Recording activity on the system (or of a particular program) for later reporting and analysis. Logins, logouts, web server page requests, etc might all be logged.

learn more… | top users | synonyms (2)

4
votes
1answer
721 views

No more logging after upgrade to Debian Wheezy

Syslog, auth.log, kern.log and messages log files are not updated anymore after upgrading to Debian Wheezy (Debian Squeeze was previously running). How could I fix it?
0
votes
0answers
149 views

Linux audit failure flag ignored? (can't silence printk)

We're using the Linux audit subsystem to monitor process execution. # in audit.rules -a exit,always -F arch=b32 -F subj_user=unconfined_u -S execve -a exit,always -F arch=b64 -F ...
0
votes
1answer
74 views

How to see which workstation on our network went to a certain site

We had someone order a laptop from Staples.com with one of our company credit cards on Sept 25. It showed up at our office on the 27th, nobody knew who ordered it, and then it was gone... Someone ...
0
votes
1answer
136 views

A good tool for parsing Nginx logs for Django app [closed]

Can anyone recommend a good tool to parse and analyze Nginx access logs which will group the urls based on the regex in my django urls.py files (or a config file generated from them)? It does not ...
1
vote
3answers
1k views

Query specific logs from event log using nxlog

Below is my nxlog configuration define ROOT C:\Program Files (x86)\nxlog Moduledir %ROOT%\modules CacheDir %ROOT%\data Pidfile %ROOT%\data\nxlog.pid SpoolDir %ROOT%\data LogFile %ROOT%\data\nxlog.log ...
0
votes
0answers
37 views

Include executed cron command when outputting to log

Is there a way I can include the command in the output when I'm logging to a file? For example * * * * * date && /path/to/php /path/to/script.php >> cron.log 2>&1 Would give ...
2
votes
3answers
312 views

Logging doesn't work after rsyslog upgrade

I have several different django applications under apache on a Red Hat server. These applications use SysLogHandler for sending log messages to the local rsyslog service. In order to pipe log messages ...
0
votes
0answers
208 views

Getting strange error from elasticsearch backed of LogStash

When i try to run any query from logstash like "httpd" search from url: http://mydomain.domain.com:9292/search , it gives me following error: "No results for query 'httpd'" And in the log ...
0
votes
0answers
23 views

apache virtualhostalias and logging

I have a virtualhost configurate with a VirtualDocumentRoot directive: <VirtualHost *:80> ServerName my_server VirtualDocumentRoot /home/user/webserv/%1/www CustomLog ...
0
votes
0answers
39 views

martian entry in debian log file

I have a Debian Wheezy server and several windows 7(sp1) & windows xp (sp3) clients. The server has 2 network cards with eth0 the local internal. I am also running a dynamic DNS server on the ...
0
votes
1answer
49 views

How to know which user killed a process

Is there a way in linux to find out which user or which process killed another process? Maybe a log? I searched through /var/log and specifically on auth.log.* but I didn't find anything ...
0
votes
0answers
68 views

Rsyslog filter packets from input file before sending to remote rsyslog host

I have my rsyslog configured to send logs from a logfile to a remote host $InputFileName /var/log/app/app.log $InputFileTag app $InputFileSeverity info $InputFileFacility local7 ...
1
vote
1answer
58 views

Apache logs just “plesklog”

I just discovered that my Apache 2.2.8 just logs in his access_log the string plesklog since a few weeks. Normally it looks like that www.xxx.yyy.zzz - - [19/Jul/2013:04:37:32 +0600] "GET ...
0
votes
1answer
344 views

rsyslog relp - preventing remote logs from being written to my local /var/log

I've set up a logging server using rsyslog with relp. It works just fine as far as receiving remote logs and placing them in /var/spool/rsyslog. My problem is: most of these messages are appearing in ...
1
vote
0answers
57 views

Graphing/Aggregating IIS Logs from Windows Azure

I've got IIS logging etc enabled in my Azure Web Roles - so they're there in case i want to reference them, but i'd like to pull them all in to somewhere central and run stats across them to get ...
0
votes
2answers
348 views

Log Analysis Tools for Apache & Tomcat [closed]

I'm looking for a log analysis tool to monitor & analyse the logs from an Apache & Tomcat webfarm. It would need to have agents that run on the servers, and ship logs back to a central ...
2
votes
1answer
288 views

Is IIS Advanced Logging faster than ODBC logging?

