Recording activity on the system (or of a particular program) for later reporting and analysis. Logins, logouts, web server page requests, etc might all be logged.
1
vote
4answers
442 views
Make sense of SEP11 log entry
I have this log entry from SEP:
2011-04-05T10:52:37+02:00 SymantecServer SomeServer: SomePC,[SID: 23179]
OS Attack: MS Windows Server Service RPC Handling CVE-2008-4250 detected.
Traffic has been ...
0
votes
1answer
25 views
apache access log exclude static files like css|js|png|gif etc
I want to reduce the size of my Apache access log and needs to exclude static files from logging like js|css|xml|png|gif & more.
I am parsing access log to track user activity & website data.
...
0
votes
0answers
17 views
Active Directory Access logging
We are running Active Directory on windows server 2012 and are looking to create a report of users daily usage by logging the login time and log out time of each user.
The aim is to database these ...
0
votes
4answers
91 views
How to automatically clean up date stamped logs
I have an apache web server with various virtual hosts. Each virtual host logs to date stamped files using cronolog. The result is that I end up with a lot of files like this:
----rw-r-- 1 root ...
6
votes
4answers
2k views
Apache access.log interpretation
In the log file of apache (access.log) I find log entries like the following:
10.20.30.40 - - [18/Mar/2011:02:12:44 +0200]
"GET /index.php HTTP/1.1" 404 505 "-" "Opera/9.80 (Windows NT 6.1; U; en)
...
-3
votes
0answers
28 views
How to log VPN traffic? [closed]
I have the following services running:
root 780 1 0 May18 ? 00:00:00 /usr/lib/ipsec/starter
root 782 780 0 May18 ? 00:00:00 /usr/lib/ipsec/pluto --nofork --uniqueids ...
1
vote
4answers
48 views
Rsyslog not logging from remote server
I am trying to set up a centralized log server. I have central server (A) receiving logs via a remote server (B) on port 514. I know it is receiving these. Here are a few entries from a tcpdump on ...
1
vote
2answers
29 views
Is there a way to log all files that are created on a W2K8 server?
I've got a W2K8 server with some IIS apps that are creating a lot of files. I would like to monitor what files are created and how big they are. Is there a tool I could use to log all files that are ...
1
vote
2answers
45 views
Is there a Midnight Commander log or history file?
Sometimes I have to track down user activity on remote machines. Linux audit and messages log are of course a great help; .bash_history is also very helpful, but it's not very verbose as a lot of ...
0
votes
1answer
30 views
Rsyslog: Difference between logging to a UNIX domain socket or an INET socket (UDP)
I am observing the following behaviour when logging to syslog from an external application: if I send a well-formed syslog message to a UDP socket, rsyslog correctly parses it, however if the very ...
0
votes
2answers
34 views
Cleaning log files on Solaris for a service manifest
I have a service manifest on Solaris (Smart OS actually) and I would like to periodically clean its log files either automatically or manually without shutting down the server.
My log is here:
...
-1
votes
0answers
22 views
Extract data information from proxy squid log [closed]
I need to extract data information from proxy squid logs.
I've check out some online scripts to extract data from squid, but first I would like to check with some of your experience if this ...
0
votes
1answer
25 views
Troubleshooting NFS authentication problems
I am trying to mount a krb5p NFS export. For this I have followed these instructions.
Line in /etc/exports:
/home/users ...
5
votes
1answer
806 views
How to maintain the log source host using logstash
I am following the steps in this blog to set up rsyslog + logstash + graylog2 and I can't figure out how to replace the @source_host attribute in logstash using the mutate -> replace filter.
In the ...
2
votes
1answer
1k views
Understanding Zabbix Triggers
I have zabbix set with an item to monitor a log file on a zabbix client:
log["/var/log/program_name/client.log","ERROR:","UTF-8",100]
And a trigger to determine when that log file get's more ...
0
votes
4answers
638 views
Force Dovecot not to log connect/disconnect messages
My /var/log/mail.log gets constantly flooded with Dovecot connect/disconnect messages like this:
Mar 29 18:15:48 summit dovecot: IMAP(foo@bar.baz): Disconnected: Logged out bytes=63/2126
...
