Recording activity on the system (or of a particular program) for later reporting and analysis. Logins, logouts, web server page requests, etc might all be logged.

learn more… | top users | synonyms (2)

0
votes
0answers
126 views

IIS 8 logging stops at midnight UTC

I have one IIS 8 server where the w3logsvc dies at midnight UTC (we're Central Time, so we're UTC -6). I have to manually start the service to get it back running again. I have the logging set to use ...
1
vote
0answers
40 views

“\xc2:\xc2” in HTTP proxy GET request

Recently I came across lines like these in an HTTP server's access_log (I've changed the real image to "someimage.jpg" - you can browse the images folder directly since directory listing is allowed, ...
0
votes
1answer
76 views

Analyze tons of Apache logs

I'm having an issue analyzing Apache logs - because there's a ton of them. Like first 5 days of March have resulted in about 50Gb of log files ( uncompressed ). How to analyze these? What tools to ...
1
vote
2answers
61 views

Rolling log file without losing any log event

I have an 8GB file called php.log with a running php script logging into it. It is important for me that I log every event, and I want to compress it and empty the current file without stopping the ...
0
votes
2answers
163 views

How to Change sysstat/sar logging folder

I have just enabled sysstat on one of my servers (Ubuntu 12.04), I have noticed it is logging all to /var/log/sysstat/sa04 /var/log/sysstat/sa05 /var/log/sysstat/sar04 How can I change the sysstat ...
0
votes
2answers
121 views

Not getting anything written to my log files in ubuntu

I am not getting any logs in auth.log, kern.log, syslog or any other log files on my 12.04 ubuntu server. There is also no rsyslog.conf if it should be there by default. rsyslogd is not running as ...
0
votes
1answer
29 views

Disabling sentbox in postfix over Squirrelmail

I have installed POSTFIX over Squirrelmail on CentOS Linux... The services I have ran are: service httpd service ssl service mysql service postfix service saslauthd service dovecot I have ...
1
vote
1answer
61 views

Rsyslog: stopping after 1047 file descriptors opened on a centralized log server using TCP

We have heroku drains dumping to 1 log server. There are a lot of instances (~100) sending their logs to this server using TCP. The Server filters the logs based on hostname and puts them into a ...
0
votes
1answer
59 views

Snort logging mode - How to define subnets

I am using snort to log all traffic on an interface snort -i eth1 -l /interface/log/dir -b -U -m 112 With this command I manage to get ALL data which makes my log files very large. Is there any ...
1
vote
1answer
169 views

Will changing IIS Advanced Logging config restart app

I am using the IIS Advanced Logging module on a production server running IIS 7.5. I need to change some of the settings (specifically, which fields are logged) and cannot find anywhere that ...
0
votes
1answer
507 views

Compress and remove logs from jboss on linux with cron

I need to compress and remove log files after some time from serwer. I have never write scripts before. So far i have script logs.sh: #!/bin/bash LOGS=/usr/local/jboss/server/default/log/ ...
1
vote
1answer
165 views

Logcheck alternative for central syslog server [closed]

I have to setup some open source log monitoring on a centralized syslog server. A lot of machines (windows, linux) and some routers and switches sending their logs there. Many years ago when I had to ...
3
votes
1answer
265 views

What are the drawbacks to using mod_log_rotate and rotatelogs.exe together?

On Microsoft-based platforms, are there any drawbacks or hidden pitfalls to using rotatelogs.exe for ErrorLog directive(s) and allowing mod_log_rotate to handle CustomLog directives for rotation? As I ...
0
votes
1answer
49 views

Apache CustomLog for WSGI server is not filtered by LogLevel

I have a WSGI server which is served by an Apache proxy. I would like to have a log file dedicated to that server, so I added the following to the VirtualHost declaration: LogFormat "%h %l %u %t ...
1
vote
0answers
76 views

Using OSSEC HIPS alongside rsyslog, overkill?

I have been tasked to harden our company linux servers. One of the problems that was outlined was the fact that logs are stored on the server which poses two problems: Difficult to aggregate and ...
5
votes
4answers
83 views

sshd logging attempts to login without a private key

On my VPS, running Debian 7, I have ssh enabled on the default port 22 with only private key authentication enabled, all other ports are filtered with iptables. I am frequently getting login attempts ...
1
vote
1answer
356 views

rsyslog udp forwarding truncates at 2048 characters

Rsyslog on a RHEL 6 server is receiving messages locally on port 514 UDP. These messages are sometimes much larger than normal syslog message sizes. I am seeing rsyslog handle all of the messages ...
1
vote
1answer
65 views

IIS FTP server- log of file names transferred

The log files for my ftp server on iis 7.5 show DataChannelOpened and Closed events, but do not log what actual file was transferred. Is it possible to find this out, or add it to the logging?
1
vote
3answers
351 views

Is this a security breach?

