Recording activity on the system (or of a particular program) for later reporting and analysis. Logins, logouts, web server page requests, etc might all be logged.

learn more… | top users | synonyms (2)

0
votes
1answer
59 views

Apache CustomLog for WSGI server is not filtered by LogLevel

I have a WSGI server which is served by an Apache proxy. I would like to have a log file dedicated to that server, so I added the following to the VirtualHost declaration: LogFormat "%h %l %u %t ...
1
vote
0answers
90 views

Using OSSEC HIPS alongside rsyslog, overkill?

I have been tasked to harden our company linux servers. One of the problems that was outlined was the fact that logs are stored on the server which poses two problems: Difficult to aggregate and ...
5
votes
4answers
92 views

sshd logging attempts to login without a private key

On my VPS, running Debian 7, I have ssh enabled on the default port 22 with only private key authentication enabled, all other ports are filtered with iptables. I am frequently getting login attempts ...
1
vote
1answer
507 views

rsyslog udp forwarding truncates at 2048 characters

Rsyslog on a RHEL 6 server is receiving messages locally on port 514 UDP. These messages are sometimes much larger than normal syslog message sizes. I am seeing rsyslog handle all of the messages ...
1
vote
1answer
75 views

IIS FTP server- log of file names transferred

The log files for my ftp server on iis 7.5 show DataChannelOpened and Closed events, but do not log what actual file was transferred. Is it possible to find this out, or add it to the logging?
1
vote
3answers
405 views

Is this a security breach?

I have a server running Ubuntu 10.04LTS (I know it is too old), which over the last couple of weeks has on occasion been unresponsive to network traffic, and needed a hard reset first thing in the ...
0
votes
1answer
782 views

ElasticSearch Multiple Indexes and Routing

Currently I have the following setup. Syslog --> Logstash --> ElasticSearch --> Kibana Logstash is creating a daily index ...
-1
votes
1answer
92 views

Could anyone explain the logs from my IPMI

my server is suffering freezing these days. I thought it was software problem. Then I found something strange from server log 113,System Event,02/12/2014 11:16:50 Wed,Memory,,Assertion: Memory| Event ...
0
votes
0answers
548 views

How do I log the true client IP with Apache's CustomLog and the X-Forwarded-For header?

I am currently logging the contents of the X-Forwarded-For header using a CustomLog declaration in Apache. The problem is that every proxy and load balancer along the request path will add its IP to ...
0
votes
0answers
23 views

Advanced Windows Firewall - Strange logging behavior

I have created a GPO that set's several firewall rules to Windows Server 2008 R2 machines within a specific OU. The default behavior is set to block on inbound and outbound on all profiles. Also I did ...
1
vote
1answer
225 views

How to configure remote IP address audit logging for VPN clients on a Cisco 2801

We have a Cisco 2801 that also acts as a VPN Server for Cisco VPN Client. We would like to configure IP address logging so that each time a user connects using VPN we would like to log his IP Address. ...
3
votes
1answer
226 views

How can I log a message to the systemd journal from the command line?

Reading Where does logger log its messages to in Arch Linux?, it seems that syslog() messages and the 'logger' command line app only talk to the systemd journal if a socket for message forwarding is ...
4
votes
1answer
351 views

Why my nginx server receives requests targeting ads.yahoo.com?

I have a nginx proxy facing public internet. A few days ago, I started to receive a torrential amount of requests, targeting URLs that are invalid for my domain. An excerpt from nginx access.log: ...
0
votes
0answers
14 views

Changing an Apache CustomLog configuration line from within a conf.d file?

My Apache 2.2 httpd.conf file contains the following line: CustomLog logs/access_log common I want to instead use: CustomLog logs/access_log "a different log format that I prefer" But I only ...
0
votes
1answer
96 views

mysql.slow.log is not created even though it's configured in /etc/my.cnf , what could be the reason?

