Recording activity on the system (or of a particular program) for later reporting and analysis. Logins, logouts, web server page requests, etc might all be logged.

learn more… | top users | synonyms (2)

1
vote
1answer
192 views

Access log of nginx: why are foreign URLs logged?

My access log is full of such entries: 178.207.40.219 - - [03/Apr/2014:17:34:37 +0200] "GET http://win.mail.ru/cgi-bin/auth?Login=nutyck@bk.ru&Domain=mail.ru&Password=241716 HTTP/1.1" 403 168 ...
0
votes
1answer
717 views

make nginx not log “no user/password was provided for basic authentication” in error logs

I've added password protection to a lot of my domain via nginx by adding: auth_basic "Restricted"; auth_basic_user_file /usr/ssl/htpasswd; to the nginx vhosts. I log all errors ...
0
votes
1answer
59 views

How to log mail client with Dovecot / Postfix

Does anyone know if it's possible to have Dovecot or Postfix output the mail client of a user? In Dovecot's variables list, I cannot find anything in that direction.
0
votes
0answers
176 views

Logparser - Getting average response time from microseconds

I have one month's worth of web server log files in the following format: #Fields: date time cs-uri-stem cs-uri-query c-ip cs(Referer) sc-status sc-bytes time-taken 2014-03-12 17:34:02 ...
0
votes
2answers
102 views

How do I see if user connected to mysql over ssh tunnel?

I imagined command last, would also give me mysql over ssh tunnels list. But I was wrong. Is there a place where this tunnels are logged? Ubuntu server 12.04.
0
votes
1answer
45 views

%systemdrive%\windows\temp deletion rules

What are the rules for which the files in %systemdrive%\windows\temp are removed? I am not referring to rules that System Administrator add to system. I am referring to the built-in processes that ...
0
votes
0answers
115 views

Tomcat 7 log file date format

Tomcat7 log entries use a date format: Mar 30, 2014 11:50:32 AM How do I change it use the format: 2014-03-30 11:50:32 This would make it much easier for Zabbix to parse the log file for ...
1
vote
1answer
181 views

How do I configure Linux to log when ulimits are hit?

For example, say I'm hitting nproc. I would expect a log message to appear /var/log/messages or similar, but it looks like that needs to be configured. How do I do that? I can't find anything relevant ...
0
votes
0answers
39 views

Apache microseconds logs

So, I'm trying to understand how the apache microseconds log format is working - I configured a custom log for my apache vhost including %D for microseconds and from my tests it seems that is working ...
3
votes
3answers
602 views

Parseable NGINX accesslog files with delimiters

The default NGINX format is this: log_format combined '$remote_addr - $remote_user [$time_local] ' '"$request" $status $body_bytes_sent ' '"$http_referer" ...
0
votes
0answers
71 views

Rsyslog with Nginx virtual hosts

I have an Nginx server with several virtual hosts, each of them generating log files. I'm sending all these logs to a remote server but don't know how to create one log file per virtual on this ...
3
votes
1answer
82 views

How can I configure IIS to save log files in a given folder without creating a W3SVCXXX folder under it?

You can configure IIS to save its logs in any folder you want; however, even if you configure this setting at the site level, it will always create another folder under the one you choose, called ...
0
votes
0answers
11 views

How can we log file download successes and failures from IIS7?

We have a dedicated server: IIS7 Windows Server 2012 R2 Standard This servers sole use is to serve files ~120MB in size. We're looking for the simplest way to log how many downloads were: ...
1
vote
2answers
162 views

Excluding clients from web logs?

Is it possible to exclude certain IP addresses from Nginx's access.log, for example where lots of the requests come from a monitoring server?
2
votes
2answers
137 views

How to log remotely without syslog

I have a bunch of logs which are not created using syslog. I would like to export them to another host. If possible using syslog or rsyslog. A pipe? how can I do that?
1
vote
1answer
2k views

Troubleshooting intermittent Apache 400 Bad Request errors

I'm trying to debug an issue in my app and looking for suggestions or troubleshooting tips. My app consists of a mobile app submitting data over HTTPS to apache (which is using mod_proxy to forward ...
1
vote
0answers
156 views

IIS 8 logging stops at midnight UTC

I have one IIS 8 server where the w3logsvc dies at midnight UTC (we're Central Time, so we're UTC -6). I have to manually start the service to get it back running again. I have the logging set to use ...
1
vote
0answers
42 views

