Recording activity on the system (or of a particular program) for later reporting and analysis. Logins, logouts, web server page requests, etc might all be logged.

learn more… | top users | synonyms (2)

-1
votes
0answers
5 views

IDS (or similar) to query ELK logs and send alarms on strange situations

I have an ELK stack (that receives logs from mostly web services,web applications). I'd like to deploy something that take that logs as input and sends alarms when attacks are detected (stupid ...
0
votes
0answers
3 views

Logging in IIS 7.5/8.0

I have an IIS 8.0 Server setup running ASP .NET applications. In addition to the normal logging like, Begin Request, End Request, Requests /Sec, etc., I also want to log some perfmon counters like ASP ...
0
votes
1answer
15 views

How to monitor/log wireless events including failed authorization attempts?

Is it possible to log wireless events including failed authorization attempts? I have two access points and also would like to see, which one is serving which client and see when client is connected ...
0
votes
1answer
257 views

Method request in nginx

my Nginx report in error log with 2012/07/24 13:00:16 [notice] 19056#0: *3275841 "^(GET|HEAD|POST)$" matches "GET", client: 42.114.191.177, server: _, request: "GET /template/images/loading.gif ...
0
votes
0answers
14 views

How to customize LogFormat for Apache Virtual Hosts?

I really need some help with this. My server has multiple virtual hosts, each virtual host has its access log, I need to be able to customize the LogFormat for each virtual host exist on server. I ...
0
votes
1answer
8 views

Graylog ignoring all HTTP logs

I've integrated our PHP web application using Monolog recently and added support for logging into Graylog. Until very recently I've used the Graylog VM and I've successfully logged all the information ...
0
votes
0answers
19 views

cPanel latest visitors log configuration file path [on hold]

I was trying to change the LogFormat for the Latest Visitors stats to report clients' real IPs, but I couldn't find a path for it. I've already modified the LogFormat in httpd.conf file and now the ...
1
vote
2answers
14 views

Modifying LogFormat in Apache

I need to modify the LogFormat in Apache in order to add the X-Forwarded-For header and log clients' real IPs. I attempted to edit that in httpd.conf file but I then found two separate parts for the ...
1
vote
1answer
13 views

Logging data posted to a specific URL in Apache

I have been asked to create a logging solution for an AngularJS application on a large e-commerce site. The solution itself has been created but actual transmission of the log data to the server has ...
1
vote
2answers
36 views

building a SIEM, should I send logs or get them from the gathering machine?

I am working in a Linux environment, I would like to gather all the logs from the machine pool on a unique machine X. There are several log files I need to move and I am not sure about the way I ...
0
votes
1answer
302 views

DL360 G2 SNMP drive failure location

I've got this service call with the snmp information provided below, about the drive failing in HP DL360 G2 server: Error log Event Type: Error Event Source: Storage Agents Event Category: Events ...
0
votes
0answers
7 views

Non-domain log forwarding certificate types

I'm trying to set up a source initiated subscription (Log forwarding) where the event source server is not in the same domain as the event collector server. I'm following these steps. It states that ...
0
votes
0answers
9 views

Access to “Windows Security” logs for “eventlog” group

Security logs are not available for users in eventlog group. I've checked this down to security event log file. eventlog group has all permissions. Unfortunately I cannot add my user to ...
1
vote
2answers
29 views

nginx log when specific referrer is present

Because someone steals content from our website, I need to create additional log file, that logs only if http_referrer contains specific domain. Currently I have this: if ($http_referer ~* ...
0
votes
4answers
247 views

How to concat rotated logs back together

How to concatenate the rotated logs back together to make the original file? huali-access.log huali-access.log.15 huali-access.log.21 huali-access.log.28 huali-access.log.34 ...
0
votes
1answer
12 views

What's in the DNS Debug Log Message Fields

I've enable debug logging options on the DNS server, and I'm trying to parse through the output in dns.log. Here's a guide from technet on how to use server debug logging options, but I can't find ...
2
votes
2answers
96 views

Elasticsearch index much larger than the actual size of the logs it indexed?