This is the relevant section from /etc/my.cnf: [mysqld] slow-query-log = ON long_query_time = 2 log_slow_queries = /var/log/mysql-slow.log The problem is that file is ...
5
votes
2answers
1k views

Cannot find upstart logs in syslog despite a log-priority of debug (ubuntu 13.04 & mint 16)

I've set upstart log level to "debug" sudo initctl log-priority debug But I still cannot see anything in /var/log/syslog. sudo initctl emit hello # no log sudo initctl start my-broken-service # ...
0
votes
0answers
114 views

Understanding parse, bind, execute entries in PostgreSQL logs

I am new to PostgreSQL logging and have a few questions. PostgreSQL is used as a database for a couple of comercial products (both on the same server). This is run on a Windows 2008 R2 server (as I ...
0
votes
0answers
41 views

rsyslog.conf only partly honored

I followed this description on how to enable audit for Samba (entry of Aug 10, 2009) and wanted to get all additionally enabled logging in a special log file (/var/log/samba/log.audit). The mentioned ...
2
votes
2answers
989 views

Block bots by their Java referrer or User-Agent string?

I have been getting a lot of web hits in my logs that crawl most top level pages of my site and show a referrer as a Java version. I see different variants of the Java versions in the referrer, i.e. ...
0
votes
1answer
9 views

Get referrer of requests currently listed by status module

Our server has on normal time 20 request/second, which can be seen constantly on server-status (status module) Sometimes we have 800 requests/second, and all these requests are shown on ...
0
votes
0answers
31 views

Scribe Log Auto Stopping?

We are running Scribe Log Service to collect Logs from Application Servers. (https://github.com/facebook/scribe/wiki/Scribe-Configuration) Scribe Log run smoothly for a long time. But Yesterday, I ...
0
votes
0answers
239 views

Why is SystemMaxFileSize in journald.conf not being honoured?

I have the following settings in journald.conf SystemMaxUse=100M #SystemKeepFree= SystemMaxFileSize=10M According to the documentation, SystemMaxUse controls how much disk space the journal may use ...
0
votes
0answers
18 views

How to suppress request string logging in App Engine to secure passwords

I am designing an app for Google App Engine. In my initial set up, I have the user submit their username and password to my app via AJAX. I then hash it and compare that to a stored hash without ...
1
vote
1answer
42 views

How to log both HTTP and HTTPS requests to the same file

Using recent Apache on Linux. It's inconvenient to have the two different kinds of requests sent to two different log files since I like to watch the log file scroll by live via the shell. I also ...
0
votes
1answer
47 views

How to check last FTP logins using SSH?

I've just bought a new VPS (its operating system is CentOS). As this is my first experience with VPS, I don't know everything about managing and ... One of my customers told me his website is not ...
-2
votes
1answer
222 views

Configure Protocols using iptables log file with ndpi [closed]

I am using iptables with ndpi to filter my network and add two rules to my iptables rules they are iptables -I INPUT -m ndpi --http -j LOG iptables -I INPUT -m ndpi --google -j LOG In my log file ...
1
vote
1answer
254 views

Why or who did reboot my server

One of our servers rebooted last night reboot system boot 2.6.32-5-amd64 Wed Jan 15 03:24 - 16:07 (1+12:42) Our hoster didn't do it, nor did I. syslog does not show any error Jan 15 03:17:01 ...
0
votes
1answer
25 views

Is there a way to detect what is modifying Active Directory user properties?

We use a display name format of first initial and surname, e.g. J Smith. Recently, something is changing this to show their full name. Is there any way to look through some logs to find out which ...
2
votes
1answer
1k views

How can I make apache give the config file path and line number for a 403 error

I'm running Apache 2.4.7 on debian unstable. I'm getting 403 errors when I try to run supysonic using the mod_wsgi module. I turned the LogLevel for wsgi and authz_core up to trace6, but I'm still ...
0
votes
1answer
338 views

Apache2 server (behind Zyxel USG 100 NAT/Firewall) with vhost does not log real clients ip addresses

SOLVED To allow the Zyxel USG 100's NAT to forward untouched packets to my web server i edited the policy route of the Zyxel. Zyxel -> Configuration -> Network ->Routing -> Policy Route ...
0
votes
1answer
32 views

Logging not getting disabled

Out Tomcat 8 is logging so much so that by the evening the catalina.out inflates to GBs of data. I followed the procedure given on the tomcat website to replace JULI logging with LOG4J. Now LOG4J has ...
1
vote
2answers
326 views

logging/capturing STDERR/STDOUT on Amazon EC2

I'm looking for a solution that would allow me to automatically capture the STDOUT/STDERR of a process running on Amazon EC2, and send it (remotely) to another server. Sound simple, except: I will ...
2
votes
0answers
17 views

Globally recording Bash history: Dealing with long-running commands [duplicate]

For security reasons, I'm trying to remotely log all commands that users enter into the shell. I've got it to work by using this in my global bashrc: PROMPT_COMMAND='history -a >(tee -a ...
2
votes
1answer
537 views

How can I use perfmon/logman to set up logging on a master (Windows) VM, writing to another machine on the network?