I have a server running Ubuntu 10.04LTS (I know it is too old), which over the last couple of weeks has on occasion been unresponsive to network traffic, and needed a hard reset first thing in the ...
0
votes
1answer
540 views

ElasticSearch Multiple Indexes and Routing

Currently I have the following setup. Syslog --> Logstash --> ElasticSearch --> Kibana Logstash is creating a daily index ...
-1
votes
1answer
74 views

Could anyone explain the logs from my IPMI

my server is suffering freezing these days. I thought it was software problem. Then I found something strange from server log 113,System Event,02/12/2014 11:16:50 Wed,Memory,,Assertion: Memory| Event ...
0
votes
0answers
477 views

How do I log the true client IP with Apache's CustomLog and the X-Forwarded-For header?

I am currently logging the contents of the X-Forwarded-For header using a CustomLog declaration in Apache. The problem is that every proxy and load balancer along the request path will add its IP to ...
0
votes
0answers
23 views

Advanced Windows Firewall - Strange logging behavior

I have created a GPO that set's several firewall rules to Windows Server 2008 R2 machines within a specific OU. The default behavior is set to block on inbound and outbound on all profiles. Also I did ...
1
vote
1answer
185 views

How to configure remote IP address audit logging for VPN clients on a Cisco 2801

We have a Cisco 2801 that also acts as a VPN Server for Cisco VPN Client. We would like to configure IP address logging so that each time a user connects using VPN we would like to log his IP Address. ...
2
votes
1answer
175 views

How can I log a message to the systemd journal from the command line?

Reading Where does logger log its messages to in Arch Linux?, it seems that syslog() messages and the 'logger' command line app only talk to the systemd journal if a socket for message forwarding is ...
4
votes
1answer
346 views

Why my nginx server receives requests targeting ads.yahoo.com?

I have a nginx proxy facing public internet. A few days ago, I started to receive a torrential amount of requests, targeting URLs that are invalid for my domain. An excerpt from nginx access.log: ...
0
votes
0answers
12 views

Changing an Apache CustomLog configuration line from within a conf.d file?

My Apache 2.2 httpd.conf file contains the following line: CustomLog logs/access_log common I want to instead use: CustomLog logs/access_log "a different log format that I prefer" But I only ...
0
votes
1answer
78 views

mysql.slow.log is not created even though it's configured in /etc/my.cnf , what could be the reason?

This is the relevant section from /etc/my.cnf: [mysqld] slow-query-log = ON long_query_time = 2 log_slow_queries = /var/log/mysql-slow.log The problem is that file is ...
5
votes
2answers
730 views

Cannot find upstart logs in syslog despite a log-priority of debug (ubuntu 13.04 & mint 16)

I've set upstart log level to "debug" sudo initctl log-priority debug But I still cannot see anything in /var/log/syslog. sudo initctl emit hello # no log sudo initctl start my-broken-service # ...
0
votes
0answers
90 views

Understanding parse, bind, execute entries in PostgreSQL logs

I am new to PostgreSQL logging and have a few questions. PostgreSQL is used as a database for a couple of comercial products (both on the same server). This is run on a Windows 2008 R2 server (as I ...
0
votes
0answers
35 views

rsyslog.conf only partly honored

I followed this description on how to enable audit for Samba (entry of Aug 10, 2009) and wanted to get all additionally enabled logging in a special log file (/var/log/samba/log.audit). The mentioned ...
2
votes
2answers
859 views

Block bots by their Java referrer or User-Agent string?

I have been getting a lot of web hits in my logs that crawl most top level pages of my site and show a referrer as a Java version. I see different variants of the Java versions in the referrer, i.e. ...
0
votes
1answer
9 views

Get referrer of requests currently listed by status module

Our server has on normal time 20 request/second, which can be seen constantly on server-status (status module) Sometimes we have 800 requests/second, and all these requests are shown on ...
0
votes
0answers
26 views

Scribe Log Auto Stopping?