I believe ODBC logging is slowing my website down. I read that IIS Advanced Logging can give me what I need with the Log Parser (I think). Is the Advanced Logging worth the time to implement? ...
1
vote
1answer
281 views

Mongodb - proper way to rotate logs

Mongo docs say that I can: use -SIGUSR1 signal and get the old log renamed and current switched use logrotate from OS I want the OS's logrotate ability to zip old files and remove oldest, but see ...
1
vote
2answers
166 views

Server timezone changed to PHT but logs still written in MST?

A couple of days ago, I updated the timezone on an Ubuntu 12.04 LTS server using $ sudo dpkg-reconfigure tzdata. Today I noticed while tailing the mail log, that the times were still 15 hours behind. ...
1
vote
1answer
500 views

Excluding some messages from syslog-ng

I'm trying to exclude some messages from being logged by syslog-ng, such as this LDAP log entry: Sep 18 15:18:34 myserver slapd[9682]: conn=1043 op=24 SEARCH RESULT tag=101 err=0 nentries=1 text= ...
0
votes
1answer
57 views

In sensu, how to configure log level?

I've just installed sensu (with the debian "omnibus" package) and I couldn't find any way to change the log level. Is there any way to do it in both client and server?
0
votes
1answer
74 views

Mysql general query log tool to play back queries in time?

I am trying to reproduce production activity in time for benchmarking purposes from the mysql general query log. I'd like to be able to use the date data from the log to reprduce the time intervals ...
1
vote
1answer
328 views

Is it possible to get logging in netsh interface portproxy

I am using netsh interface portproxy to do some port forwarding on a server. Is there any way at all to see any logs of what was the input sent to the port, whether something was forwarded etc? i.e. ...
2
votes
0answers
180 views

Apparmor denies ntpd access to its own logs

ntpd complains that it cannot access its own logs # ntpd -qgddd ... 11 Sep 16:23:00 ntpd[7262]: can't open /var/log/ntpstats/peerstats.20130911: Permission denied ... 11 Sep 16:23:01 ntpd[7262]: ...
0
votes
1answer
1k views

Limit tcpdump capture files by time and size

I am having some problems getting tcpdump to log all internet traffic on an interface with the following limitations: I would like a new pcap file every hour with time and date tag in the name If ...
0
votes
1answer
141 views

Remotely diagnosing server 2012 boot problems with no KVM

I have a rented dedicated server that seems to have run into some issues. Unfortunately I have rented from a company who will only give hardware support leaving me in the dark. My server had been ...
0
votes
0answers
98 views

Weird date-time in catalina.out

I support a tomcat application that has recently started returning errors for every request, and I am trying to get debug info out of the catalina.out. I am expecting to see a date-time format like ...
1
vote
1answer
86 views

Splunk as syslog analyzer

I have running centralized syslog server (rsyslog on CentOS6, which works perfect). Next step it was to add Splunk as a syslog analyzing tool. All was installed perfectly - Splunk works, can log in to ...
2
votes
1answer
612 views

How to install auditd on CentOS?

How to install auditd on CentOS 6.4 x64 ? I want to Log all commands run by admins Log all commands run by admins on production servers Edit: I can't run aduditd service I did with this tut enter ...
1
vote
1answer
39 views

Is it possible to have 2 Error Logs per VirtualHost in Apache?

I have about 10 VirtualHosts and I like to keep the error_logs separated. Recently, I need to also have the error_logs all combined for some mod_security scanning. If I define 2 ErrorLogs for a test ...
3
votes
3answers
205 views

Logging when limit Exceeds

Is there a log file that logs information when the values set in /etc/security/limits.conf are exceeded? If the values are too tight in the above file the clients using the website hosted on the ...
0
votes
3answers
350 views

Why does MySQL Slow Queries Log not exist?

I was looking today on my CentOS server for a MySQL Slow Queries Log, but have had no luck finding the log. I even did a "SELECT SLEEP(2)" test in hopes to have this file created. Take note, I am not ...
0
votes
1answer
63 views

rndc querylog - Can you specify log file other than messages?

