Recording activity on the system (or of a particular program) for later reporting and analysis. Logins, logouts, web server page requests, etc might all be logged.

learn more… | top users | synonyms (2)

1
vote
1answer
944 views

X-Forwarded-For not showing up in tomcat7 access log

I'm trying to print out the remote client IP on a tomcat running behind an ELB and for some reason it's not being printed out to the access log. my elb configuartion is : 80 -> 8080 443 -> 8080 ...
2
votes
1answer
80 views

Forwarding structured data with rsyslog

We have a Java application logging structured data (MDC with log4j) via syslog to rsyslog (7.6.3) on localhost. localhost should then forward these log messages to a central logging host (also running ...
0
votes
0answers
12 views

rsyslog syntax error on non existent line

I get a syntax error message for my rsyslog configuration file at line 61. But my configuration only got 60 lines. I checked the last line in my configuration and it seems correct since it is the ...
-3
votes
1answer
28 views

How do you restart logging after deleting an NGINX log? [on hold]

I deleted my NGINX log because it was very large, thinking that NGINX would automatically create a new one in its place. It didn't, and now I don't have logs. The file was previously located at ...
0
votes
5answers
275 views

How to concat rotated logs back together

How to concatenate the rotated logs back together to make the original file? huali-access.log huali-access.log.15 huali-access.log.21 huali-access.log.28 huali-access.log.34 ...
-2
votes
0answers
14 views

mail log error (dovecot - postfix -amavis) and spam folder config [on hold]

Im having some trouble to filter mail error logs (Mail Server - Postfix - Dovecot - Amavis -ClamAV - SpamAssasin). Right now i can see my logs in the "/var/log/mail.log" file. Is there anyway to get ...
0
votes
1answer
27 views

nginx log entries out of sequence, possible to fix?

I have an nginx log parser which relies on fact, nginx log entries placed in sequential order. But from time to time I have log like this: [2015-07-01T08:41:59-07:00] https "GET ... ...
0
votes
2answers
17 views

rsyslog (local) and remote logging

I have several linux servers that I want to monitor the log files. I thought it would be great to setup a central log server that can capture incoming rsyslog packets. Each hostname would have its own ...
0
votes
0answers
12 views

logger not logging to remote rsyslogd instance

I am running CentOS 7.0.1406 with rsyslogd 7.4.7 and logger from util-linux 2.23.2. I have two machines connected via a switch. When I try to use logger to log from one machine to the other, nothing ...
1
vote
2answers
988 views

nginx with real_ip — log both client remote_addr and proxies address

I have an nginx instance set up behind multiple load balancing proxies, and I am using real_ip to get the clients IP address in remote_addr for processing by my Python application. However in my logs ...
3
votes
6answers
42k views

Are there any RDP activity logs? - Windows Server 2008 R2

a few users have logged into a server through RDP. I would like to monitor activity, but do not know my way round Windows Server that well. I am hoping there are logs of some kind around that I can ...
1
vote
2answers
179 views

nginx access.log only kept for a day

I'm using goaccess on Ubuntu Server 12.04 to view my analytics on my web server. I just run the following utility: goaccess -f /var/log/nginx/access.log However I'm only seeing one days worth of ...
0
votes
1answer
317 views

GoAccess analytics and HTTP Referer

This is a high-level question regarding using goaccess as a tool for website analytics. I have it set up on an nginx server and parsing the logs just fine, but it seems that many requests to my own ...
0
votes
2answers
21 views

What would be a portable nignx HTTP access log format to use with nginx?

I am looking for a way to store that logs in a common format so they can easily be recognized and parsed by most tools. I am interested about a format that is automatically recognized by goaccess ...
0
votes
0answers
15 views

Using goaccess to figure out cause of increased traffic

I have an Ubuntu server hosted by Linode. A few days ago I got a notification that my Disk IO rate was higher than normal. I am trying to determine what they root cause of this is and whether I need ...
0
votes
0answers
8 views

Pfsense firewall log format and packets data length

In pfsense firewall logs there are many fields described here: https://doc.pfsense.org/index.php/Filter_Log_Format_for_pfSense_2.2 I would like to get some statistics from these logs about traffic, ...
0
votes
0answers
19 views

Logrotate: Error creating outfile, file already exists

I run logrotate in a daily cron, today I got an e-mail about a file already existing error: error creating output file path/to/search.log.2014-10-03.1412289722.gz: File exists But I'm not sure why ...
1
vote
1answer
23 views

Can the ETW Provider: Microsoft-Windows-IIS-Logging be installed on a Windows workstation?

