Recording activity on the system (or of a particular program) for later reporting and analysis. Logins, logouts, web server page requests, etc might all be logged.

learn more… | top users | synonyms (2)

0
votes
1answer
15 views

Central Logging Options - need flat file as well as elastic search

I would like to have ephemeral ec2 instances push logs to a central flat-file store for archiving and manual perusing, as well has have that data pushed to elastic search. Is there a single agent ...
0
votes
1answer
1k views

Setting up Splunk/IronPort WSA

I recently stumbled across Splunk 4 (by way of an advert on this very site...) and found that it had an "App" that's designed to work with Cisco IronPort WebSecurity and E-Mail Appliances! That's ...
3
votes
5answers
8k views

Wireshark filter to only capture Incoming Packets?

I am trying to setup a Filter (so my log files aren't massive) that will capture only incoming traffic. I have looked on http://wiki.wireshark.org/CaptureFilters but so far have been unable to find a ...
0
votes
0answers
10 views

Solaris run rsync after logadm

I'm trying to get this logadm configuration running. '/dir1/*/*/alert*.log' -C 8 -c -s 10m -t '$file_%Y-%m-%d' -z 0 -a '/usr/bin/rsync -qp /dir1/*/*/alert*.gz ...
1
vote
2answers
5k views

Cisco login on-failure using syslog doesn't show username on failure?

interesting issue I am running into. I am trying to get syslog rmeote logging working with a Cisco switch. i have it working and logging for both on-success and on-failure. However when it is a failed ...
0
votes
2answers
25 views

logrotate not workig as expected

I am setting up logrotate & realized that a few of the options are either incorrectly explained/understood. My logrotate rotate 52 keyword is creating 52 files of the same log every time it ...
2
votes
1answer
7 views

Does AppEnforce.log really log the context used for installation incorrectly?

I have a deployment type with the following attributes: Technology: MSI Installation behavior: Install for system Logon requirement: Whether or not a user is logged on Installation program ...
0
votes
0answers
7 views

Log specific info from request in Apache

I need to login whether X-PDONE-SESSION-ID come on each request being made to my server or doesn't. First I have enabled mod_forensic_log and I setup this at my virtual host logging: <VirtualHost ...
0
votes
1answer
20 views

What is this error in apache error.log

What is this error in apache error.log and how to fix that problem?: [Sat Jul 25 09:23:11.961977 2015] [proxy_fcgi:error] [pid 4448:tid 140445816444672] [client 127.0.0.1:57067] AH01068: Got bogus ...
0
votes
1answer
8 views

Which log file can I use for server port analytics?

Ideally I'd like to use piwik to track conversions from ads to server connections on port 5000 and port 5001 but I highly doubt that is even possible. I'm willing to settle for [ipaddress,time ...
1
vote
0answers
5 views

fluentd modular configuration

Is there any way to setup fluentd/td-agent in a way that it's configuration will be modular? I know there is @include directive but this works only if every time I add something new I modify main ...
1
vote
1answer
12 views

Audit Logs for Environment Path Changes

Something (or someone) keeps changing our environment path variables on several of our servers. I have the Audit Policy (under local sec pol) set to Success, Failure for all but Process Tracking ...
0
votes
1answer
36 views

How can I log a linux command's process tree?

I'm trying to track the usage of a certain command so I want to log its parents (to see what is actually using it) Solaris has "ptree" which would be pretty easy to parse and log: # ptree 4198 4198 ...
1
vote
0answers
25 views

Event Log trigger configuration for scheduled tasks not working despite working with the eventviewer

I'm trying to start a task that gets triggered by specific events. The XML configuration for the filter I'm using is the following: <QueryList> <Query Id="0" Path="Security"> ...
0
votes
0answers
6 views

centralized logging when clients have an intermittent connection

I'm working on a project where we'd like to monitor remote embedded clients running Ubuntu Trusty. We are planning to start by just centralizing critical and error log messages on one cloud server. ...
3
votes
4answers
5k views

Nginx not logging PHP errors

When accessing some PHP scripts on my website, I'm getting the dreaded 500 error message. I'd like to know what's wrong to fix it, but Nginx isn't logging any PHP errors in the log file I have ...
-1
votes
0answers
16 views

