Recording activity on the system (or of a particular program) for later reporting and analysis. Logins, logouts, web server page requests, etc might all be logged.

learn more… | top users | synonyms (2)

0
votes
1answer
124 views

Event ID 521 - Critical Logging Failure on Domain Controllers

I'm tasked with the monitoring and analysis of variious logs via our SIEM solution; LogRhythm. I noticed a few weeks back that we had large volumes of this event originating from all of our domain ...
0
votes
1answer
24 views

Apache log format: repeat headers

The LogFormat directive allows you to set a custom format for your log files, including any headers you're interested in, such as: \"%{Referer}i\" \"%{Location}o\" However, some headers may be used ...
0
votes
1answer
35 views

Varnish Error Log Files

I upgraded to version 4.1 from 4.0 and everything was working fine until I restarted the service and it shows Starting or Started, but when I check the status or go to a website the services shows ...
1
vote
1answer
77 views

Exchange 2013 reduce disk writes

I have some write problems on my system. One of the most ravenous virtual machine is Exchange 2013 with only 70 mailboxes. This is a writes list dump example: If we exclude all EDB files and ...
0
votes
1answer
30 views

Make BIND DNS server to “remember” the resolved names

I have a corporative VPN server where every client request (the IP address of the server they are accessing) are being logged via an script with tcpdump. However, the logs are not really useful ...
0
votes
1answer
14 views

Nginx error_log levels difference

There are warn, error, crit, alert and emerg levels. But I can't find from the documentation what each means... especially I'm interested in the difference between crit, alert and emerg levels. Can ...
2
votes
1answer
37 views

Is there a way to write application logs like Tomcat and PostgreSQL to Tenable Log Correlation Engine?

My IT group uses Tenable's Log Correlation Engine and we have our Linux servers writing syslog to LCE. Is there a way to write our Tomcat and PostgreSQL application logs to LCE?
0
votes
0answers
24 views

Applications are no longer writing to their log files

Im not sure what has happened, but im having some trouble with postfix so i went to check the maillog to find it hasnt been written to in days. I checked apache and mysql logs and the same thing is ...
-1
votes
1answer
74 views

IPtables log only some drop connections

I have these rules: -A INPUT -m limit --limit 2/min -j LOG --log-prefix "IPTables Packet Dropped: " --log-level 7 -A INPUT -j DROP But this logs every DROP that occurs like IPTables Packet Dropped: ...
0
votes
1answer
2k views

How to view mariadb log?

I am using new relic to monitor the performance of my server. Recently I noticed a very strange problem where for every 3 hours, the server will be down for 1 minute. And in the new relic report, ...
1
vote
0answers
385 views

Why does graylog2 delete old indicies?

According to http://docs.graylog.org/en/1.3/pages/index_model.html, graylog2 deletes old indicies based on the "elasticsearch_max_number_of_indices". Why can't graylog2 allow no. of indicies to grow? ...
0
votes
1answer
49 views

How to log outbound connections in an OpenVPN server?

I'm running a corporative OpenVPN server in an Ubuntu Server 14.04.3 Intel Xeon E3 machine. I need to log each connection try to any website, including destination IP, hostname, date, up/down ...
0
votes
1answer
22 views

Debug Logging daily task

I manage a domain with 4 domain controllers and i have been asked to enable Debug Logging for Incoming and Request packets. I have set the maximum size of the log file to 500MB. First question I have,...
0
votes
1answer
87 views

OpenVPN log not showing up in /var/log/messages file

When running service openvpn status, the output states Status written to /var/log/messages However, nothing shows up in the file.
0
votes
0answers
29 views

Open source logging application with advanced filters (multiple conditions, etc.)

I'm working with Graylog2 and can't find any alternative with advanced filters. Example: I got 50 servers accessible from outside web. I want to know about (alert) every 5 failed logins using the ...
2
votes
1answer
119 views

How to log execution of a specific binary/script using auditd or other

I have the following situation in hand. I have one or more specific execuatble files in /usr/bin, I will call one /usr/bin/execute , and they may either be a compiled binary or a script file, such as ...
2
votes
1answer
79 views

Find source of outgoing traffic to specific UDP port [duplicate]