I'm attempting to use Microsoft Message Analyzer version 1.3 to perform a live trace on an IIS 8.5 server. I'm an admin on my Windows 7 workstation and the target server. Each remote provider I want ...
0
votes
1answer
1k views

Cisco ASA 8.2 - 106015 (Deny) and 106100 (Permit) Logs for the Same Packet

I'm seeing traffic from numerous internal endpoints where a RST or FIN/ACK is sent by the endpoint to a host on the Internet. These connections are related with a transparent proxy that is not ...
0
votes
0answers
15 views

How to send rsyslog to graylog? [on hold]

Hi I have just configured GrayLog Now I want to transport my Linux-Client log to GrayLog. How can I do that? I tried with allowing TCP:514 in /etc/rsyslog.conf and on the client I have added this ...
10
votes
2answers
4k views

No more logging after upgrade to Debian Wheezy

Syslog, auth.log, kern.log and messages log files are not updated anymore after upgrading to Debian Wheezy (Debian Squeeze was previously running). How could I fix it?
0
votes
0answers
19 views

How to set IIS Logging to best fit this scenario

I need to monitor a IIS 7 App Pool (WCF is running on it) and I would like to read messages like: Request A Received. Pool is down. Starting Pool. Request B Received. Pool going up. Request C ...
19
votes
7answers
40k views

Is there a proper way to clear logs?

I was wondering if there was a proper way to clear logs in general? I'm new to Ubuntu and I'm trying to set up Postfix. The log in question is /var/log/mail.log. I was wondering if there was a ...
22
votes
1answer
5k views

Get notification from supervisord when a job exits

Is there any way supervisord can automatically restart a failed/exited/terminated job and send me a notification email with a dump of the last x lines of log file?
0
votes
0answers
21 views

How to set the correct file permissions for custom logging with Apache 2? [duplicate]

I am trying to set custom logging for a particular web application (Apache 2.4.7 on Ubuntu Server 14.04). In the .conf file I added the following: CustomLog "|/usr/sbin/rotatelogs ...
1
vote
1answer
37 views

Import IIS Advanced Logs into SQL

I'm using IIS 8.5 Advanced Logging and also logging some custom HTTP headers. How can I import the raw logs into SQL on a regular basis (i.e. every minute)? I want to avoid the overhead of ODBC ...
1
vote
3answers
4k views

Specifying a log name for screen output without relying on .screenrc

In a bash script, I use "screen -L" to log executed commands in color. For example : screen -L tree Then we read logfile with less -R. When this script is executed, other screens are ...
4
votes
5answers
2k views

Appending output to a file at the same time truncating it to N lines

I'm trying to find a simple way to append/write to a log, while at the same time keeping it the log trimmed to a reasonable size. I would prefer to not just append files forever, and then have to have ...
-1
votes
1answer
162 views

huge traffic from POST 123.249.24.233/POST_ip_port.php

222.186.129.5 - - [19/Jun/2015:16:56:28 +0000] "POST http://123.249.24.233/POST_ip_port.php HTTP/1.1" 301 184 "http://123.249.24.233/POST_ip_port.phpAccept: */*" "Mozi$ 222.186.30.111 - - ...
1
vote
0answers
13 views

sles/opensuse os installation log

Is it possible to keep installation log off all events, tasks, say running commands, etc.. while installing SLES/openSUSE (or maybe another linux)? It's not a problem lookup info in already running ...
0
votes
1answer
31 views

Redirecting syslog facility to other facility

I have a syslog server, which separates logging informations according to hostnames. It can separate messages if it's in the 'local1' facility. I have a mail server, which sends messages to the ...
0
votes
1answer
1k views

Setting up Splunk/IronPort WSA

I recently stumbled across Splunk 4 (by way of an advert on this very site...) and found that it had an "App" that's designed to work with Cisco IronPort WebSecurity and E-Mail Appliances! That's ...
3
votes
3answers
2k views

How do I disable command line history in Linux?