0
votes
1answer
895 views
Setting up Splunk/IronPort WSA
I recently stumbled across Splunk 4 (by way of an advert on this very site...) and found that it had an "App" that's designed to work with Cisco IronPort WebSecurity and E-Mail Appliances! That's ...
1
vote
7answers
5k views
PsExec and Remote Environment Variables, Logging, Etc
When I run PsExec on a remote computer, I always fall short of what I want. What I would like ideally in most situations is a) a log on an admin server where each individual log has the name of each ...
3
votes
3answers
1k views
Command to output panic/reboot history in FreeBSD
Many years ago while dealing with a FreeBSD (5.3?) box that randomly panic'ed and reboot (bad memory as it turned out), I came across a command in some forum post that when used would output ...
1
vote
1answer
24 views
Add logging to HTTP server on runtime
Sometimes we have an HTTP server running where you can see that it starts to act out. Without restarting it I want to start to log all HTTP requests.
Are there any tools that allows you to add some ...
1
vote
1answer
30 views
client 157.56.229.87 attempt to invoke directory as script: /usr/lib/cgi-bin/
Ok, so i frequently check my logs and see an array of errors logs from people "scoping the joint" but today i noticed a new one:
[client 157.56.229.87] attempt to invoke directory as script: ...
-6
votes
2answers
57 views
What do the numbers after status code in HTTPD logs signify?
"POST /cgi-bin/test.cgi HTTP/1.1" 200 368 "-" "-" What is the 368? I have also seen 370 and 333 in this log. What do they mean?
1
vote
1answer
21 views
View when IP Address Was Blocked in IIS
We had an issue recently where our server started throwing 500 errors because an IP address was blocked that had already been blocked elsewhere. It -appears- that the IP was blocked on individual ...
1
vote
0answers
37 views
Timzone incorrect for log files only?
I have a small server running centos 6.4 and it is working quite nicely for some time. One thing that still bugs me is that the time in my log files is different then the time the 'date' command ...
0
votes
2answers
50 views
Log PHP-script that take long time to render
I would like to find out, which pages on my server are really slow.
Is it possible to log all pages that took longer than 2 seconds to render in a file?
/var/log/php/php-slow.log
Or could the ...
0
votes
1answer
24 views
Add causing php-script to mysql-slow.log
If you enable the line
log_slow_queries = /var/log/mysql/mysql-slow.log
in
/etc/my.cnf or /etc/mysql/my.cnf
then that will log all queries, that take longer than the setting in long_query_time.
...
1
vote
3answers
3k views
Oracle 9i - delete Archive Logs without any concerns?
I have an Oracle 9i which creates Archive Logs since the year 2007. Can I delete them without any concerns? Or do I need to tell Oracle something before I delete them?
(From time to time I do a cold ...
1
vote
1answer
50 views
View event details in “Events Detail View” in Windows Server 2012
Is there a way to actually view the details of an event in the "Events Detail View" that's provided by the Windows Server 2012 Server Manager?
11
votes
1answer
3k views
How do I find out the W3SVC number of a given IIS7.5 website?
I have a server running multiple websites under IIS7.5. I want to view the log files for one website in particular. In C:\inetpub\logs\LogFiles I see a number of folders, W3SVC1 through 6.
How do I ...
0
votes
1answer
43 views
Parse Apache logfile and ban IPs
My server is under attack, it is flooded with request with the following pattern:
Thousands of IPs
Each IP request the same page "GET / HTTP/1.1" with the same referrer 3-5 times per second (same ...
0
votes
1answer
629 views
How can I filter /var/adm/wtmpx on Solaris 10?
Some of our Solaris 10 servers are monitored using SiteScope, which uses Telnet to probe certain ports (SSH is one of them) every few minutes. This is creating an insane amount of lines in ...
2
votes
1answer
42 views
Multitier server logging
I have a multitier application, consisting of many servers on different subnets (each one of these subnets dedicated for the application purpose they provide with no other servers independent of the ...
0
votes
1answer
115 views
CSF Log Watching
I run suphp so the uid of scripts is for the user not the webserver. My log files are also in /home/$user/logs/error.log
CSF only monitors
/var/log/apache2/error.log
However because of my setup i ...
