Recording activity on the system (or of a particular program) for later reporting and analysis. Logins, logouts, web server page requests, etc might all be logged.

learn more… | top users | synonyms (2)

0
votes
1answer
1k views

Log Rotation Causing nxlog Failure

I'm using nxlog to watch two vCenter log files on a Windows Server 2008 system and I have a very simple config to ship messages to Logstash. Nxlog began failing yesterday after a file was rotated. ...
1
vote
3answers
1k views

Best tools for “ssh tail -f” style log file monitoring and analysis

I'm looking for a tool to monitor custom PHP Error logs/Apache and possibly Java logs on remote development servers. I'm not looking for a full production log system like Splunk, but something that's ...
0
votes
1answer
18 views

How to view dnsmasq client MAC addresses dynamically?

If I have already known the client IP, I know there's /var/log/dnsmasq.log and it contains logs such as Jun 13 12:22:42 dnsmasq-dhcp[499]: DHCPACK(wlan0) 172.24.1.110 34:12:98:11:80:bd ones-iPad ...
0
votes
1answer
1k views

Logstash: Failed to flush outgoing items

First of all, I'm a total newbie to logstash. Despite the fact that I've managed to achieve some basic logging (trying to parse an apache log file without the build in COMBINEDAPACHELOG). However, I ...
0
votes
1answer
33 views

How to diagnose process at 100% CPU without being able to shell in?

Given an Ubuntu 14.04 server setup on a popular VPS provider hosting a single website with Nginx, Apache and WordPress / PHP, after starting the server it works fine for a while. Days later the VPS ...
0
votes
1answer
20 views

Can I edit a “live” log file?

I want to mark some log entries for a web server log file. Is it possible to do this while the file, possibly simultaneously, gets new entries added by the server?
0
votes
0answers
15 views

Rsyslog output in GELF

rsyslog is powerful, but its docs aren't that explicit. I can't figure out how to parse a log file and route it directly to Graylog in GELF format. I have found bits of documentation about outputing ...
0
votes
0answers
14 views

Tracking filesystem changes in runtime

I need to have program that tracks changes made to the file e.g. when I am installing software from supplied installer instead of packages. I do not want to checksum every file in filesystem because ...
4
votes
1answer
1k views

How do I increase the logging level for Puma?

Currently I am only getting ActiveRecord and view-rendering output in my Rails application log file, since I switched to Puma from WEBrick. I haven't been able to find where I can modify the output ...
0
votes
1answer
2k views

How to forward arbitrary files to graylog2 with rsyslog

I have some random files that I would like to collect and forward to my logging server. These are applications that don't really support GELF, so I am trying to forward these files with rsyslog: # ...
0
votes
0answers
8 views

Streaming wireless router's logs [closed]

I am trying to set up a WLAN consisting of wireless routers at my families homes in multiple states to an AWS VPC. Are wireless routers capable of streaming, batch processing or otherwise able to ...
0
votes
0answers
12 views

Can I rotate/truncate a single logfile in PostgreSQL 9.4?

I want to setup my test PostgreSQL instance in a VM so that is logs queries to a single file (postgresql.log), which is rotated every hour. Using examples from the docs, I've added the following to ...
-1
votes
0answers
7 views

How to output progress indicator in a better way for vagrant?

I've the provisioning vagrant script which is downloading certain assets using wget and curl, however when it's doing it (vagrant provision), it displays a lot of information into standard error (red ...
0
votes
0answers
13 views

auditd - Getting only EXECVE in ausearch?

I'd like to use the auditd daemon to log whatever is run as or by root on our servers. To that effect, I added the following lines to /etc/audit/audit.rules: # Log all commands run as (or by) root -a ...
0
votes
0answers
8 views

Haproxy log in with more precision

Using Haproxy, is there a way to log Tq/Tw/Tc/Tr/Tt values (HTTP mode) with more precision? (or in different units than milliseconds, e.g. in microseconds)
0
votes
0answers
12 views

HAProxy - How to raise the log level of responses with status code above 400

Here's my sample configuration: frontend www-http bind *:80 acl status_error status ge 400 http-response set-log-level err if status_error default_backend www-backend backend www-...
2
votes
5answers
10k views

What is the best tool for to capturing Windows Event Logs centrally?