“\xc2:\xc2” in HTTP proxy GET request

Recently I came across lines like these in an HTTP server's access_log (I've changed the real image to "someimage.jpg" - you can browse the images folder directly since directory listing is allowed, ...
0
votes
1answer
81 views

Analyze tons of Apache logs

I'm having an issue analyzing Apache logs - because there's a ton of them. Like first 5 days of March have resulted in about 50Gb of log files ( uncompressed ). How to analyze these? What tools to ...
1
vote
2answers
75 views

Rolling log file without losing any log event

I have an 8GB file called php.log with a running php script logging into it. It is important for me that I log every event, and I want to compress it and empty the current file without stopping the ...
0
votes
2answers
263 views

How to Change sysstat/sar logging folder

I have just enabled sysstat on one of my servers (Ubuntu 12.04), I have noticed it is logging all to /var/log/sysstat/sa04 /var/log/sysstat/sa05 /var/log/sysstat/sar04 How can I change the sysstat ...
0
votes
2answers
196 views

Not getting anything written to my log files in ubuntu

I am not getting any logs in auth.log, kern.log, syslog or any other log files on my 12.04 ubuntu server. There is also no rsyslog.conf if it should be there by default. rsyslogd is not running as ...
-1
votes
1answer
32 views

Disabling sentbox in postfix over Squirrelmail

I have installed POSTFIX over Squirrelmail on CentOS Linux... The services I have ran are: service httpd service ssl service mysql service postfix service saslauthd service dovecot I have ...
1
vote
1answer
76 views

Rsyslog: stopping after 1047 file descriptors opened on a centralized log server using TCP

We have heroku drains dumping to 1 log server. There are a lot of instances (~100) sending their logs to this server using TCP. The Server filters the logs based on hostname and puts them into a ...
0
votes
1answer
78 views

Snort logging mode - How to define subnets

I am using snort to log all traffic on an interface snort -i eth1 -l /interface/log/dir -b -U -m 112 With this command I manage to get ALL data which makes my log files very large. Is there any ...
1
vote
1answer
235 views

Will changing IIS Advanced Logging config restart app

I am using the IIS Advanced Logging module on a production server running IIS 7.5. I need to change some of the settings (specifically, which fields are logged) and cannot find anywhere that ...
0
votes
1answer
665 views

Compress and remove logs from jboss on linux with cron

I need to compress and remove log files after some time from serwer. I have never write scripts before. So far i have script logs.sh: #!/bin/bash LOGS=/usr/local/jboss/server/default/log/ ...
1
vote
1answer
228 views

Logcheck alternative for central syslog server [closed]

I have to setup some open source log monitoring on a centralized syslog server. A lot of machines (windows, linux) and some routers and switches sending their logs there. Many years ago when I had to ...
3
votes
1answer
412 views

What are the drawbacks to using mod_log_rotate and rotatelogs.exe together?

On Microsoft-based platforms, are there any drawbacks or hidden pitfalls to using rotatelogs.exe for ErrorLog directive(s) and allowing mod_log_rotate to handle CustomLog directives for rotation? As I ...
0
votes
1answer
65 views

Apache CustomLog for WSGI server is not filtered by LogLevel

I have a WSGI server which is served by an Apache proxy. I would like to have a log file dedicated to that server, so I added the following to the VirtualHost declaration: LogFormat "%h %l %u %t ...
1
vote
1answer
109 views

Using OSSEC HIPS alongside rsyslog, overkill?

I have been tasked to harden our company linux servers. One of the problems that was outlined was the fact that logs are stored on the server which poses two problems: Difficult to aggregate and ...
5
votes
4answers
98 views

sshd logging attempts to login without a private key

On my VPS, running Debian 7, I have ssh enabled on the default port 22 with only private key authentication enabled, all other ports are filtered with iptables. I am frequently getting login attempts ...
1
vote
1answer
565 views

rsyslog udp forwarding truncates at 2048 characters

Rsyslog on a RHEL 6 server is receiving messages locally on port 514 UDP. These messages are sometimes much larger than normal syslog message sizes. I am seeing rsyslog handle all of the messages ...
1
vote
1answer
81 views

IIS FTP server- log of file names transferred

The log files for my ftp server on iis 7.5 show DataChannelOpened and Closed events, but do not log what actual file was transferred. Is it possible to find this out, or add it to the logging?
1
vote
3answers
421 views

Is this a security breach?

