Questions tagged [logging]

Recording activity on the system (or of a particular program) for later reporting and analysis. Logins, logouts, web server page requests, etc might all be logged.

Filter by
Sorted by
Tagged with
0 votes
0 answers
6 views

pam_unix logs: xrdp-sesman:session session opened for user USERNAME(uid) by (uid=0)

recently I found a lot of these type of logs: pam_unix(xrdp-sesman:session): session opened for user username(uid=some_uid) by (uid=0) From what I read is xrdp-sesmam-session that is "opening&...
3 votes
2 answers
3k views

Simple web tool for viewing log

I'm developing a server deployment script that installs a bunch of stuff and generates a log in the process. I'd like users of the script to be able to view what's happening, on a web page, in real ...
8 votes
1 answer
4k views

Adding timestamps to supervisord logs

Is it possible to let supervisord add timestamps to the outputs in stdout_logfile and stderr_logfile? I couldn't find it anything about that in the documentation.
1 vote
0 answers
14 views

After creating relying party trust in ADFS, how to validate configuration is correct using SAML tracer

I created a relying party trust in ADFS. To test, I log into IDP, initiate link, select the relying party, enter credentials, then the application page will display. How do I perform this validation ...
2 votes
2 answers
2k views

What is the meaning of these HAProxy configuration lines?

I've seen several examples (see below) of HAProxy logging configuration that all look like this: /etc/haproxy/haproxy.cfg global log /dev/log local0 log /dev/log local1 notice ...
42 votes
11 answers
184k views

Delete all of /var/log?

Can I delete everything in /var/log? Or should I only delete files (recursively) in /var/log but leave folders? Does anyone have a good rm command line? (My admin skills leave me nervous.) Note: I ...
0 votes
3 answers
6k views

/var/log/messages Not Created Although restart rsyslog.service

I use centos7 and /var/log/messages has not worked for a while although I restarted rsyslog.service. Its size was always 0. I then deleted the messages file, and restarted rsyslog again but it was ...
0 votes
1 answer
56 views

Cannot add Kubernetes metadata as label to Loki container logs in FluentBit

I am trying to gather container logs in Kubernetes environment using FluentBit, Loki and Grafana. I would like to append Kubernetes Pod name as label so when I query the logs in Grafana, it would be ...
0 votes
0 answers
30 views

Fluentd tail config for HashiCorp Vault audit/server logs from stdout

I'm trying to figure out a way to get both the audit and server logs from HasiCorp Vault container (both logs go to stdout of the same container and they have a different structure): Audit example: ...
0 votes
0 answers
27 views

Watchguard logs incoming SMTP connections has an dst_user entry. Where can I change this entry?

Hello fellow Exchangers, as mentioned in the title any incoming smtp connection is routed correctly to our onpremise microsoft exchange server and the logs look as described here: https://www....
4 votes
1 answer
887 views

Systemd service not logging

I have a systemd service. No logs appear from it despite my best efforts. This is the service file: [Unit] Description=Load Balancer [Service] WorkingDirectory=/home/lb ExecStart=/usr/lib/jvm/jdk-20/...
8 votes
8 answers
26k views

How to find "growing" files inside a linux system

I have a server that is constantly losing disk space so I reckon there must be some logs that I'm not aware of. What is a good way to locate files that are constantly increasing in size?
0 votes
1 answer
49 views

nginx custom log format to log header value when exists

environment setup I have nginx webserver and simple backend application. this backend app has custom response header in certain condition (for example: X-Real-Status) and it's running behind nginx as ...
0 votes
1 answer
53 views

Nginx not logging after Logrotate

I've a nginx reverse proxy with custom log files (depending on hostname) pwd : /var/log/nginx/domain/fqdn.(log|err) Since some time (maybe after switching to Ubuntu 23.10), my log files are very often ...
0 votes
0 answers
32 views

Looking to monitor activity regarding connection attempts to closed ports on my system, what log file in should i look in? Ubuntu

I'm looking to monitor activity regarding connection attempts to closed ports on my system, as part of a server side portknocking implemetation. However, I am confused about what log file in ...
21 votes
6 answers
51k views

Mongodb - proper way to rotate logs

Mongo docs say that I can: use -SIGUSR1 signal and get the old log renamed and current switched use logrotate from OS I want the OS's logrotate ability to zip old files and remove oldest, but see no ...
0 votes
0 answers
13 views

Where can I find the output of exim's 'debug_print'? -- years later

There is an old thread: Where can I find the output of exim's 'debug_print'? (so yes I did search for existing questions, I did find an exact match , but I'm not allowed to comment + it's ...
2 votes
1 answer
4k views

How to configure nDPI for iptables

I am new to nDPI, I have installed nDPI but when I add rules like; iptables -I OUTPUT -m ndpi --http -j REJECT It shows this error iptables v1.4.7: Couldn't load match 'ndpi':/lib64/xtables/...
0 votes
0 answers
24 views

How to get MariaDB slow query logs to show up on RDS

I have a MariaDB instance on RDS which I would like to enable slow query logs for. Following the documentation, I've created a paramter group which is assigned to the database. When I make changes to ...
31 votes
2 answers
36k views

How do you disable SMB printing support?

