Tag Info

Hot answers tagged

5

In the access log you can add the $ssl_protocol variable but this is only going to work with enabled SSL Protocols which is not the case with SSLv3 . With the error log you can modify the log_level to info and you will get information about the SSL Protocol when a connection is aborted: 2015/03/19 09:04:21 [info] 27759#0: *1 SSL_do_handshake() failed (SSL: ...


3

There is no way to both retain auditing capabilities and letting users become root. Instead, grant sudo access to the commands your users need, and log everything. From the sudoers(5) man page: sudoers also supports logging a command's input and output streams. I/O logging is not on by default but can be enabled using the log_input and log_output ...


3

The first and best solution is to simply not allow SSH logins to the root account. As you've found for yourself, this makes it very hard to track who did what. People who should have access to a server should use their own accounts, and then use sudo to perform tasks requiring root access. This is the current best practice for SSH access. You might also ...


3

From the syslog-ng administrators guide (v 2.0, which is old, but what you're using) When a log statement includes multiple filter statements, syslog-ng sends a message to the destination only if all filters are true for the message. In other words, the filters are connected with the logical AND operator. In the following example, no message arrives to ...


3

I would search for some of the excellent answers on http://webmasters.stackexchange.com/ but simply put most people use log analyzers to generate visitor stats. Most log analyzers convert those referers to active links and too many people don't shield their stats pages, so when indexed your spammer gets pageRank At least that was the reason more than a ...


2

You've got all the components you need there - I'm surprised you can't make the jump to combine them yourself. Just change the first command in your first pipeline to the grep at the start of the second one ... grep 'MYURL' /usr/local/apache/logs/access_log | awk '{print $1}' | sort | uniq -c | sort -n | tail -n 20 I don't understand why you would want to ...


2

If the process is still running and still has the file open "lsof" will tell you its process id. If it is more transient, then you might use inotify to let you "pounce" on a file that's just been created: this set of tools has some userspace stuff you can wrap in shell script, and some decent examples. I trust you've tried looking in the files - who knows ...


2

I'm not sure why you think that C:\Windows\Debug would contain such things, but I can assure it doesn't. ACL changes aren't logged by DFS at all, it's just a system of pointers and replication services. If you wanted to track such things, you'd be looking at Auditing. This article describes how to set it up, and although it says it applies Windows 7 and ...


1

Cronjob for both log & email : Run once a month at midnight of the first day of the month: 0 0 1 * * 0 0 1 * * /home/User/script.sh > /home/User/cronlog/`date +\%Y-\%m-\%d-\%H:\%M:\%S`-cron.log 2>&1 ; mailx -s "CronJob is run successfully" someone@domain.com,someone1@domain.com


1

The log is being written to ./var/log/upstart/php5-fpm.log This was ridiculously annoying to find. Thanks to Luigi (in the comments) for pointing this out.


1

Not a solution but a workaround: I have the same problem on CoreOS 607.0.0 and reproduced this problem in containers based on Ubuntu or Fedora. However containers that use busybox do not have this issue. Two workarounds: 1) use a busybox-based container image such as alpine 2) install busybox in your existing container and run busybox tail -F ...


1

In syslog.conf you can only assign an action according to a given facility and level of the message. The tag specified by logger -t [tag] cannot be used for identifying the message by syslog. However you could use -p [facility.level]' option of logger to set custom facility and level, for example: logger -t deviant -p local3.info Then in syslog.conf you ...


1

You can do something like the following: tcpdump -i eth0 -s 0 -w ~/my-traffic-capture.cap -s tells it to capture the full packet which is not the default setting. Replace eth0 with what network interface you want to capture traffic on. You can get a list by running ifconfig. You can view the capture in WireShark. You could also view the capture in a ...


1

No, 4624s are not just for local workstation logons. They also occur on domain controllers. Same rules apply to both local logon and domain logon. The trick is to look at the Logon Type listed in the event 4624. If the event says Logon Type: 3 then you know that it was a network logon. These events occur on domain controllers when users (or computers) ...



Only top voted, non community-wiki answers of a minimum length are eligible