I have a server running Ubuntu 10.04LTS (I know it is too old), which over the last couple of weeks has on occasion been unresponsive to network traffic, and needed a hard reset first thing in the ...
0
votes
1answer
922 views

ElasticSearch Multiple Indexes and Routing

Currently I have the following setup. Syslog --> Logstash --> ElasticSearch --> Kibana Logstash is creating a daily index ...
-1
votes
1answer
100 views

Could anyone explain the logs from my IPMI

my server is suffering freezing these days. I thought it was software problem. Then I found something strange from server log 113,System Event,02/12/2014 11:16:50 Wed,Memory,,Assertion: Memory| Event ...
0
votes
0answers
568 views

How do I log the true client IP with Apache's CustomLog and the X-Forwarded-For header?

I am currently logging the contents of the X-Forwarded-For header using a CustomLog declaration in Apache. The problem is that every proxy and load balancer along the request path will add its IP to ...
0
votes
0answers
23 views

Advanced Windows Firewall - Strange logging behavior

I have created a GPO that set's several firewall rules to Windows Server 2008 R2 machines within a specific OU. The default behavior is set to block on inbound and outbound on all profiles. Also I did ...
1
vote
1answer
236 views

How to configure remote IP address audit logging for VPN clients on a Cisco 2801

We have a Cisco 2801 that also acts as a VPN Server for Cisco VPN Client. We would like to configure IP address logging so that each time a user connects using VPN we would like to log his IP Address. ...
3
votes
1answer
260 views

How can I log a message to the systemd journal from the command line?

Reading Where does logger log its messages to in Arch Linux?, it seems that syslog() messages and the 'logger' command line app only talk to the systemd journal if a socket for message forwarding is ...
4
votes
1answer
355 views

Why my nginx server receives requests targeting ads.yahoo.com?

I have a nginx proxy facing public internet. A few days ago, I started to receive a torrential amount of requests, targeting URLs that are invalid for my domain. An excerpt from nginx access.log: ...
0
votes
0answers
14 views

Changing an Apache CustomLog configuration line from within a conf.d file?

My Apache 2.2 httpd.conf file contains the following line: CustomLog logs/access_log common I want to instead use: CustomLog logs/access_log "a different log format that I prefer" But I only ...
0
votes
1answer
111 views

mysql.slow.log is not created even though it's configured in /etc/my.cnf , what could be the reason?

This is the relevant section from /etc/my.cnf: [mysqld] slow-query-log = ON long_query_time = 2 log_slow_queries = /var/log/mysql-slow.log The problem is that file is ...
5
votes
2answers
1k views

Cannot find upstart logs in syslog despite a log-priority of debug (ubuntu 13.04 & mint 16)

I've set upstart log level to "debug" sudo initctl log-priority debug But I still cannot see anything in /var/log/syslog. sudo initctl emit hello # no log sudo initctl start my-broken-service # ...
0
votes
0answers
119 views

Understanding parse, bind, execute entries in PostgreSQL logs

I am new to PostgreSQL logging and have a few questions. PostgreSQL is used as a database for a couple of comercial products (both on the same server). This is run on a Windows 2008 R2 server (as I ...
0
votes
0answers
45 views

rsyslog.conf only partly honored

I followed this description on how to enable audit for Samba (entry of Aug 10, 2009) and wanted to get all additionally enabled logging in a special log file (/var/log/samba/log.audit). The mentioned ...
2
votes
2answers
1k views

Block bots by their Java referrer or User-Agent string?

I have been getting a lot of web hits in my logs that crawl most top level pages of my site and show a referrer as a Java version. I see different variants of the Java versions in the referrer, i.e. ...
0
votes
1answer
10 views

Get referrer of requests currently listed by status module

Our server has on normal time 20 request/second, which can be seen constantly on server-status (status module) Sometimes we have 800 requests/second, and all these requests are shown on ...
1
vote
1answer
43 views

How to log both HTTP and HTTPS requests to the same file

Using recent Apache on Linux. It's inconvenient to have the two different kinds of requests sent to two different log files since I like to watch the log file scroll by live via the shell. I also ...