Tagged Questions

Recording activity on the system (or of a particular program) for later reporting and analysis. Logins, logouts, web server page requests, etc might all be logged.

learn more… | top users | synonyms (2)

0
votes
0answers
13 views

“Safely remove Device” logs

I would like to know if Windows Server 2003 logs somewhere when a device has plugged/unplugged. A network card disappeared from one of our virtual machines and I believe it was because somebody ...
0
votes
2answers
92 views

Tracking OpenVPN user login

Situatio is that each user login is loged in log file. Each Server start log file is erased and created new. Is any way to log user logins into antoher file or other place that when server start it ...
1
vote
1answer
128 views

Access log of nginx: why are foreign URLs logged?

My access log is full of such entries: 178.207.40.219 - - [03/Apr/2014:17:34:37 +0200] "GET http://win.mail.ru/cgi-bin/auth?Login=nutyck@bk.ru&Domain=mail.ru&Password=241716 HTTP/1.1" 403 168 ...
0
votes
1answer
644 views

make nginx not log “no user/password was provided for basic authentication” in error logs

I've added password protection to a lot of my domain via nginx by adding: auth_basic "Restricted"; auth_basic_user_file /usr/ssl/htpasswd; to the nginx vhosts. I log all errors ...
0
votes
1answer
51 views

How to log mail client with Dovecot / Postfix

Does anyone know if it's possible to have Dovecot or Postfix output the mail client of a user? In Dovecot's variables list, I cannot find anything in that direction.
0
votes
0answers
139 views

Logparser - Getting average response time from microseconds

I have one month's worth of web server log files in the following format: #Fields: date time cs-uri-stem cs-uri-query c-ip cs(Referer) sc-status sc-bytes time-taken 2014-03-12 17:34:02 ...
0
votes
2answers
92 views

How do I see if user connected to mysql over ssh tunnel?

I imagined command last, would also give me mysql over ssh tunnels list. But I was wrong. Is there a place where this tunnels are logged? Ubuntu server 12.04.
0
votes
1answer
38 views

%systemdrive%\windows\temp deletion rules

What are the rules for which the files in %systemdrive%\windows\temp are removed? I am not referring to rules that System Administrator add to system. I am referring to the built-in processes that ...
0
votes
0answers
106 views

Tomcat 7 log file date format

Tomcat7 log entries use a date format: Mar 30, 2014 11:50:32 AM How do I change it use the format: 2014-03-30 11:50:32 This would make it much easier for Zabbix to parse the log file for ...
1
vote
1answer
134 views

How do I configure Linux to log when ulimits are hit?

For example, say I'm hitting nproc. I would expect a log message to appear /var/log/messages or similar, but it looks like that needs to be configured. How do I do that? I can't find anything relevant ...
0
votes
0answers
34 views

Apache microseconds logs

So, I'm trying to understand how the apache microseconds log format is working - I configured a custom log for my apache vhost including %D for microseconds and from my tests it seems that is working ...
2
votes
3answers
497 views

Parseable NGINX accesslog files with delimiters

The default NGINX format is this: log_format combined '$remote_addr - $remote_user [$time_local] ' '"$request" $status $body_bytes_sent ' '"$http_referer" ...
0
votes
0answers
64 views

Rsyslog with Nginx virtual hosts

I have an Nginx server with several virtual hosts, each of them generating log files. I'm sending all these logs to a remote server but don't know how to create one log file per virtual on this ...
3
votes
1answer
68 views

How can I configure IIS to save log files in a given folder without creating a W3SVCXXX folder under it?

You can configure IIS to save its logs in any folder you want; however, even if you configure this setting at the site level, it will always create another folder under the one you choose, called ...
0
votes
0answers
11 views

How can we log file download successes and failures from IIS7?

We have a dedicated server: IIS7 Windows Server 2012 R2 Standard This servers sole use is to serve files ~120MB in size. We're looking for the simplest way to log how many downloads were: ...
0
votes
2answers
107 views

Excluding clients from web logs?

