Recording activity on the system (or of a particular program) for later reporting and analysis. Logins, logouts, web server page requests, etc might all be logged.

learn more… | top users | synonyms (2)

1
vote
0answers
52 views

How to modify the message string being logged by syslog?

I have a few linux systems with the keyboard and console shared via a KVM switch. When I switch between them, I get a lot of unwanted syslog messages regarding the keyboard connecting and ...
0
votes
1answer
115 views

Will Syslog-ng recreate syslog-ng.persist file if deleted?

I am running syslog-ng pe 4 lts on Centos 6. Syslog is recursing a local directory of web logs and moving them to a NAS. We are seeing that some old log lines are showing up on the NAS for current ...
1
vote
1answer
229 views

How can I get sshd to tell me why it's failing public key authentications? [closed]

I'm using OpenSSH 6.9p1 (on Lubuntu) as my SSH server. When trying to connect to it (using an SSH client in Cygwin), I keep being reverted to password authentication, despite having properly generated ...
3
votes
2answers
131 views

How can I combine two commands to tally data from compressed and uncompressed log files?

I am running this command to get a tally of failed login attempts from a server’s auth.log and it works well: sudo cat /var/log/auth.{log,log.1} | grep 'Failed password' | grep sshd | awk '{print $1,$...
1
vote
1answer
191 views

postfix/dovecot - how to view smtp auth user in log files?

I am using postfix with dovecot and virtual users on a centos 6 system. I had a rush of spam recently, with tons of packs of 50 recipients delivered from an unknown account. The current logging (...
0
votes
1answer
27 views

syslog clipping for particular applications

I have a few particular applications that are causing a LOT of logs in my syslog server. I would like to keep all of their logging in /var/log/messages or somewhere on the server, but I am trying to ...
2
votes
1answer
652 views

Can nginx log time in ISO 8601 format, but include milliseconds?

We have Nginx as a reverse proxy in front of Tomcat. Both of them log access with ISO 8601 timestamps, but tomcat adds in milliseconds (which is part of the standard). So if Nginx gets a request and ...
1
vote
2answers
136 views

Attach timestamp to each line of stdout

Im am hosting some game servers, and each server instance runs in stdout, but they don't have timestamps, just logging events to new lines, e.g.: player a connected player b connected game started ...
0
votes
0answers
65 views

xen-hypervisor-4.4 doesn't show log timestamps

I'm trying to debug some performance problems with a recently updated xen (from 3 to 4.4) and I realized that with the old XEND toolstack I had a log file in var/log/xen/xend.log with timestamps and ...
0
votes
1answer
88 views

ejabberd: logging to /var/log/ejabberd/ejabberd.log is incomplete even with debug log level (5)

I have ejabberd 15.09 from the Testing repository running on the Debian 8.2 "Jessie" (Stable) server. Since upgrade from ejabberd from the Stable the logging to /var/log/ejabberd/ejabberd.log seems ...
1
vote
1answer
43 views

How to keep a reproducible server admin log?

So here is something I am always wondering about when setting up a new Linux machine, be it desktop or server: How can I keep a reproducible log of what administration tasks I did on the machine, so ...
5
votes
1answer
194 views

iptables is occasionally logging MAC addresses. Why?

I have logging enabled on specific iptables packet drops. The rules I'm using are IP/port related only and this is what I can easily see in the logs, however occasionally I do get MAC address ...
0
votes
1answer
74 views

Sanity Checking mod_rewrite for Apache 2.2 on Ubuntu 12.04

Summary: I'm testing a simple catch-all rewrite rule. It doesn't seem to be taking effect, it's not being logged and I'm not getting any errors. I'm a junior server administrator trying to gain a ...
0
votes
0answers
228 views

how to supervisord logs to syslog

I am using supervisord to manage my process. Say process A, I log to /data/log/A.log and I setup logrotate. Now, I need to pipe to syslog which automatically pipes to r syslog. Should I edit ...
0
votes
1answer
18 views

how to prevent log if request matches in Apache

i'am trying to remove some request from Apache logs. for example, if the request match "RunJobs&tasks=jobs" i am trying to use SetEnvIf Request_URI "(RunJobs&tasks=jobs)" dontlog CustomLog $...
4
votes
1answer
136 views

Best practice for application logging database replacement

Our web apps (30 or so) log application specific stuff to a centralized logging database (Sql Server 2012) with log4net, so the logging database gets huge quickly. Thus we decided to replace it every ...
2
votes
2answers
301 views

Postfix connected to Load Balancer, how to turn down connect/disconnect messages in mail.log

We have a few Postfix servers connected to our F5 Load Balancer which checks for a connection on port 25 every couple seconds to the servers to make sure it's available. Unfortunately this creates ...
1
vote
0answers
49 views

Can iptables log all type of tcp connection?