Right now, I'm aware that for all commands typed into the console, the Ubuntu system logs it somewhere. How can I disable logging of unix commands for all users?
6
votes
8answers
6k views

how to write a script that only acts on new log entries

I feel like this should be a simple thing but I am having a hard time figuring it out. I am trying to write a script that will monitor one of the apache log files and take some specific action. But ...
0
votes
1answer
919 views

Compress and remove logs from jboss on linux with cron

I need to compress and remove log files after some time from serwer. I have never write scripts before. So far i have script logs.sh: #!/bin/bash LOGS=/usr/local/jboss/server/default/log/ ...
0
votes
0answers
16 views

fail2ban stops logging after some time (3-4 days)

I've noticed that whenever I want to see fail2ban logs after 3 or 4 days of being working, it compresses the logs to .gz which Im fine with that: -rw-r--r--. 1 root root 90034 May 1 12:49 ...
2
votes
4answers
2k views

Akamai log processing

I'm digging through Akamai logs, downloading excel sheets, and then manually joining them so that I can do sorting of data to find top videos and referrers. Are there any tools you know of to help ...
0
votes
1answer
21 views

Syslog-ng reverse dns lookup for data fields

I would like to try a reverse-dns before storing the firewall logs. I know this is possibile in logstash but i don't know if syslog-ng can be configured to do the same. Actually my logs coming from ...
0
votes
0answers
8 views

How to log only certain result/status codes with Squid?

By default Squid logs all access information including 'successes' and 'failures'. I'm interested in logging only 'failures'. In other words, I want to do something like log only Squid DENIED result ...
0
votes
1answer
30 views

Logstash matching ceph client and server separation

So I have a fresh logstash install and I am trying to deploy logstash to get a handle on the logs. I am going through and will eventually segment the logstash filters based on subsystem and ...
1
vote
2answers
3k views

IIS Advanced Logging Forward to Syslog

I am looking for a method that would allow us to forward the IIS Advanced Logging logs to a centralized log source via syslog or something similar. We are able to perform this currently for the ...
0
votes
0answers
17 views

Log network traffic from a specific process

I would like to track all the network traffic coming from and to specific processes. I don't need very detailed information, more like the total data volume, protocols, ports and addresses. Something ...
0
votes
1answer
2k views

SFTP logging in Solaris Server using 'internal-sftp'

I'm trying to enable logging for SFTP file transfer (without help of any opentools) on solaris 10 using "internal-sftp" but couldn't see any info about file transfers. Please help. **#Argument in ...
3
votes
0answers
25 views

iptables on openwrt router: logging connections to a host from clients on the same subnet [migrated]

I am trying to setup an auto wake-on-lan setup using my router that is running OpenWRT 14.07, Barrier Breaker. My idea is that the router monitors any connection attempts to the host I want to wake up ...
5
votes
2answers
14k views

nginx / php-fpm error logging

I'm trying to figure out where the PHP errors are going in my setup. I'm running nginx as the reverse proxy to PHP-FPM, but I'm not seeing the various E_NOTICE or E_WARNING messages my app is ...
0
votes
2answers
1k views

fedora tomcat log file path

My log file is inside: kamil@localhost tomcat$ grep "logs/" ./* ./log4j.properties:log4j.appender.R.File=${catalina.home}/logs/tomcat.log my CATALINA_HOME is kamil@localhost tomcat$ sudo grep ...
-1
votes
2answers
23 views

How do I get a simple non-reload logging toggle switch for Apache?

On a development server, I'd like to turn logging on only when needed for specific debugging operations. One way I can think of is Apache checks for the existence of certain dotfile somewhere and ...
1
vote
1answer
22 views

Possible to have FQDN in Debian Logfiles?

Is it possible to have instead the hostname the fqdn inside debian log files? Example: Now its: Mar 2 18:00:12 www rsyslogd: [origin software="rsyslogd" swVersion="5.8.11" x-pid="2442" ...
1
vote
2answers
178 views

Ubuntu 14.04.2 LTS - RSysLog 8.8.0 - omusrmsg not working

I have been trying for two days to get RSysLog to alert all [or specified] users of certain Facilities/Priorities hitting RSysLog. rsyslog.d/50-default.conf: ... *.emerg ...
0
votes
0answers
70 views

View PHP error logs on VM - Vagrant CentOS via Puphpet

I have a Vagrant VM running CentOS, which was built from a puphpet file (config.yaml), and I'm trying to get the PHP error logs setup and accessible. config.yaml - PHP section: php: install: '1' ...