We are running Scribe Log Service to collect Logs from Application Servers. (https://github.com/facebook/scribe/wiki/Scribe-Configuration) Scribe Log run smoothly for a long time. But Yesterday, I ...
0
votes
0answers
158 views

Why is SystemMaxFileSize in journald.conf not being honoured?

I have the following settings in journald.conf SystemMaxUse=100M #SystemKeepFree= SystemMaxFileSize=10M According to the documentation, SystemMaxUse controls how much disk space the journal may use ...
0
votes
0answers
18 views

How to suppress request string logging in App Engine to secure passwords

I am designing an app for Google App Engine. In my initial set up, I have the user submit their username and password to my app via AJAX. I then hash it and compare that to a stored hash without ...
1
vote
1answer
41 views

How to log both HTTP and HTTPS requests to the same file

Using recent Apache on Linux. It's inconvenient to have the two different kinds of requests sent to two different log files since I like to watch the log file scroll by live via the shell. I also ...
0
votes
1answer
41 views

How to check last FTP logins using SSH?

I've just bought a new VPS (its operating system is CentOS). As this is my first experience with VPS, I don't know everything about managing and ... One of my customers told me his website is not ...
-2
votes
1answer
209 views

Configure Protocols using iptables log file with ndpi [closed]

I am using iptables with ndpi to filter my network and add two rules to my iptables rules they are iptables -I INPUT -m ndpi --http -j LOG iptables -I INPUT -m ndpi --google -j LOG In my log file ...
1
vote
1answer
200 views

Why or who did reboot my server

One of our servers rebooted last night reboot system boot 2.6.32-5-amd64 Wed Jan 15 03:24 - 16:07 (1+12:42) Our hoster didn't do it, nor did I. syslog does not show any error Jan 15 03:17:01 ...
0
votes
1answer
25 views

Is there a way to detect what is modifying Active Directory user properties?

We use a display name format of first initial and surname, e.g. J Smith. Recently, something is changing this to show their full name. Is there any way to look through some logs to find out which ...
1
vote
1answer
795 views

How can I make apache give the config file path and line number for a 403 error

I'm running Apache 2.4.7 on debian unstable. I'm getting 403 errors when I try to run supysonic using the mod_wsgi module. I turned the LogLevel for wsgi and authz_core up to trace6, but I'm still ...
0
votes
1answer
307 views

Apache2 server (behind Zyxel USG 100 NAT/Firewall) with vhost does not log real clients ip addresses

SOLVED To allow the Zyxel USG 100's NAT to forward untouched packets to my web server i edited the policy route of the Zyxel. Zyxel -> Configuration -> Network ->Routing -> Policy Route ...
0
votes
1answer
30 views

Logging not getting disabled

Out Tomcat 8 is logging so much so that by the evening the catalina.out inflates to GBs of data. I followed the procedure given on the tomcat website to replace JULI logging with LOG4J. Now LOG4J has ...
1
vote
2answers
248 views

logging/capturing STDERR/STDOUT on Amazon EC2

I'm looking for a solution that would allow me to automatically capture the STDOUT/STDERR of a process running on Amazon EC2, and send it (remotely) to another server. Sound simple, except: I will ...
2
votes
0answers
17 views

Globally recording Bash history: Dealing with long-running commands [duplicate]

For security reasons, I'm trying to remotely log all commands that users enter into the shell. I've got it to work by using this in my global bashrc: PROMPT_COMMAND='history -a >(tee -a ...
2
votes
1answer
455 views

How can I use perfmon/logman to set up logging on a master (Windows) VM, writing to another machine on the network?

I know how to set up logging to write to a remote location in the general case - just specify the output filename using the full UNC path (e.g. \\HOST-PC\directory\logoutput.etl) when creating the log ...
0
votes
0answers
86 views

What kind of messages are dropped when $OmitLocalLogging is on?

The new systemd journal was introduced some time ago. The following configuration is added in rsyslog to integrate this new module: $ModLoad imjournal # provides access to the systemd journal ...
0
votes
1answer
218 views

tried to spam postfix, doesn't log IP address

I've had some serious spam issues with my local postfix installation, until I found out that there was a postfix user wich was allowed to relay mails (I still don't know why this was possible in the ...
2
votes
1answer
51 views

Log Archiving Solution

What is the best solution for log archiving ? I have two application server (tomcat6) and I need to keep application log files for 7 years. Shipping, zipping and writing them on Bluray or DVD is time ...