Ubuntu logger with delayed flush [on hold]

Is there any good logging tool in Ubuntu that meets requirements: Console-based Collects data in memory to be flushed to user-defined logs on disk with delay, for example, 5 sec. I.e. not to "kill" ...
3
votes
2answers
1k views

Shorewall: logging to custom file

I am running an Ubuntu Server 14.04 system with a shorewall firewall. Shorewall is essentially a front end to iptables, and it is iptables that does the logging via Netfilter (my understanding so ...
1
vote
2answers
3k views

IIS Advanced Logging Forward to Syslog

I am looking for a method that would allow us to forward the IIS Advanced Logging logs to a centralized log source via syslog or something similar. We are able to perform this currently for the ...
0
votes
1answer
25 views

Logs during rpm installation

I'm able to obtain logs in /var/log/message while installing a package using yum, but I'm not able to find logs when a package is installed using rpm. Is there any option to log rpm ...
0
votes
2answers
93 views

How to best monitor/log problems on eth0?

I have manually configured an email server - very simple config and I have done no fancy networking. I simply opened up only the relevant ports via iptables. Once every 10-15 days however, eth0 ...
0
votes
1answer
955 views

Compress and remove logs from jboss on linux with cron

I need to compress and remove log files after some time from serwer. I have never write scripts before. So far i have script logs.sh: #!/bin/bash LOGS=/usr/local/jboss/server/default/log/ ...
6
votes
2answers
15k views

nginx / php-fpm error logging

I'm trying to figure out where the PHP errors are going in my setup. I'm running nginx as the reverse proxy to PHP-FPM, but I'm not seeing the various E_NOTICE or E_WARNING messages my app is ...
3
votes
3answers
12k views

Where is the login history for Windows XP?

Does Windows XP keep a log of the login and screen locking events? If so, how can I view it?
0
votes
0answers
24 views

how to set up logging-files ubuntu 14.04

Im having some trouble to correctly configure my mail logs. How can i configure the following needs? I have a mail server and the log result should be 7 different files mail.sunday, mail.monday, ...
3
votes
3answers
5k views

Separate Nginx access log file for certain requests only

As far as I can see Nginx supports by default 2 log files: error_log (tracks issues related to the Nginx server itself) and access_log (tracks requests processed by Nginx). Whilst it is possible to ...
0
votes
1answer
3k views

SFTP logging in Solaris Server using 'internal-sftp'

I'm trying to enable logging for SFTP file transfer (without help of any opentools) on solaris 10 using "internal-sftp" but couldn't see any info about file transfers. Please help. **#Argument in ...
0
votes
1answer
34 views

Logging when cisco switch restarts, shuts down, or starts up

Is it possible to log events like restart,shutdown and start in cisco catalyst 3750. Also need to log when a new user is created. I'm forwarding the logs from the cisco switch to the syslog server and ...
0
votes
1answer
27 views

Send user level messages to syslog

I currently have syslog.conf like so to send INFO logs to /var/log/messages *.info;mail.none;authpriv.none; /var/log/messages; I have an application that uses python libraries LOG_USER facility to ...
0
votes
1answer
29 views

Event viewer missing logs following unexpected reboot

One of our Server 2012 boxes lost power unexpectedly recently. We're still not sure how it happened, but given its suddenness I suspect someone in the data centre tripped over a power cable. I went ...
0
votes
1answer
28 views

How to find out what is being accesed in Apache logs

I am managing a dedicated server with hundreds of websites, in which there is a main log for Apache. The server has spikes in Apache CPU usage once every 4 or 5 hours and after a review I found in ...
0
votes
0answers
17 views

Fetch logstash-forwarded auth logs from elasticsearch database

In my logstash-forwarder, i have configured to ship /var/log/auth.log messages under the files section as, { "paths": [ "/var/log/syslog", "/var/log/auth.log" ], ...
0
votes
2answers
1k views

fedora tomcat log file path

My log file is inside: kamil@localhost tomcat$ grep "logs/" ./* ./log4j.properties:log4j.appender.R.File=${catalina.home}/logs/tomcat.log my CATALINA_HOME is kamil@localhost tomcat$ sudo grep ...
0
votes
0answers
6 views

How to log any connection request from statically banned IPs with shorewall?