Is it possible to exclude certain IP addresses from Nginx's access.log, for example where lots of the requests come from a monitoring server?
2
votes
2answers
93 views

How to log remotely without syslog

I have a bunch of logs which are not created using syslog. I would like to export them to another host. If possible using syslog or rsyslog. A pipe? how can I do that?
1
vote
1answer
1k views

Troubleshooting intermittent Apache 400 Bad Request errors

I'm trying to debug an issue in my app and looking for suggestions or troubleshooting tips. My app consists of a mobile app submitting data over HTTPS to apache (which is using mod_proxy to forward ...
1
vote
0answers
143 views

IIS 8 logging stops at midnight UTC

I have one IIS 8 server where the w3logsvc dies at midnight UTC (we're Central Time, so we're UTC -6). I have to manually start the service to get it back running again. I have the logging set to use ...
1
vote
0answers
40 views

“\xc2:\xc2” in HTTP proxy GET request

Recently I came across lines like these in an HTTP server's access_log (I've changed the real image to "someimage.jpg" - you can browse the images folder directly since directory listing is allowed, ...
0
votes
1answer
81 views

Analyze tons of Apache logs

I'm having an issue analyzing Apache logs - because there's a ton of them. Like first 5 days of March have resulted in about 50Gb of log files ( uncompressed ). How to analyze these? What tools to ...
1
vote
2answers
68 views

Rolling log file without losing any log event

I have an 8GB file called php.log with a running php script logging into it. It is important for me that I log every event, and I want to compress it and empty the current file without stopping the ...
0
votes
2answers
196 views

How to Change sysstat/sar logging folder

I have just enabled sysstat on one of my servers (Ubuntu 12.04), I have noticed it is logging all to /var/log/sysstat/sa04 /var/log/sysstat/sa05 /var/log/sysstat/sar04 How can I change the sysstat ...
0
votes
2answers
149 views

Not getting anything written to my log files in ubuntu

I am not getting any logs in auth.log, kern.log, syslog or any other log files on my 12.04 ubuntu server. There is also no rsyslog.conf if it should be there by default. rsyslogd is not running as ...
-1
votes
1answer
32 views

Disabling sentbox in postfix over Squirrelmail

I have installed POSTFIX over Squirrelmail on CentOS Linux... The services I have ran are: service httpd service ssl service mysql service postfix service saslauthd service dovecot I have ...
1
vote
1answer
70 views

Rsyslog: stopping after 1047 file descriptors opened on a centralized log server using TCP

We have heroku drains dumping to 1 log server. There are a lot of instances (~100) sending their logs to this server using TCP. The Server filters the logs based on hostname and puts them into a ...
0
votes
1answer
68 views

Snort logging mode - How to define subnets

I am using snort to log all traffic on an interface snort -i eth1 -l /interface/log/dir -b -U -m 112 With this command I manage to get ALL data which makes my log files very large. Is there any ...
1
vote
1answer
195 views

Will changing IIS Advanced Logging config restart app

I am using the IIS Advanced Logging module on a production server running IIS 7.5. I need to change some of the settings (specifically, which fields are logged) and cannot find anywhere that ...
0
votes
1answer
552 views

Compress and remove logs from jboss on linux with cron

I need to compress and remove log files after some time from serwer. I have never write scripts before. So far i have script logs.sh: #!/bin/bash LOGS=/usr/local/jboss/server/default/log/ ...
1
vote
1answer
188 views

Logcheck alternative for central syslog server [closed]

I have to setup some open source log monitoring on a centralized syslog server. A lot of machines (windows, linux) and some routers and switches sending their logs there. Many years ago when I had to ...
3
votes
1answer
311 views

What are the drawbacks to using mod_log_rotate and rotatelogs.exe together?

On Microsoft-based platforms, are there any drawbacks or hidden pitfalls to using rotatelogs.exe for ErrorLog directive(s) and allowing mod_log_rotate to handle CustomLog directives for rotation? As I ...
0
votes
1answer
56 views

Apache CustomLog for WSGI server is not filtered by LogLevel

I have a WSGI server which is served by an Apache proxy. I would like to have a log file dedicated to that server, so I added the following to the VirtualHost declaration: LogFormat "%h %l %u %t ...
1
vote
0answers
83 views

Using OSSEC HIPS alongside rsyslog, overkill?

