Recording activity on the system (or of a particular program) for later reporting and analysis. Logins, logouts, web server page requests, etc might all be logged.

learn more… | top users | synonyms (2)

1
vote
2answers
190 views

Apache logs full URL rather than URI

My Apache web server logged following messages to access.log: 46.22.173.131 - - [23/Dec/2014:15:34:54 +0100] "GET http://pl.wikipedia.org/wiki/Special:Search?search=&go=Go HTTP/1.1" 302 482 "-" ...
36
votes
6answers
4k views

The corporate benefits of using MSI files

What are the advantages of using .msi files over regular setup.exe files? I have the impression that deployment is easier on machines where users have few permissions, but not sure about the ...
1
vote
2answers
4k views

How to make Tomcat 7 log debugging info?

Tomcat 7 takes more than 21 minutes to start: ene 09, 2013 10:01:39 AM org.apache.catalina.startup.Catalina start INFO: Server startup in 1290787 ms When it finishes it says that it's scanning JARs ...
0
votes
2answers
179 views

Unexplained spike in web traffic

Question I am suspicious of an unexplained 1600% increase in traffic and massive slow-down that lasted about 10 minutes. I'm not sure if it was an attempted DoS attack, dictionary login attack, etc. ...
-2
votes
0answers
22 views

log error in centos7 [closed]

I'm just a beginner in linux base opreation system. I delete a log folder(log folder and all the sub folder within log folder) under var folder because it take 19GB of my hosting. And here we got the ...
2
votes
1answer
16 views

How to make Ossec aware of logrotate

I installed Ossec in a monitor/agent configuration on a few servers of mine. Everything works greats. The only thing that annoy me is that I keep receiving alerts after logrotate rotates the log I ...
6
votes
2answers
5k views

Nagios vs Splunk

I am looking to implement log tracking at my current company. After some research it seems Nagios and Splunk are the two best options. I was wondering if there is a consensus with which is better. I ...
0
votes
1answer
23 views

Syslog-ng loghost - filter not-match

I've got a problem with receiving remote logs from syslog-ng OSE to syslog-ng OSE. I am configuring loghost and at now - i how no idea what i am doing wrong. It seems like filters are not working for ...
1
vote
3answers
1k views

Mongodb - proper way to rotate logs

Mongo docs say that I can: use -SIGUSR1 signal and get the old log renamed and current switched use logrotate from OS I want the OS's logrotate ability to zip old files and remove oldest, but see ...
1
vote
1answer
22 views

What kind of service is runit's svlogd expecting?

The runit manual states that in the configuration one can use an option to submit logs to: ua.b.c.d[:port] tells svlogd to transmit the first len characters of selected log messages to the ...
1
vote
1answer
2k views

Troubleshooting intermittent Apache 400 Bad Request errors

I'm trying to debug an issue in my app and looking for suggestions or troubleshooting tips. My app consists of a mobile app submitting data over HTTPS to apache (which is using mod_proxy to forward ...
16
votes
4answers
522 views

Need a technique to coerce sysadmins to log the reason for accessing a prod server

My company requires that any time a user logs into a production server the reason that person logged in and the changes the user intends to make must be logged. My team wants to do this, but its easy ...
0
votes
2answers
34 views

Automatic archiving of log files [closed]

I look at my various log files, and I believe the operating system will periodically archive the log by appending a datestamp to it. I've created some custom logs in my httpd.conf file, however, ...
0
votes
1answer
27 views

Centralised log monitoring for linux servers [closed]

I've read several QA on this site about monitoring servers, but I found out, that none of them centralises all the logs I want to watch. To describe my situation: 10 linux hosts Using logwatch to ...
0
votes
0answers
20 views

Logging user and power activity Synology DiskStation (v5)

Is there any practical way of logging user activity and power state changes on a Synology NAS? I'm not looking for anything very extensively detailed, but I would like to log e.g. Video Station usage ...
3
votes
6answers
342 views

How to monitor your “entire” website?

