New answers tagged log-files
In bash, if the extendedglob option is set (it is by default), you can negate a glob pattern by wrapping it in parentheses and prepending a bang (!). For example, !(*.gz) matches all items whose names don't end with .gz. See the Pathname Expansion subsection in the EXPANSION section in the bash manual page for more information. In zsh, if the extglob option ...
If the filenames have anything else in common - e.g. length of name, number of periods in name, name ending... you can simply adjust your glob. If not, there are some other ways: tail -f `ls -l /var/logs/myLog* |grep -v .gz$` or, using xargs: ls /var/logs/myLog* | grep -v .gz$ | xargs tail -f
Usually tail -f /var/logs/myLog*log will work. However, if the end of the filenames is unpredictable, and really the only way is to exclude files ending in .gz, it becomes more complicated. One possibility is this: ls /var/logs/myLog* | grep -v .gz$ | xargs tail -f
No, it's far from enough. Intrusion detection is much larger topic then simple /var/log/(auth.log|secure) parsing. Also, remember that logs can be manipulated with, so in case someone has got root account on your machine, it's game over. Those situations are avoided by having central syslog server, and shipping logs there. That way attacker modifies only ...
Start by asking ARIN using the WHOIS tool (it's in the upper right corner) http://whois.arin.net/ui They'll point you to the right affiliate (APNIC or RIPE) if it's not an American IP. You'll either get the Company name (and maybe a Point of Contact, although those are usually outdated) that owns the IP or the name of the ISP hosting the site. I've also ...
Use LogStash, which has native support for multiline entries.
This is controlled through the use of "Parameter Group" settings. 1) In the RDS dashboard, go to "Parameter Groups" 2) Create a new parameter group, make sure the "Group Family" is set to postgres9.3, name it whatever 3) Go back to "Parameter Groups", select the newly created group and then "Edit Parameters" 4) Set "rds.log_retention_period" to whatever ...
If you are referring to the SonicWALL Secure Email Gateway Virtual Appliance this is how you get to the log files (I am guessing you want the SMTP transaction logs): Log in as admin user Click System | Advanced About 3/4 down the page you will find Download System / Logs All sorts of things are there. You will be looking for the MlfAsgSMTP.log or ...
it's the web proxy autodiscovery protocol... (http://en.wikipedia.org/wiki/Web_Proxy_Autodiscovery_Protocol) Did you setup any weird dns records (specifically *.something.tld) that would point to 127.0.01? why it is coming from 127.0.0.1 .... Try running netstat -punta | grep 127.0.0.1:80 see if you can track down the process on the webserver making the ...
You can check the full list of HTTP request methods in RFC 7231. An attacker was probably assessing what your web server does with an invalid request.
Top 50 recent answers are included