We have a collection of about 100 Windows 2003 and Windows 2008 R2 domain controllers that I would like to start capturing Event Log data from. Many of the servers are very busy and generate large ...
1
vote
3answers
547 views

preventing log_on_success in xinetd

I'd like to prevent a particular xinetd check from logging START/EXIT messages as it's a lot of logging I don't need. Is ther a way to set log_on_success = NONE or something? I'm able to find ways of ...
4
votes
1answer
1k views

Separating java stdout and stderr with systemd and without filling journal

I am running java apps via systemd: [Unit] Description=test service [Service] Type=simple EnvironmentFile=/etc/sysconfig/testserver WorkingDirectory=/opt/testserver ExecStart=/usr/bin/java -jar /opt/...
0
votes
1answer
16 views

Logstash Grok Filter

I'm sure there is a simple solution to this but I'm new to working Logstash. The filter I'm trying to apply is for some firewall logs and I have a field that will either have a single or two values ...
1
vote
2answers
2k views

X-Forwarded-For not showing up in tomcat7 access log

I'm trying to print out the remote client IP on a tomcat running behind an ELB and for some reason it's not being printed out to the access log. my elb configuartion is : 80 -> 8080 443 -> 8080 ...
0
votes
1answer
1k views

Setting up Splunk/IronPort WSA

I recently stumbled across Splunk 4 (by way of an advert on this very site...) and found that it had an "App" that's designed to work with Cisco IronPort WebSecurity and E-Mail Appliances! That's ...
1
vote
1answer
50 views

systemd-logind spams in log

In /var/log/auth.log appears too many messages "Removed session" Jun 2 17:42:39 srv-1 systemd-logind[13785]: Removed session c36006. Jun 2 17:42:39 srv-1 systemd-logind[13785]: Removed session ...
0
votes
1answer
31 views

mongodb logging entire document occasionally even with verbosity lowest

We are using mongodb version 3 in a AWS environment with Linux AMIs. Initially mongo was logging the entire document. We then lowered the verbosity in the yaml. That seemed to make most (99%) of the ...
8
votes
3answers
17k views

Where is “/var/log/messages” on mac-osx?

When you read the man pages on Mac OS X, there are references to /var/log/messages, but if you look for the file, it doesn't exist: $ ls -l /var/log/messages ls: /var/log/messages: No such file or ...
1
vote
0answers
20 views

Awstats shows no operating system

I have AWStats running for two applications and for both no operating system is displayed. Instead only "unknown" is shown (100%). All the other stats are interpreted correctly, only the operating ...
0
votes
0answers
51 views

“Index Patterns: Please specify a default index pattern” in Kibana

I'm trying to create a simple hello world for ELK and be able to see kibana reports via the internet. I've installed kibana, logstash, nginx and elastic search. Here's my /etc/logstash/conf.d/10-...
34
votes
2answers
20k views

How do I find out the W3SVC number of a given IIS7.5 website?

I have a server running multiple websites under IIS7.5. I want to view the log files for one website in particular. In C:\inetpub\logs\LogFiles I see a number of folders, W3SVC1 through 6. How do I ...
0
votes
1answer
1k views

Compress and remove logs from jboss on linux with cron

I need to compress and remove log files after some time from serwer. I have never write scripts before. So far i have script logs.sh: #!/bin/bash LOGS=/usr/local/jboss/server/default/log/ INFOLOG="...
0
votes
2answers
25 views

Multiple readers on a Unix Domain Socket?

I was hoping to have multiple clients reading from /dev/log (rsyslog and a custom tool) which I understand is a unix domain socket. How can this be achieved?
6
votes
4answers
6k views

How to Enable IPtables TRACE Target on Debian Squeeze (6)

I am trying to use the TRACE target of IPtables but I can't seem to get any trace information logged. I want to use what is described here: Debugger for Iptables. From the iptables man for TRACE: ...
0
votes
0answers
10 views

Logging NAT translation errors on Cisco IOS router? (port scanning, bogus 'established' packets)

We have a NAT setup with port mappings to internal Webservers and DNS servers. If someone tries to connect, say, to port 22 (SSH), then those packets are dropped simply because there is no static NAT ...
0
votes
2answers
15 views