I'm running CentOS on a storage server that has to do file sharing for with Windows machines. SMB version is smbd version 3.5.5-68.fc13 I'm getting a lot of error messages in /var/log/messages ...
0 votes
1 answer
155 views

Why rotatelogs from apache produce files smaller than specified max size?

I use the following rotatelogs command from Apache : /usr/sbin/rotatelogs /var/log/somelogfile 1GB If I send 1GB of content to it (for testing), it produces the following files : somelogfile....
0 votes
1 answer
9k views

Event ID 521 - Critical Logging Failure on Domain Controllers

I'm tasked with the monitoring and analysis of variious logs via our SIEM solution; LogRhythm. I noticed a few weeks back that we had large volumes of this event originating from all of our domain ...
0 votes
1 answer
5k views

OpenVPN server dedicated log missing log.conf?

I'm trying to run an OpenVPN server with it's own log, not just writing to the Syslog with everything else. For some reason it looks like you can only set a different log location by using a command ...
0 votes
1 answer
59 views

What IAM permissions are required to change audit log settings in Google Cloud?

In our Google Cloud project, we have granted the following IAM roles to certain users, but they are unable to make changes to the audit log settings. Project Editor Logging administrator When I try ...
0 votes
1 answer
129 views

how can I configure All-in-one WAZUH for log retention?

I installed WAZUH all-in-one no kibana no elastics, and I want to write a code where I can make 40 days of log retention, Any advice or guides for this solution?
0 votes
0 answers
52 views

Changing nginx default log format sometimes doesn't work

I've recently set up fail2ban to work with my custom nginx logging format (called "main"), I have all my sites logging to a different *.access.log file. I still had to change the default ...
2 votes
3 answers
3k views

how can I read old varnish logs?

In /var/log/varnish/ I have some old varnish logs, produced by varnishlog which, due to logrotated, are now in gz format: -rw-r--r-- 1 varnishlog varnish 143068514 Aug 10 23:59 varnish.log.2017-08-...
0 votes
1 answer
66 views

Postfix Log - Get entries for certain mail only

The standard Postfix log Format is something like Feb 4 15:03:53 mail postfix/smtp[31148]: xyz The 31148 seems to be the process id, so this does not necessarily change if I send another mail. At ...
2 votes
1 answer
1k views

Can I control frequency of AWS S3 bucket access log delivery?

I have enabled access logging for an AWS S3 bucket. Now I get log files delivered to my chosen destination. Each file has a name of the form YYYY-MM-DD-hh-mm-ss-guidguidguid with the time representing ...
0 votes
1 answer
108 views

Making Tomcat log in /var/log

I'm trying to make our Tomcat 9 server log its internal log in /var/log instead of ${catalina.base}/logs. I tried to change the destinations in logging.properties, but the logs directory in ${catalina....
0 votes
0 answers
169 views

How to be sure to keep all the logs regarding a MySQL table data but filter Google Cloud SQL maintenance queries logs made by localhost GCP SQL?

I enabled the flag General_log for a Google Cloud SQL MySQL instance to get all the queries logs in Google Cloud Logging. I get all the queries users make, but also all the queries made to probe and ...
0 votes
2 answers
137 views

Syslog-ng multiple filters

I am fairly new to syslog-ng and I have the following issue. I have a Checkpoint firewall that sends the logs to a Splunk server. Due to the huge amount of data sent by the firewall, I tried to filter ...
0 votes
0 answers
29 views

The way of logging at action of controller in Ruby on Rails for debug purpose

I am just trying to know if router is reaching to specific action of controller. In js, we are using console.log and var_dump in php. I tried with puts but it didn't work and I think it's because of ...
5 votes
4 answers
4k views

Forward UNIX syslog to Windows Event viewer

I'm running a pfSense firewall which runs syslog and can forward it's logs to a remote syslog server. I'd like to be able to view these on my SBS 2011 server's event viewer, via a subscription. I ...
4 votes
2 answers
12k views

How to forward windows log using Nxlog to rsyslog server(linux)?