So I'm banning IPs with shorewall drop IP. How do I get shorewall to log connexion requests from those IPs ?
0
votes
1answer
937 views

CSF Log Watching

I run suphp so the uid of scripts is for the user not the webserver. My log files are also in /home/$user/logs/error.log CSF only monitors /var/log/apache2/error.log However because of my setup i ...
1
vote
1answer
30 views

Constant server pings

I've got a Python/Django app hosted on Heroku, monitored on New Relic, with logging tracked on Logentries. I've noticed a large amount of logs that are of the form: at=info method=HEAD ...
0
votes
0answers
13 views

prevent rsyslog to duplicate logs

my rsyslog writes on secure and on messages i have this *.info;mail.none;authpriv.none;cron.none /var/log/messages authpriv.* ...
5
votes
3answers
3k views

Security Log in Event Viewer does not store IPs

I'd like to write a service that pulls Event Viewer records, specifically from the Security log. Of particular interest to me are things like event id 4625 (audit fail) messages. Ideally I'd like ...
0
votes
0answers
37 views

Acount Logon events not getting on domain controller

We have windows domain running with 2012R2 DC, We have enabled logging through GPO for all member servers and DCs, but I dont see any Account logon/logoff events (4624/4634) being logged, neither on ...
-1
votes
2answers
962 views

Analyse a set of User-Agent strings

I have a list of User-Agent strings and timestamp. I also have a unique identifier for the user. What is the best tool for analyzing this type of data?
0
votes
1answer
944 views

Log Rotation Causing nxlog Failure

I'm using nxlog to watch two vCenter log files on a Windows Server 2008 system and I have a very simple config to ship messages to Logstash. Nxlog began failing yesterday after a file was rotated. ...
0
votes
3answers
42 views

How to make a cron script for cleaning up a log file? [on hold]

I don't usually do this kind of stuff, so I just have to ask. How do I make a script which checks a log file, lets say it's named log.txt, grabs everything but the first 100 000 lines from it to a new ...
2
votes
2answers
9k views

How to make Tomcat 7 log debugging info?

Tomcat 7 takes more than 21 minutes to start: ene 09, 2013 10:01:39 AM org.apache.catalina.startup.Catalina start INFO: Server startup in 1290787 ms When it finishes it says that it's scanning JARs ...
1
vote
2answers
600 views

tail -f not following log file in Docker container

I am seeing some strange behavior running the tail -f command inside a Docker container in CoreOS. There are a number of variables I can think of that may be contributing to the problem but I am not ...
4
votes
1answer
19k views

Apache: Configure “LogLevel debug” for certain modules only?

I want to debug some authentication & authorization issues on my webserver, particularly with mod_authnz_ldap and other mod_auth* modules. So I set LogLevel debug in the Apache configuration, ...
1
vote
1answer
994 views

X-Forwarded-For not showing up in tomcat7 access log

I'm trying to print out the remote client IP on a tomcat running behind an ELB and for some reason it's not being printed out to the access log. my elb configuartion is : 80 -> 8080 443 -> 8080 ...
2
votes
1answer
96 views

Forwarding structured data with rsyslog

We have a Java application logging structured data (MDC with log4j) via syslog to rsyslog (7.6.3) on localhost. localhost should then forward these log messages to a central logging host (also running ...
0
votes
0answers
26 views

rsyslog syntax error on non existent line

I get a syntax error message for my rsyslog configuration file at line 61. But my configuration only got 60 lines. I checked the last line in my configuration and it seems correct since it is the ...
-3
votes
1answer
34 views

How do you restart logging after deleting an NGINX log? [closed]

I deleted my NGINX log because it was very large, thinking that NGINX would automatically create a new one in its place. It didn't, and now I don't have logs. The file was previously located at ...
0
votes
5answers
288 views

How to concat rotated logs back together

How to concatenate the rotated logs back together to make the original file? huali-access.log huali-access.log.15 huali-access.log.21 huali-access.log.28 huali-access.log.34 ...