How to direct errors from with a find exec command to a log file

Hi I have the following command that does yui optimizations and runs as a cron job. I want to log the output of the command to a log file. find . -type d -exec bash -c "cd '{}' && pwd &&...
5
votes
1answer
1k views

Apparmor denies ntpd access to its own logs

ntpd complains that it cannot access its own logs # ntpd -qgddd ... 11 Sep 16:23:00 ntpd[7262]: can't open /var/log/ntpstats/peerstats.20130911: Permission denied ... 11 Sep 16:23:01 ntpd[7262]: ...
0
votes
1answer
17 views

rsyslog ignoring settings file

changing the /etc/rsyslog.conf has no effect for my rsyslog. After changing the settings I call service rsyslog restart and it starts up without any problems. I for instance tried commenting out all ...
7
votes
2answers
10k views

how to filter rsyslog messages by tags

I have several applications and scripts that I want to redirect the output to custom files. I launch those applications using command | logger -t TAG I would like to filter these messages based ...
-1
votes
1answer
52 views

How to tell if auditd has suspended logging?

If you put the following in your auditd.conf, auditd will suspend logging when you have 50MB or less space on your disk: admin_space_left = 50 admin_space_left_action = SUSPEND How can an external ...
0
votes
3answers
2k views

Finding outbound connections from Apache/PHP

A client website was recently compromised, and we're analyzing the damage and exposure from the attack. We've found a script that is "calling home" to a URL we can easily find in a log, but is this ...
0
votes
0answers
26 views

set log level for 404'ed requests in nginx

I am analyzing my server log via journalctl: journalctl --since '24 hours ago' -p err and there are a lot of error messages from nginx for the simple reason that someone requested an invalid/not-...
0
votes
0answers
20 views

Odoo: reopen log files for external logrotate

We'd like to use logrotate (the standard tool, not Odoo's configuration parameter) to manage rotation of odoo.log: that usually means having the application close and reopen its log file in order to ...
4
votes
8answers
69k views

Are there any RDP activity logs? - Windows Server 2008 R2

a few users have logged into a server through RDP. I would like to monitor activity, but do not know my way round Windows Server that well. I am hoping there are logs of some kind around that I can ...
4
votes
2answers
1k views

Auditctl - filtering out cron messages

Im using auditctl and get a lot of logging events for crond. I do not wish to log any cron/crond events. node=127.0.0.1 type=CRED_DISP msg=audit(1405678801.149:5571): user pid=1757 uid=0 auid=0 ...
22
votes
4answers
40k views

How to find error messages from Linux init.d/rc.d scripts?

In Linux, I've written some scripts to be executed during boot and played around with the various ways of installing them. For larger scripts I'll put in /etc/init.d and link the appropriate /etc/rc.d/...
1
vote
2answers
6k views

Haproxy not logging requests?

So, I configured Haproxy so the logging would go through rsyslog and, for now, be all dumped in one file. It's definetly logging, as I get those "starting" messages on startup, but no HTTP requests ...
0
votes
2answers
34 views

Rsyslog pull tools or strategy

I would collect the log(in particolar auditd but also other syslog log) produced by several linux server in a centralized syslog server installed in a linux server. I would configure the centralized ...
0
votes
0answers
7 views

General purpose monitoring and alerter [duplicate]

I sometimes have a need to automatically get notified when some events happens... I'm looking for some suggestions of application to use for this (Operation System isn't important). Requirements ...
0
votes
0answers
54 views

IIS 7.0 Advanced Logging: Is 1 Log File per Website Possible?

We currently have normal IIS Logging enabled with the "One log file per: Site" option selected, allowing each website to have its own log files. I just set up IIS Advanced Logging and cannot find a ...
0
votes
0answers
23 views

Hiding apache internal dummy connection on local ip address, not loopback

TLDR Hide in apache logs only the "Internal dummy connection" entries. My problem Apache 2.4, CentOS 7. For some reason the infamous internal dummy connection is coming from my own local IP ...
1
vote
2answers
30 views

I erased haproxy.log with old content but this file hasn't appeared again

I have a load balancer with HAProxy in Ubuntu 14.04. I did all configurations for turn on log and it works well. However, I erased haproxy.log file and that hasn't appeared again. Can someone help me? ...