I've perused through the forums here and was wondering what the best practice was in terms of monitoring the status of your "entire" website? (not just the homepage) In terms of priority, if your ...
0
votes
1answer
1k views

Setting up Splunk/IronPort WSA

I recently stumbled across Splunk 4 (by way of an advert on this very site...) and found that it had an "App" that's designed to work with Cisco IronPort WebSecurity and E-Mail Appliances! That's ...
2
votes
1answer
59 views

IIS 6 immediate log flush

In troubleshooting an issue with a web service, I need to examine the HTTP log created by IIS 6 on a Win2003 box. As I'm sure you are aware there is a log buffer that prevents writing to file every ...
2
votes
1answer
1k views

How can I make apache give the config file path and line number for a 403 error

I'm running Apache 2.4.7 on debian unstable. I'm getting 403 errors when I try to run supysonic using the mod_wsgi module. I turned the LogLevel for wsgi and authz_core up to trace6, but I'm still ...
1
vote
2answers
1k views

Convert ISA 2006 MSDE logs to text format?

We have a client running ISA2006 with logs going to MSDE. The MSDE database gets rotated. We have NO control over the client infrastructure. We need to get the logs out to a TEXT file on the server ...
0
votes
1answer
2k views

SFTP logging in Solaris Server using 'internal-sftp'

I'm trying to enable logging for SFTP file transfer (without help of any opentools) on solaris 10 using "internal-sftp" but couldn't see any info about file transfers. Please help. **#Argument in ...
1
vote
1answer
27 views

User blocked in AD by some windroid device

We have a user that is constantly blocked. We checked the logs in the domain controllers and all the information shown is that a WINDROID device is the source. How can I know which device is causing ...
1
vote
1answer
111 views

Show real server name in nginx logs and params passed to fastcgi?

I have configured my nginx vhosts with a regex in server_name. nginx shows the raw regex in logs and in params passed to php-fpm (I know there's $_SERVER['HTTP_HOST'] with a real value, that's not an ...
1
vote
2answers
14 views

Use iptables to log connections except for two addresses

We would like to use iptables to log all network connections except if the connecting address is A.B.C.D or the connecting address is E.F.G.H. These two addresses cannot be combined into a single CIDR ...
0
votes
1answer
888 views

rsyslog relp - preventing remote logs from being written to my local /var/log

I've set up a logging server using rsyslog with relp. It works just fine as far as receiving remote logs and placing them in /var/spool/rsyslog. My problem is: most of these messages are appearing in ...
0
votes
1answer
33 views

Sudo-io log output shows garbled text

We have set up in our servers sudoers config the following configuration in order to log the console output for auditoring purposes Defaults:%administrators log_output Defaults logfile=/var/log/sudo ...
1
vote
0answers
6 views

Log to file in Asterisk: append with newline

(I am testing on Asterisk 11.7.0~dfsg-1ubuntu1) I am using the following format to append to a logfile, according to the documentation: same => n,Set(FILE(/tmp/mylog.txt,,,a)=my-log-message) ...
0
votes
0answers
27 views

Solaris SSH Server Log Destinaton IP Address

To stay compliant, it's required that my Solaris 10 SSH server log the destination IP address in addition to the existing port logging. Is it possible to add the destination IP address in the authlog? ...
0
votes
2answers
914 views

fedora tomcat log file path

My log file is inside: kamil@localhost tomcat$ grep "logs/" ./* ./log4j.properties:log4j.appender.R.File=${catalina.home}/logs/tomcat.log my CATALINA_HOME is kamil@localhost tomcat$ sudo grep ...
1
vote
2answers
2k views

IIS Advanced Logging Forward to Syslog

I am looking for a method that would allow us to forward the IIS Advanced Logging logs to a centralized log source via syslog or something similar. We are able to perform this currently for the ...
0
votes
1answer
56 views

MySQL/MariaDB stops running. How do I find out why?

Today I've seen MySQL/MariaDB stop running on a CentOS VPS. When I check the status I get: # service mysql status ERROR! MySQL is not running, but lock file (/var/lock/subsys/mysql) exists So I ...
0
votes
1answer
870 views

Changing location of ClamAV logging files

I've run into a weird problem with ClamAV that I have been unable to resolve, due to a incredibly non-informative error message. I've installed ClamAV via aptitude on an Ubuntu box (ClamAV ...
0
votes
0answers
14 views

WinServer 2003 R2: Socket Error#10060

So I inherited a legacy in-house application, that is supposed to have printing functionality. However, whenever a user prints, it conks out with the following error, "Message: Socket Error #10060, ...
0
votes
1answer
14 views

Output server and other logs to the browser

I am facing a challenge with my current project.We have it on an ec2 instance and we have a dev and a production server.Now the challenge is,whenever a team member encounters an error on the server I ...
-1
votes
2answers
25 views

How disabled log apache for image file missing?