I noticed that elasticsearch consumed over 30GB of disk space over night. By comparison the total size of all the logs I wanted to index is only 5 GB...Well, not even that really, probably more like ...
0
votes
2answers
277 views

What is the purpose of elasticsearch logs? How to manage them?

As I understand indexes(or data) are being stored in /var/lib/elasticsearch by default, this folder contains nodes with 0 and 1 folders and overall size of these folders is 376M. The logs are ...
0
votes
2answers
31 views

Is there a way to backup logs to tape without mounting a NAS?

The traditional way to send logs to tape backup as I understand it is to mount a NAS which has the ability to do tape backups (or maybe send to a syslog server which in turn mounts a NAS). Is there a ...
0
votes
2answers
1k views

haproxy logging to syslog

I installed haproxy 1.5 via apt-get on ubuntu 14.04 via ppa:vbernat/haproxy-1.5 as per http://haproxy.debian.net/ The problem is it logging to /var/log/syslog instead of /var/log/haproxy.log The ...
-1
votes
0answers
15 views

Server and tomcat log timings varrying [closed]

All the servers are linux servers and are defined in UTC time zones, but the time in tomcat logs is in GMT. Please let me know how can I sync the timings of both.
0
votes
1answer
1k views

rsyslog relp - preventing remote logs from being written to my local /var/log

I've set up a logging server using rsyslog with relp. It works just fine as far as receiving remote logs and placing them in /var/spool/rsyslog. My problem is: most of these messages are appearing in ...
-1
votes
0answers
20 views

Recommended Storage for Domain Controller Collecting Audit Logs

I am currently working with a customer on getting their Windows audit logs to our SIEM. Since the customer is unwilling/unable to provide hostnames for each host in the environment, I have suggested ...
2
votes
4answers
385 views

Use logger in shell script

How can I use logger in a shell script? If I run ntpd -qnp pool.ntp.org 2> >(logger) in console, it works as expected. If I put it into a shell script #!/bin/sh ntpd -qnp pool.ntp.org ...
-1
votes
2answers
31 views

shell command to find common IPs on a specific url from error_log [closed]

Is there a shell command to group all the most common IPs that requested a specific file via GET (or that came from a url)? For example with this command I can group requests from ip: cat ...
3
votes
0answers
17 views

IIS 7.5 not rolling over logs hourly

I have six IIS 7.5 web servers deployed using a Shared Configuration. The properties for the logging in the configuration are set to log Per Site, W3C, and on an hourly schedule: For five of the ...
0
votes
1answer
1k views

Setting up Splunk/IronPort WSA

I recently stumbled across Splunk 4 (by way of an advert on this very site...) and found that it had an "App" that's designed to work with Cisco IronPort WebSecurity and E-Mail Appliances! That's ...
0
votes
3answers
3k views

AWStats is processing log files but does not display them [closed]

I've setup AWStats on my VPS to get some more insight into the traffic coming to my site. As instructed I ran a manual build/update which ran fine: sudo -u www-data ./awstats.pl -config=example.com ...
0
votes
0answers
84 views

IIS 7 Advanced Logging Filters

I'm trying to separate normal from mobile traffic using Filtering in IIS Advanced Logging, but it is not working. I have one definition with: ('User Agent' Equals '.*android.*') and the "Enable as ...
1
vote
1answer
57 views

Windows Domain Controller Authentication Logon Logging and Forensics

This question does not take Windows Server 2003 and older OSes into consideration. I know that for local logon (event ID 4624) also the logon type is logged (interactive, remote, etc.). Is there a ...
1
vote
2answers
39 views

Access to logs for not root/sudo user

What should I choose to allow staff access to logs on server. For example if I have user webmaster which should have access to /var/log/{mysql,nginx, etc...}, how can I make it? Maybe add group ...
0
votes
1answer
2k views

SFTP logging in Solaris Server using 'internal-sftp'

I'm trying to enable logging for SFTP file transfer (without help of any opentools) on solaris 10 using "internal-sftp" but couldn't see any info about file transfers. Please help. **#Argument in ...
3
votes
2answers
4k views

How to diagnose Internal Server error on Lighttpd?

I have Lighttpd on Centos 5 with Fcgi and Memcached. Periodically, once per week or two i get internal server error 500 and i must manually restart lighttpd to get it to work again. In my lighttpd ...
1
vote
1answer
15 views

What does READ_CONTROL mean in the Security event log?