Im using nxlog version 3.0 on WinServ2012 R2 Standard, i can forward the event logs under Eventviewer --> windows logs --> application, system, security. But Im not able to forward other log that is ...
0 votes
2 answers
426 views

Can't get dumpio on Apache 2.4 Oracle Linux 8.6 php 8

I can't get dumpio to log POST request data. httpd.conf: ... Include /etc/httpd/conf/httpd-le-ssl.conf ... No LogLevel or dumpio related stuff in there. httpd-le-ssl.conf: <virtualHost *:443> ...
3 votes
3 answers
1k views

Change format of IIS HTTP Error logging

HTTP.sys by default creates error log files under C:\Windows\System32\LogFiles\HTTPERR. Is it possible to change the format of these log files to include other fields including cs-host and cs-uri-...
9 votes
2 answers
20k views

What should be the right logs permissions for NGINX on CentOS?

on /var/log/nginx/ I have access and error logs. Some are .log errors and others have .gz I think I messed up with the permissions. Some files are created by root/root, other files are created using ...
2 votes
1 answer
737 views

Apache to log only requests generated by PHP

I'm not sure if this is possible, and haven't had any success yet. I'm trying to log page generation times at the web server level and currently have this working for all requests with mod_log_config ...
0 votes
1 answer
80 views

What do these logs mean? Is someone attempting to hack into my server via ssh?

Today I woke up to a a very large number of logs for ssh, and I can only assume someone is trying to gain access to my linux server. Here are the logs -- Logs begin at Wed 2023-08-02 08:59:10 EEST, ...
0 votes
1 answer
50 views

Microsoft Defender: extract Automatic log upload data

Is there a way to extract this automatic log upload table from defender: my goal is to use this information to aid in responding to the System alert: Cloud Discovery automatic log upload error alert ...
0 votes
3 answers
139 views

Exchange Server: Is it possible to find out which user marked an email as read?

We are running a self hosted Exchange 2016 Windows Server 2016 Datacenter. There is a shared mailbox used by multiple users. Users have been told to mark emails in this account only in special cases, ...
3 votes
2 answers
3k views

A linux tftpd server that can log the incoming requests to stdout/stderr

I find it crazy that this doesn't work out of the box, but neither atftpd nor tftpd-hpa seem to have any way to log to the console. I've run them in the foreground with verbosity right up but clearly ...
1 vote
2 answers
675 views

Why would you want to change the log_msg_size from syslog-ng's default of 64k?

Per the syslog-ng admin guide, the log_msg_size defaults to 64k (65536 bytes) However, I have seen some sample syslog-ng config files (like this one) that drop this to <18k (18192 bytes) Why would ...
0 votes
0 answers
26 views

SSH_CLIENT variable bringing the server's IP instead of the client's IP when connecting via SSH

I need to monitor the SSH access logs of an Oracle Linux Server 7.9 to determine which machines accessed this server throughout the day. However, the logs display the IP of the server itself instead ...
3 votes
2 answers
5k views

Use Logrotate to truncate log files after every entry or clear last 'n' entries

i have created a logrotate config file: touch /etc/logrotate.d/.test with the conficurations: /home/myUser/test*.log{ size 0 hourly rotate 0 nocreate nocompress ...
0 votes
2 answers
13k views

CRON opens and closes sessions continuously

I'm seeing a huge amount of these lines in my auth logs: Dec 31 03:45:01 xxxxxxx CRON[17259]: pam_unix(cron:session): session opened for user root by (uid=0) Dec 31 03:45:01 xxxxxxx CRON[17259]: ...
0 votes
0 answers
299 views

Discover process that exhausted my memory and CPU limits on Ubuntu

I have a DigitalOcean droplet running Ubuntu 22.04.2 LTS (GNU/Linux 5.15.0-89-generic x86_64). My website went down at approximately Fri Dec 01 6:48 AM GMT. From var/log/apache2/access.log, I ...
0 votes
1 answer
94 views

Apache LogFormat: what does %f mean?

I have checked the apache logformat from - https://httpd.apache.org/docs/2.4/mod/mod_log_config.html I am not able to understand what does "%f" parameter mean in apache log format. The ...
1 vote
1 answer
9k views

How to configure rsyslog to send multiple logs to a remote server and save them as individual files?

I have some log files inside a directory called log ls -l /var/log/ org1_app.log org2_app.log org1_perf.log org2_perf.log ... Now I set up an rsyslog client on the host server. Here is the ...

1
2 3 4 5
58