Can iptables log tcp Split-Handshake and Simultaneous-Open connections as well as tcp Three Way Handshake? Here is these two kind of tcp connection descriptions. Here I find how to log new tcp ...
3
votes
1answer
258 views

overriding nginx access_log directive - duplicate log entries

I'm using the default nginx package on Ubuntu 14.04 server. It is using /etc/nginx/nginx.conf as the main config, and then includes configs from /etc/nginx/conf.d/*.conf and /etc/nginx/sites-enabled/*....
1
vote
2answers
448 views

What rule can I use in ModSecurity to log POST payload for a specific site?

I need to inspect POST payload for a specific website (the server is rather busy and I wouldn't turn on POST logging for the entire server). The server is LiteSpeed 5.0.7. SecRequestBodyAccess is set ...
2
votes
2answers
84 views

Increase precision of apache 2.2 log timestamp to include microseconds

A similar question was already asked on StackOverflow but there was no helpful answer given and I think it fits better here. I need to log the microseconds or milliseconds of the first response time....
0
votes
1answer
1k views

How can I get haproxy to log to systemd/journald?

I have a current generation Linux system I'd like to use with haproxy. Journald will happily log stdout from .service, and mark the log as coming from that service, but haproxy doesn't seem to be able ...
0
votes
2answers
306 views

Apache 2.4 unusual logs

since some days, i am getting some tries of hack attacks, but actually all seems fine. but i saw some log i could not explain: 127.0.0.1:443 216.218.206.66 - - [09/Oct/2015:04:49:29 +0200] "GET / ...
0
votes
1answer
302 views

IIS 8.5 not logging all requests

I'm having an issue where IIS 8.5 on Server 2012 R2 is not logging requests properly. It was working fine up until about a week ago - producing log files >10mb. This information was useful for our ...
1
vote
1answer
180 views

Logging TLS version used by clients connecting to Apache

Recently in the news was an announcement that the PCI standards in the UK will outlaw the use of TLS1.0. Unfortunately, this means that we're going to have to stop using TLS1.0 on our web servers for ...
0
votes
1answer
88 views

How to clear or stop net-snmpd.log?

System: 3.10.17-gentoo NET-SNMP version: 5.7.3.pre5 ps ax: /usr/sbin/snmpd -p /var/run/snmpd.pid /etc/conf.d/snmpd: #SNMPD_FLAGS="${SNMPD_FLAGS} -Lsd -Lf /dev/null" /var/log/net-snmpd.log: ...
0
votes
0answers
39 views

Logging Simultaneous Open Connection Establishment With Iptables

Simultaneous Open Connection Establishment: TCP is also set up to handle the situation where both devices perform an active OPEN instead of one doing a passive OPEN. This may occur if two clients are ...
1
vote
1answer
18 views

Change MySQL “lob_bin_trust” variable definitely

I've seen this topic earlier, but it doesn't fit in my needs. Is there anyway to set variable "log_bin_trust_function_creators" definitely in my system, except specifying it on mysql initiation (...
0
votes
0answers
18 views

Odd PUT requests in apache logs

I got a few domains hosted from an Apache server. I've had this setup for a while without much problems. However, since about a week I've began to receive strange PUT requests for one of the domains: ...
0
votes
1answer
319 views

How to provision dashboards into kibana?

I am giving my developers the gift of kibana using the elasticsearch that is bundled with logstash. They will have kibana in their vagrant boxes. Goal: Install and configure kibana dashboards via ...
0
votes
1answer
59 views

PAM standard macros and logging on CentOS7

According to the D(x) macro defined in pam_macros.h (source code) and used as follows: D(("Hello PAM World")); Where is this log located on CentOS7? Note that I am using as flag debug in my pam.d ...
1
vote
1answer
103 views

Window Logs - Is any event logged when a user overwrites files? (Win Server 2012 R2)

Is any event logged when a user/process overwrites files? (Win Server 2012 R2)
1
vote
0answers
215 views

How can I separate logs with rsyslog from a remote location for devices using the same IP?

