watched by the AWS CloudWatch agent. The first one, /var/log/nginx/access.log, works perfectly fine. The second, /var/log/otherserver/access.log, is not having ...
-1
votes
1answer
85 views

port forwarding access.log

Problem was localized - MASQUERADE (it's modifying original source-IP). Question is closed, because problem not in port forwarding, but in configuration in general of router server. Thanks all. ...
0
votes
0answers
21 views

Cron Reports Running the Script but no Results [duplicate]

RESOLUTION Per the marked duplicate question above, I checked the mail box for the user running the script. I found that a fatal error was occurring in the PHP script when run by CRON. The error was ...
0
votes
0answers
36 views

Web Server Log analyzer from a security perspective

Web Server Log analyzers are really meant to just show trends, statistics and are more geared towards an SEO/Marketing standpoint. How can I do the following in regards to HTTP(s) traffic from a ...
0
votes
0answers
17 views

How to use AWSTATS LogFile tags when the date is in the middle of the file?

AWSTATS provides tags for use in the LogFile setting which allows you to dynamically represent the date. But the date in my log files is used as an extension and contains 00 at the end. ...
1
vote
0answers
32 views

Simple progress for rsync when piping output to a log file

I ran rsync with nohup and --progress: nohup rsync --progress --[other-options] source destination & tail -f nohup.out When I'm tailing the file, I see the output with a changing last line (...
0
votes
0answers
19 views

How can I select an output device for video from headless server?

I have a syslog server, and I call it headless, but it actually does have two monitors attached to it via an internal video card. I never actually use the monitors since I'm just ssh'd in, and the ...
0
votes
1answer
30 views

Get password for all failed MySQL logins

Im having issues trying to figure out what is the cause of a failing SQL login. The password seems correct to me, but it still isnt working. I want to see what exactly the user login is sending when ...
0
votes
0answers
129 views

SFTP logging chrooted users in OS X 10.11

I have been trying to piece together the exact setup for logging SFTP user activity for chroot jailed users on OS X 10.11 (El Capitan) from various links but I'm currently stuck. I have gotten as far ...
3
votes
2answers
852 views

How to find out who deleted event viewer logs

On windows server 2003, someone has deleted the security and application logs. I would like to know when the logs have been deleted and if possible who is this criminal. :) Thank you
0
votes
1answer
174 views

Send tomcat logs with syslog-ng in Ubuntu Linux

I am trying to setup syslog-ng to send tomcat logs (as well as all the other system logs) to a log server but it doesn't seem to be working, this is the line I have: destination d_tomcat { file("/opt/...