I know how to set up logging to write to a remote location in the general case - just specify the output filename using the full UNC path (e.g. \\HOST-PC\directory\logoutput.etl) when creating the log ...
0
votes
0answers
131 views

What kind of messages are dropped when $OmitLocalLogging is on?

The new systemd journal was introduced some time ago. The following configuration is added in rsyslog to integrate this new module: $ModLoad imjournal # provides access to the systemd journal ...
0
votes
1answer
272 views

tried to spam postfix, doesn't log IP address

I've had some serious spam issues with my local postfix installation, until I found out that there was a postfix user wich was allowed to relay mails (I still don't know why this was possible in the ...
2
votes
1answer
53 views

Log Archiving Solution

What is the best solution for log archiving ? I have two application server (tomcat6) and I need to keep application log files for 7 years. Shipping, zipping and writing them on Bluray or DVD is time ...
0
votes
0answers
249 views

Message Structure Different Between Log Shipper — Logstash and nxlog

I have a Windows Server 2008 (ugh) system that I'm pulling messages from with Logstash and nxlog. With nxlog as the log shipper, messages as they appear in the log file are sent to the parser: ...
0
votes
1answer
505 views

Log Rotation Causing nxlog Failure

I'm using nxlog to watch two vCenter log files on a Windows Server 2008 system and I have a very simple config to ship messages to Logstash. Nxlog began failing yesterday after a file was rotated. ...
2
votes
4answers
280 views

Use logger in shell script

How can I use logger in a shell script? If I run ntpd -qnp pool.ntp.org 2> >(logger) in console, it works as expected. If I put it into a shell script #!/bin/sh ntpd -qnp pool.ntp.org ...
1
vote
1answer
87 views

Can I automate emailing of critical errors with systemd journal?

Fedora OS introduces journalctl as the new way to log error messages. I learn about this recently when I performed an upgrade. var/log/messages and many other log files are now combined into a ...
0
votes
1answer
45 views

ap_log_perror unable to read loglevel from configuration file?

Loglevel error I am giving this in the configuration file,httpd.conf,when i am using the function ap_log_rerror,it is capturing only log messages that are having error or above loglevels,but when i ...
0
votes
0answers
68 views

Making changes in Loglevel httpd.conf of apache server?

I am working on windows-7 Visual studio 2008,According to Apache: Configure "LogLevel debug" for certain modules only? i am making changes in the loglevel of configuration file I am giving ...
1
vote
1answer
502 views

NXLOG File Input Search Patterns

I'm trying to use nxlog to forward vCenter messages to Logstash with the im_file input module and a pattern to specify the exact file(s) to watch. What would normally be simple is now needlessly ...
0
votes
1answer
17 views

Logging redirects and rewrites

I'm using the following blacklist .htaccess directives in apache v2.2 (on mediatemple): http://perishablepress.com/5g-blacklist-2013/ I want to get a sense of how often these directives are ...
0
votes
2answers
87 views

how to prevent crontab logs from registring in syslog?

I have separate my crontab log into cron.log file by uncommenting the below ling in /etc/syslog.conf, But it register in syslog too. cron.* /var/log/cron.log How ...
1
vote
0answers
137 views

Syslog-ng not logging on debian

I have syslog-ng running but it does not seem to be logging to /var/log anymore. Looking at the logs it apparently used to awhile back: -rw------- 1 root root 0 Sep 8 00:55 messages ...
1
vote
0answers
242 views

View dropped/rejected SMTP sessions in Exchange 2010

I am troubleshooting a problem trying to SMTP into an Exchange 2010 machine. I would like to view SMTP logs to see dropped or rejected sessions in order to try to figure out exactly why the sessions ...
0
votes
0answers
519 views

Should I Set pm.start_servers to Highest Value or Not?

I have the following settings on my PHP-FPM: pm.max_children = 256 pm.start_servers = 50 pm.min_spare_servers = 40 pm.max_spare_servers = 128 Even if I set it to higher value, I still get the ...
1
vote
1answer
116 views

Choosing the right database/storage engine for iptables ulogd

I'm looking for some help choosing a database backend for a iptables ulogd setup. We are going to swap out our current proprietary firewall solution with iptables and one of the requirements is to ...