I have a number of Yealink SIP phones at different locations that I am trying to centralize log collection for. I have set up a CentOS server at my main location with rsyslog. I am forwarding all ...
1
vote
0answers
43 views

Easily create a logcheck rule from a log message?

I’d like to more easily create logcheck rules from log messages. Ideally I’d like to have something set up such that I just take a logcheck message I receive, and pipe it to some tool, and it spits ...
1
vote
1answer
432 views

HAProxy not logging all requests

I've setup a HAProxy on Ubuntu 14.04 running a seperate backend server also on Ubuntu 14.04 and Apache2. When performing requests not all those requests are logged. Even when running HAProxy in debug ...
0
votes
0answers
14 views

When are AWS VPC logs restarted?

If I have AWS VPC Flow logs enabled. I can execute the command aws logs get-log-events --log-group-name <log-group> --log-stream-name <stream> --region us-west-2 And it spits out the ...
0
votes
1answer
437 views

Using WDS, where are the log files located on the CLIENT trying to capture an image?

I'm trying to create a capture boot image for my client machines. I have the Win7 (x64) capture image loaded in the WDS server and it boots to the WDS Image Capture Wizard with no issues. I hit ...
1
vote
1answer
1k views

PostFix sending delay, many “(queue active)” messages in log

We use postfix on a CentOS server to accept incoming mail, then do some filtering, then send the message on to our real mail server where we will pickup the mail. The postfix server sometimes has ...
1
vote
1answer
445 views

How to set up IAM Role Permissions for VPC CloudWatch logs?

I am trying to allow aws to start my log service, and I have my log streams, and log groups added already. When i got to my VPC dashboard, the status of the Flow Log I'm interested in says: Access ...
2
votes
1answer
26 views

Can Apache Access Logs be kept separated & also combined as well too?

My question may be a bit confusing, and sorry for that. Here is what i need: Well, i have (let's say) 3 Websites hosted on one Apache (which are defined inside each VirtualHost settings. Then i ...
0
votes
0answers
11 views

Which `Log group` do I select when in AWS `CloudWatch Management Console`?

I am trying to view my logs from aws command line interface, but I am unable to discover what is a log group. I followed the documentation for CloudWatch. However, nowhere in those instructions ...
1
vote
0answers
318 views

Audit trail for all actions taken with admin privileges

PCI DSS 10.2 says, "Implement automated audit trails for all system components to reconstruct the following events:" and 10.2.2 continues, "All actions taken by any individual with root or ...
0
votes
0answers
207 views

phpmyadmin doesn't log access

I just wanted to install fail2ban also for phpmyadmin as described in another post. Then I found out that phpmyadmin doesn't log access on my apache. I installed phpmyadmin as follows: apt-get ...
0
votes
1answer
57 views

Rsyslog logging to rolled log instead of unrolled log

Forgive me if I am vague, but I am trying to keep this as secure as possible. I have a CentOS server setup as a central remote logging server. Servers have been sending their logs to this server for ...
1
vote
1answer
96 views

How to configure aws in order to get log events?

My question has two parts: - How to get log events? The command line tells me that I need to configure aws... - How to configure aws? I try to get log events by doing the following: sudo aws logs ...
1
vote
1answer
582 views

Where to get proper `region name` and `output format` for AWS configuration?

I'm trying to get log events via my aws server. I log into the server as usual, and then I enter the following command: sudo aws logs get-log-events --log-group-name <myLogs> --log-stream-...
0
votes
0answers
79 views

Windows PrintService Operational Log. Which Tray?

I am a software developer but I have come here to ask an Admin type question. I have turned on the Windows PrintService Operation log to see what print jobs are being printed via Applications and ...
0
votes
1answer
1k views

How do I capture unique id in haproxy logs?

I'm trying to capture the unique id for each request in my logs. I thought I could use capture request header X-Unique-ID len 16 on the header but its not working. Any suggestions? global log /dev/...
0
votes
1answer
47 views

Unable to log into a rsyslog filter using logger [duplicate]

Ubuntu 64 14.04 comes with rsyslog (7) built-in. I've added test.conf to /etc/rsyslog.d with the following line: :syslogtag,isequal,"test" /var/log/test.log I then restart rsyslog and log ...
0
votes
0answers
14 views

LOG server - attack on my site? [duplicate]

have a problem. 3 days ago somebody clean my server, but I do not know how. My server support sent me to mail with LOGS: Friday Aug 21 03:55:47 2015 0 78.47.143.141 388 /home/stopmy/ftp/mark/site.htm ...