1
vote
1answer
49 views
How backup files with logrotate and Amazon S3?
I would like to create a new standard of two things:
how long would be generated and be rotated the logs generated by my applications ?
how to transfer the logs to Amazon S3, as a backup server ?.
...
0
votes
1answer
13 views
Tomcat logs web interface
I have several production machines running Java servlets on Tomcat infrastructure.
When I want to look at the logs, I have to remote access the machine with ssh, and manually grep the logs for ...
0
votes
0answers
16 views
Global access log and vhost access logs?
I am running Apache2 with Froxlor, so every customer gets their own access and error log in /var/customers/logs.
Now, is it possible to keep this functionality while also having a global access and ...
3
votes
1answer
130 views
What's causing so many “httpd: <ul></ul>” entries in /var/log/messages?
On a low-powered VPS I maintain, which also functions as a production server, I keep an eye on logs to crisis-manage should a site get an influx of traffic or something goes haywire (tail a bunch of ...
0
votes
1answer
36 views
Cisco asa 5500 series - Logging VPN connections to easily search connection history
We have a fresh requirement to log information to do with vpn connections.
The ultimate goal would be facilitating IT management being able to easily review when someone had been connecting / ...
0
votes
2answers
30 views
centos cron logs are not executed
I have been trying to setup a cronjob on centos but doesn't seems to work. I have been deleting the crons logfile to see all newly created logs and I have been restarting crond but /var/log/conf ...
0
votes
6answers
560 views
Log monitoring and alert utility
Actually we use ManageEngine's Application Manager to monitor some client servers that host Oracle Databases and some JBoss applications. Unfortunately App Manager doesn't work so fast as i wish so i ...
0
votes
2answers
40 views
High Processor Usage
I have a Linode VPS and am getting alerts regarding high CPU usage every few days - a reboot solves the problem - but would rather find the issue.
I'm running Ubuntu 12.10 and other than PHP, MySQL ...
0
votes
1answer
39 views
Review of a crontab script to add timestamps to minutely runs; any suggestions?
I've got a crontab job set to run minutely as such:
* * * * * /home/username/public_html/domain.tld/production/scripts/cron_runner.sh
My goal is to add some timestamps to output from cron so I can ...
0
votes
0answers
12 views
Loading JavaScript with query param triggers mod_security
When accessing http://domain.com/js/scriptaculous.js?load=effects it results in a mod_security warning:
Message: Warning. Match of "eq 1" against "&ARGS:CSRF_TOKEN" required.
[file ...
0
votes
1answer
29 views
Apache vhost-specific logging
I have the following apache setting (in conf.d/owasp-modsecurity.conf):
SecAuditLog "/var/www/vhosts/${lowercase:%{SERVER_NAME}}/statistics/logs/modsec_audit.log"
When I do httpd -t I get the ...
1
vote
1answer
24 views
SQL Server doesn't archive logs
I was just looking over one of oure less monitored databases and noticed that it hasn't archived any logs for over a month. This is what it looks like now. The current log has over 700 000 events and ...
0
votes
2answers
33 views
How planing about backup log files in Linux?
In my company, we have lots of applications running in lots of different servers.
These applications generates lots of logs, which sometimes the developers forgot to compress this logs, this way ...
0
votes
0answers
21 views
Live access logging for many nginx websites
I'm running a couple of dozen sites on a server for a client. This number moves around pretty fluidly as they test ideas and we have a flexible configuration to host things.
The problem comes in that ...
0
votes
1answer
39 views
IIS 7.5 Log Request Processing Time
I am running on a performance issue with ASP.Net 2.0 Application.
A page takes atmost 20+ secs to load in a browser.
I would like to know where the problem is occurring, i.e in browser(rendering) or ...
0
votes
0answers
28 views
IIS Advanced Logging Creating Mulitple Files
Following on the heels of the following question, IIS Advanced Logging Forward to Syslog, I am having a problem with IIS Advanced Logging creating multiple log files per rollover period.
Some of the ...
0
votes
0answers
16 views
Exclude a php file from php5-fpm slow logging?
I use nginx/php5-fpm on my VPS.
I also enabled slow script logging in php5 configuration. I analyze slow logs in periods. However, I have that script which "inteded to be slow". And I want to ...