I have been asked to create audit record of file accesses. By the log is simply overwhelming. A single double click of a text file opening in notepad creates more than 10 log entries with Event Id ...
38
votes
6answers
5k views

The corporate benefits of using MSI files

What are the advantages of using .msi files over regular setup.exe files? I have the impression that deployment is easier on machines where users have few permissions, but not sure about the ...
0
votes
0answers
8 views

Show blocked SMTP connections in Exchange 2010

Currently, I have an anonymous receive connector set up on my Exchange 2010 system that allows from an entire subnet. I'm looking to change this to only allow from specific IPs, but need to know when ...
4
votes
2answers
11k views

nginx / php-fpm error logging

I'm trying to figure out where the PHP errors are going in my setup. I'm running nginx as the reverse proxy to PHP-FPM, but I'm not seeing the various E_NOTICE or E_WARNING messages my app is ...
0
votes
0answers
16 views

How can I detect mail servername used from my clients to my server?

I have a web and mail server with Ubuntu 10.04, Apache 2, courier, postfix, Ispconfig 3 and multiple sites hosted. The clients use mail from Outlook with a config like this: @domain1.com use pop and ...
0
votes
2answers
1k views

fedora tomcat log file path

My log file is inside: kamil@localhost tomcat$ grep "logs/" ./* ./log4j.properties:log4j.appender.R.File=${catalina.home}/logs/tomcat.log my CATALINA_HOME is kamil@localhost tomcat$ sudo grep ...
0
votes
1answer
31 views

Any easy way to find out what process creates files in specified dir?

I have a superuser ssh access to a third-party ubuntu 14.10 box with misconfiguration: some process creates lots of temp files in a dir (and does not clear them, depleting inode limit slowly). Is it ...
1
vote
2answers
2k views

IIS Advanced Logging Forward to Syslog

I am looking for a method that would allow us to forward the IIS Advanced Logging logs to a centralized log source via syslog or something similar. We are able to perform this currently for the ...
1
vote
3answers
20 views

How to grep (or other command?) for first instance to last instance in a log?

How does one grep/search a text file so that the results show the first line with the string, and then every other line until the last line with the string? So, if I have a file that looks like this: ...
1
vote
2answers
2k views

When cron is completed How to get email notification and log in a file (both)

I am a Newbie to linux. I'm trying to figure out things. Can someone kindly help me how to combine these two commands? (1) Normally cron can results can be directed to a log file by editing crontab ...
2
votes
1answer
27 views

What's the purpose of spammy HTTP referers?

In the logs of my website, there's a lot of visits with a HTTP referer set to spam-like websites (usually Russian sites, I've noticed). I assume what they're doing is just using a web crawler to visit ...
0
votes
2answers
928 views

Analyse a set of User-Agent strings

I have a list of User-Agent strings and timestamp. I also have a unique identifier for the user. What is the best tool for analyzing this type of data?
0
votes
1answer
14 views

Understanding syslog conf - targeting specific types / tags of logs

I'm combining log files from several docker containers on my host and sending them a remote logging service. I'm just redirecting the output to logger and tagging it: docker-compose logs 2>&1 ...
0
votes
0answers
24 views

Trouble filtering googlebot from apache access log

Though it seems like it should be pretty straightforward, I have been unable to configure apache so that googlebot's requests are not stored in the access log. I've tried the following lines: ...
0
votes
0answers
16 views

Warnings in Tiger auditing reports (process is listening on socket)

I get email logs like the ones below emailed daily from my server. I don't really know what does it mean and thinking about disabling them, but I guess this is not a good idea and it's better to learn ...
1
vote
2answers
6k views

How to make Tomcat 7 log debugging info?

Tomcat 7 takes more than 21 minutes to start: ene 09, 2013 10:01:39 AM org.apache.catalina.startup.Catalina start INFO: Server startup in 1290787 ms When it finishes it says that it's scanning JARs ...
20
votes
1answer
4k views

Get notification from supervisord when a job exits

Is there any way supervisord can automatically restart a failed/exited/terminated job and send me a notification email with a dump of the last x lines of log file?