Since a few days ago I've been observing some strange recurrent outgoing UDP traffic from my server on port 24441 but since it's not constant, I cannot seem to find what's causing it. All I can see ...
0
votes
0answers
8 views

logrotate: missingok-equivalent for include directive

Suppose I have something like the following include /path/to/site_logrotate_config in a logrotate config file that should be the same for several hosts. This works fine as long as there is always ...
1
vote
1answer
105 views

tail /dev/stderr from errors within supervisord php cli script

To make this simple, I want to know if it's possible to access the STDERR like a channel. I don't want the data to log to a file and then tail the file because the amount of information that I want to ...
1
vote
0answers
118 views

How can I output logs to a file from the content of a service with systemd

Well, I have a service configured with systemctl. This is the config file: [Unit] Description=The description of the service (: After=network.target [Service] ExecStartPre=/bin/echo 'Starting ...
2
votes
1answer
339 views

nginx not logging errors to log files

I recently moved my CentOS 7 machine from Apache to nginx, and I am still working out the differences. One issue I have noticed for only one of my server blocks is that access and error log files are ...
0
votes
1answer
46 views

Can we log the `Accept-Encoding` field in request when using nginx?

I've read ngx_http_core_module#variables, however I cannot find the Accept-Encoding field.
0
votes
2answers
448 views

Logs: “Received disconnect from…” without the “Accepted” couterpart

I'm seeing lots of logs with this line: Nov 7 03:47:41 s1 sshd[23430]: Received disconnect from XX.XXX.XX.XX: 11: Nov 7 05:08:16 s1 sshd[24474]: Received disconnect from XX.XXX.XX.XX: 11: Nov 7 06:...
0
votes
1answer
55 views

Which domain-name was requested? Running virtual hosts on Mongoose web server

I'm currently running Mongoose WebServer 5.5 on Windows 7 I have a number of virtual hosts, running on a single Mongoose server on one IP node. The access log entries are typically 157.55.39.146 - ...
0
votes
0answers
60 views

maillog files not in chronological date order

I am running centos 7 LAMP server with webmin and recently disabled mailman from the bootup and shutdown module of webmin and then rebooted the system. I am positive my log files(such as maillog, cron,...
1
vote
0answers
52 views

How to modify the message string being logged by syslog?

I have a few linux systems with the keyboard and console shared via a KVM switch. When I switch between them, I get a lot of unwanted syslog messages regarding the keyboard connecting and ...
0
votes
1answer
110 views

Will Syslog-ng recreate syslog-ng.persist file if deleted?

I am running syslog-ng pe 4 lts on Centos 6. Syslog is recursing a local directory of web logs and moving them to a NAS. We are seeing that some old log lines are showing up on the NAS for current ...
1
vote
1answer
184 views

How can I get sshd to tell me why it's failing public key authentications? [closed]

I'm using OpenSSH 6.9p1 (on Lubuntu) as my SSH server. When trying to connect to it (using an SSH client in Cygwin), I keep being reverted to password authentication, despite having properly generated ...
3
votes
2answers
100 views

How can I combine two commands to tally data from compressed and uncompressed log files?

I am running this command to get a tally of failed login attempts from a server’s auth.log and it works well: sudo cat /var/log/auth.{log,log.1} | grep 'Failed password' | grep sshd | awk '{print $1,$...
1
vote
1answer
169 views

postfix/dovecot - how to view smtp auth user in log files?

I am using postfix with dovecot and virtual users on a centos 6 system. I had a rush of spam recently, with tons of packs of 50 recipients delivered from an unknown account. The current logging (...
0
votes
1answer
27 views

syslog clipping for particular applications

I have a few particular applications that are causing a LOT of logs in my syslog server. I would like to keep all of their logging in /var/log/messages or somewhere on the server, but I am trying to ...
2
votes
1answer
551 views

Can nginx log time in ISO 8601 format, but include milliseconds?

We have Nginx as a reverse proxy in front of Tomcat. Both of them log access with ISO 8601 timestamps, but tomcat adds in milliseconds (which is part of the standard). So if Nginx gets a request and ...
1
vote
2answers
131 views

Attach timestamp to each line of stdout

Im am hosting some game servers, and each server instance runs in stdout, but they don't have timestamps, just logging events to new lines, e.g.: player a connected player b connected game started ...
0
votes
0answers
60 views

xen-hypervisor-4.4 doesn't show log timestamps

I'm trying to debug some performance problems with a recently updated xen (from 3 to 4.4) and I realized that with the old XEND toolstack I had a log file in var/log/xen/xend.log with timestamps and ...
0
votes
1answer
83 views

ejabberd: logging to /var/log/ejabberd/ejabberd.log is incomplete even with debug log level (5)

I have ejabberd 15.09 from the Testing repository running on the Debian 8.2 "Jessie" (Stable) server. Since upgrade from ejabberd from the Stable the logging to /var/log/ejabberd/ejabberd.log seems ...
1
vote
1answer
43 views

How to keep a reproducible server admin log?