How can we specify extensions file to filter it in log error of apache? My error.log fills with : [Thu Nov 27 22:42:42 2014] [error] [client 42.42.42.42] File does not exist: ...
0
votes
1answer
56 views

Haproxy not logging requests?

So, I configured Haproxy so the logging would go through rsyslog and, for now, be all dumped in one file. It's definetly logging, as I get those "starting" messages on startup, but no HTTP requests ...
1
vote
1answer
1k views

Excluding some messages from syslog-ng

I'm trying to exclude some messages from being logged by syslog-ng, such as this LDAP log entry: Sep 18 15:18:34 myserver slapd[9682]: conn=1043 op=24 SEARCH RESULT tag=101 err=0 nentries=1 text= ...
0
votes
2answers
1k views

Windows firewall logging. Log file is always blank

I have read many similar articles and posts on how to enable windows firewall logging. I have Win2k8r2 server without any Active Directory, DC, domains and other complicated stuff. Almost all of this ...
1
vote
0answers
23 views

Rsyslog won't monitor mysql-slow.log when written to by mysql

I'm going mad. I'm trying to get rsyslog to send log files to logentries.com. This works perfectly until I try to log mysql-slow.log. The config is pretty simple module(load="imfile" ...
0
votes
0answers
25 views

IIS not logging On Demand App pool recycling

I am unable to get IIS to log on demand app pool recycling. I've followed the directions in this TechNet article: http://technet.microsoft.com/en-us/library/cc753412%28v=ws.10%29.aspx I see entries ...
1
vote
2answers
4k views

Apache httpd: Send error logs to syslog and local disk? Without touching /etc/syslog.conf?

I have an Apache httpd 2.2 server. I want to log all messages using syslog, so that the requests are sent to our central syslog server. I also want to ensure that all log messages are sent to local ...
2
votes
5answers
30k views

Are there any RDP activity logs? - Windows Server 2008 R2

a few users have logged into a server through RDP. I would like to monitor activity, but do not know my way round Windows Server that well. I am hoping there are logs of some kind around that I can ...
1
vote
5answers
2k views

Force Dovecot not to log connect/disconnect messages

My /var/log/mail.log gets constantly flooded with Dovecot connect/disconnect messages like this: Mar 29 18:15:48 summit dovecot: IMAP(foo@bar.baz): Disconnected: Logged out bytes=63/2126 ...
7
votes
2answers
3k views

How can I detect Slowloris?

I'm pretty sure I was under Slowloris attack. I set up an iptables rule to limit max connections to my webserver, but I'd like to know how I can figure out if it really was a Slowloris attack, and if ...
12
votes
1answer
130 views

How do I make sec ignore a timestamp properly

I have a rule that is set up like so; In /etc/sec/rules.d I have; type=SingleWithSuppress ptype=regexp pattern=(\S+) sshd\[\d+\]: PAM \d+ more authentication failures\; logname=.* uid=.* euid=.* ...
0
votes
1answer
72 views

How to exclude a particular domain entry from access.log in squid3 on debian

I have proxy server setup running squid proxy and Squid Cache: Version 3.1.20 on debian, I am doing some log analysis from squid's log file i.e /var/log/squid3/access.log. I dont want a entry of ...
0
votes
0answers
85 views

haproxy logging to syslog

I installed haproxy 1.5 via apt-get on ubuntu 14.04 via ppa:vbernat/haproxy-1.5 as per http://haproxy.debian.net/ The problem is it logging to /var/log/syslog instead of /var/log/haproxy.log The ...
0
votes
1answer
18 views

Logging SFTP activity with auditd

I am currently using auditd to log TTY activity for users that are SSH'd into my system. However, SFTP sessions are not logged in this way. Is there a way to log them using auditd or will I need to ...
1
vote
0answers
150 views

IIS 8 logging stops at midnight UTC

I have one IIS 8 server where the w3logsvc dies at midnight UTC (we're Central Time, so we're UTC -6). I have to manually start the service to get it back running again. I have the logging set to use ...
0
votes
0answers
19 views

sshd log file entries from the past mixed in with currently occurring entries

I have sshd log entries from the past seemingly randomly mixed in (in time) with the presently occurring log entries. No remote hosts log to this server, rsyslog serves only this box. External ...