I have been tasked to harden our company linux servers. One of the problems that was outlined was the fact that logs are stored on the server which poses two problems: Difficult to aggregate and ...
5
votes
4answers
87 views

sshd logging attempts to login without a private key

On my VPS, running Debian 7, I have ssh enabled on the default port 22 with only private key authentication enabled, all other ports are filtered with iptables. I am frequently getting login attempts ...
1
vote
1answer
429 views

rsyslog udp forwarding truncates at 2048 characters

Rsyslog on a RHEL 6 server is receiving messages locally on port 514 UDP. These messages are sometimes much larger than normal syslog message sizes. I am seeing rsyslog handle all of the messages ...
1
vote
1answer
70 views

IIS FTP server- log of file names transferred

The log files for my ftp server on iis 7.5 show DataChannelOpened and Closed events, but do not log what actual file was transferred. Is it possible to find this out, or add it to the logging?
1
vote
3answers
373 views

Is this a security breach?

I have a server running Ubuntu 10.04LTS (I know it is too old), which over the last couple of weeks has on occasion been unresponsive to network traffic, and needed a hard reset first thing in the ...
0
votes
1answer
642 views

ElasticSearch Multiple Indexes and Routing

Currently I have the following setup. Syslog --> Logstash --> ElasticSearch --> Kibana Logstash is creating a daily index ...
-1
votes
1answer
85 views

Could anyone explain the logs from my IPMI

my server is suffering freezing these days. I thought it was software problem. Then I found something strange from server log 113,System Event,02/12/2014 11:16:50 Wed,Memory,,Assertion: Memory| Event ...
0
votes
0answers
513 views

How do I log the true client IP with Apache's CustomLog and the X-Forwarded-For header?

I am currently logging the contents of the X-Forwarded-For header using a CustomLog declaration in Apache. The problem is that every proxy and load balancer along the request path will add its IP to ...
0
votes
0answers
23 views

Advanced Windows Firewall - Strange logging behavior

I have created a GPO that set's several firewall rules to Windows Server 2008 R2 machines within a specific OU. The default behavior is set to block on inbound and outbound on all profiles. Also I did ...
1
vote
1answer
205 views

How to configure remote IP address audit logging for VPN clients on a Cisco 2801

We have a Cisco 2801 that also acts as a VPN Server for Cisco VPN Client. We would like to configure IP address logging so that each time a user connects using VPN we would like to log his IP Address. ...
2
votes
1answer
197 views

How can I log a message to the systemd journal from the command line?

Reading Where does logger log its messages to in Arch Linux?, it seems that syslog() messages and the 'logger' command line app only talk to the systemd journal if a socket for message forwarding is ...
4
votes
1answer
350 views

Why my nginx server receives requests targeting ads.yahoo.com?

I have a nginx proxy facing public internet. A few days ago, I started to receive a torrential amount of requests, targeting URLs that are invalid for my domain. An excerpt from nginx access.log: ...
0
votes
0answers
12 views

Changing an Apache CustomLog configuration line from within a conf.d file?

My Apache 2.2 httpd.conf file contains the following line: CustomLog logs/access_log common I want to instead use: CustomLog logs/access_log "a different log format that I prefer" But I only ...
0
votes
1answer
87 views

mysql.slow.log is not created even though it's configured in /etc/my.cnf , what could be the reason?

This is the relevant section from /etc/my.cnf: [mysqld] slow-query-log = ON long_query_time = 2 log_slow_queries = /var/log/mysql-slow.log The problem is that file is ...
5
votes
2answers
891 views

Cannot find upstart logs in syslog despite a log-priority of debug (ubuntu 13.04 & mint 16)

I've set upstart log level to "debug" sudo initctl log-priority debug But I still cannot see anything in /var/log/syslog. sudo initctl emit hello # no log sudo initctl start my-broken-service # ...
0
votes
0answers
105 views

Understanding parse, bind, execute entries in PostgreSQL logs

I am new to PostgreSQL logging and have a few questions. PostgreSQL is used as a database for a couple of comercial products (both on the same server). This is run on a Windows 2008 R2 server (as I ...
0
votes
0answers
37 views

rsyslog.conf only partly honored

I followed this description on how to enable audit for Samba (entry of Aug 10, 2009) and wanted to get all additionally enabled logging in a special log file (/var/log/samba/log.audit). The mentioned ...
2
votes
2answers
915 views

Block bots by their Java referrer or User-Agent string?

I have been getting a lot of web hits in my logs that crawl most top level pages of my site and show a referrer as a Java version. I see different variants of the Java versions in the referrer, i.e. ...