When logging BIND requests using rndc querylog, the logging defaults to /var/log/messages. Is it possible to change this logging destination and specify my own log file?
0
votes
1answer
185 views

pam_limits(cron:session): unknown limit item 'nofiles'

On my debian-squeeze server I get thousands of messages in the logcheck email under Security Events for sudo =-=-=-=-=-=-=-=-=-=-=-=- Aug 31 20:17:44 eclabs sudo: pam_limits(sudo:session): unknown ...
0
votes
1answer
107 views

Disk usage of Puppet reports

We are running puppet-dashboard on the puppetmaster which processes all the reports and puts them in a MySQL table. Every month about 5GB of reports are generated however in /var/lib/puppet/reports. ...
0
votes
1answer
83 views

Best way to rotate Magento logs?

We have a lot of sites on Magento and the logs are getting gigantic, so I'm wondering if the best way is to use a cron script to rotate them or logrotate. I want to avoid making file copies as it ...
1
vote
1answer
257 views

Logging client ip address from tcp connection from HAproxy to nginx

If internet traffic comes through an HAproxy load balancer on SSL and that is passed to an nginx web server, how can I log the clients ip address? I'm aware of methods like this: How can I use ...
2
votes
0answers
96 views

Redhat 6.4 configured to log Martian packets but is not logging ll header

I am trying to investigate the source of martian packets I have been seeing on several servers connected to the same subnet. The logging of martian packets has been enabled in /etc/sysctl.conf. ...
0
votes
0answers
50 views

Apache logs full of empty POST /

A customer's site access_logs tons of empty POSTs requests on / from hundreds of different source IPs: X.X.X.X - - [27/Aug/2013:16:54:23 +0200] "POST / HTTP/1.1" 200 20718 "-" "Mozilla/4.0 ...
1
vote
1answer
252 views

Strange syslog for my server

Today i go on my log with nano /var/log/syslog I have this, and i think it's not very good : Aug 27 06:25:02 ks3309528 rsyslogd: [origin software="rsyslogd" swVersion="4.6.4" x-pid="2235" ...
-1
votes
1answer
71 views

Where is ssh daemon log file

I am facing a strange issue on my Centos 5.5 VMware virutal machine. SSHD service stops responding after working for few days. At the same time cmd>telnet server 22 give me no response. It works ...
2
votes
1answer
47 views

log parser doesn't interpret dates correctly

When I query our IIS logs, I get a value of '30/12/1899' in the date column. select * from 'C:\IIS 2013 Logs\*.log' However for some rows, it does have a valid date. (Coincidently rows that have a ...
0
votes
0answers
36 views

How to configure logs in Squid3

I want to configure the access.log on squid so I can read the reports with SARG, but I don't really know how to to it, as uncommenting this line #Default: access_log /var/log/squid3/access.log squid ...
0
votes
0answers
41 views

Using Lire to read squid log files

I read the instructions here : http://download.logreport.org/pub/current/README So I do : lr_log2report squid_access > /tmp/squidreport.txt < /var/log/squid3/access.log.2.gz And I get ...
1
vote
1answer
189 views

Windows DNS Debug Logging Performance Impact

Similar to this question, Logging DNS requests on a windows DNS resolver, I am curious how much of a performance hit/impact enabling DNS Debug Logging will have on a server. Per the Microsoft links, ...
1
vote
1answer
31 views

Mongodb spamming log

I found that mongod writes [snapshotthread] cpu: elapsed:4000 writelock: 0% continuously. So it one day log now about 2Mb. What does it mean and how to disable this?
1
vote
1answer
133 views

How to make comments in logcheck files?

how can I add comments to logcheck ignore-rules? Things I tried so far: # seems to match single # characters instead of starting a comment empty lines matches against everything $ matches against ...
4
votes
2answers
198 views

iptables SSH connection logging

Is it possible to only write a log-entry when a connection is established ? I have tried: iptables -I OUTPUT -p tcp --dport 22 -j LOG --log-level notice --log-prefix "outgoing ssh connection" to ...
0
votes
1answer
53 views

Log Review Process

Currently I have a fairly large syslog-ng cluster setup that is my main log aggregation point. I have the need to be able to acknowledge certain logs and mark them as review for auditing purposes. ...
8
votes
1answer
164 views

Is there a tool that can top-ify an input stream?

I come across quite a few use cases where it would be very useful to take input from a (usually newline-delimited) stream and summarise it in a top-like fashion (see top, iotop, etc). A kind of ...