So here is something I am always wondering about when setting up a new Linux machine, be it desktop or server: How can I keep a reproducible log of what administration tasks I did on the machine, so ...
5
votes
1answer
176 views

iptables is occasionally logging MAC addresses. Why?

I have logging enabled on specific iptables packet drops. The rules I'm using are IP/port related only and this is what I can easily see in the logs, however occasionally I do get MAC address ...
0
votes
1answer
71 views

Sanity Checking mod_rewrite for Apache 2.2 on Ubuntu 12.04

Summary: I'm testing a simple catch-all rewrite rule. It doesn't seem to be taking effect, it's not being logged and I'm not getting any errors. I'm a junior server administrator trying to gain a ...
0
votes
0answers
197 views

how to supervisord logs to syslog

I am using supervisord to manage my process. Say process A, I log to /data/log/A.log and I setup logrotate. Now, I need to pipe to syslog which automatically pipes to r syslog. Should I edit ...
0
votes
1answer
18 views

how to prevent log if request matches in Apache

i'am trying to remove some request from Apache logs. for example, if the request match "RunJobs&tasks=jobs" i am trying to use SetEnvIf Request_URI "(RunJobs&tasks=jobs)" dontlog CustomLog $...
4
votes
1answer
134 views

Best practice for application logging database replacement

Our web apps (30 or so) log application specific stuff to a centralized logging database (Sql Server 2012) with log4net, so the logging database gets huge quickly. Thus we decided to replace it every ...
2
votes
2answers
279 views

Postfix connected to Load Balancer, how to turn down connect/disconnect messages in mail.log

We have a few Postfix servers connected to our F5 Load Balancer which checks for a connection on port 25 every couple seconds to the servers to make sure it's available. Unfortunately this creates ...
1
vote
0answers
49 views

Can iptables log all type of tcp connection?

Can iptables log tcp Split-Handshake and Simultaneous-Open connections as well as tcp Three Way Handshake? Here is these two kind of tcp connection descriptions. Here I find how to log new tcp ...
3
votes
1answer
223 views

overriding nginx access_log directive - duplicate log entries

I'm using the default nginx package on Ubuntu 14.04 server. It is using /etc/nginx/nginx.conf as the main config, and then includes configs from /etc/nginx/conf.d/*.conf and /etc/nginx/sites-enabled/*....
0
votes
2answers
359 views

What rule can I use in ModSecurity to log POST payload for a specific site?

I need to inspect POST payload for a specific website (the server is rather busy and I wouldn't turn on POST logging for the entire server). The server is LiteSpeed 5.0.7. SecRequestBodyAccess is set ...
2
votes
2answers
82 views

Increase precision of apache 2.2 log timestamp to include microseconds

A similar question was already asked on StackOverflow but there was no helpful answer given and I think it fits better here. I need to log the microseconds or milliseconds of the first response time....
0
votes
1answer
999 views

How can I get haproxy to log to systemd/journald?

I have a current generation Linux system I'd like to use with haproxy. Journald will happily log stdout from .service, and mark the log as coming from that service, but haproxy doesn't seem to be able ...
0
votes
2answers
223 views

Apache 2.4 unusual logs

since some days, i am getting some tries of hack attacks, but actually all seems fine. but i saw some log i could not explain: 127.0.0.1:443 216.218.206.66 - - [09/Oct/2015:04:49:29 +0200] "GET / ...
0
votes
1answer
262 views

IIS 8.5 not logging all requests

I'm having an issue where IIS 8.5 on Server 2012 R2 is not logging requests properly. It was working fine up until about a week ago - producing log files >10mb. This information was useful for our ...
1
vote
1answer
154 views

Logging TLS version used by clients connecting to Apache

Recently in the news was an announcement that the PCI standards in the UK will outlaw the use of TLS1.0. Unfortunately, this means that we're going to have to stop using TLS1.0 on our web servers for ...