Tag Info

Hot answers tagged

19

Look at pam_exec.so. You can run a script on login in the session interface of PAM's system-auth. The script runs as root before the user gets a shell, so it may not capture input with read? You can try, though, and use read to get a reason from the user and log it to syslog with a logger statement. (I've omitted below, but you can trap CTRL+C to prevent ...


8

The alternative is a privileged account management solution, where rather than giving administrators access with their own account, admin accounts are held in escrow by a third party and the mandatory procedures Have to be followed before administrators can access production systems http://en.m.wikipedia.org/wiki/Privileged_Identity_Management


6

http://wiki.apache.org/httpd/ProxyAbuse: Why do I see requests for foreign sites appearing in my log files? An access_log entry showing this situation could look like this: 63.251.56.142 - - [25/Jul/2002:12:48:04 -0700] "GET http://www.yahoo.com/ HTTP/1.0" 200 1456 For this log line, the 200 code (second to last field in this example) ...


3

The OOM killer fired as the system was out of RAM and swap - the mysqld process was chosen as its victim, likely due to having a combination of high RAM use and relatively low activity on its RAM. Either adjust the available buffer pool size to make MariaDB take less RAM and not trigger the OOM killer (which might hurt performance) or give the system more ...


3

The server crashed for me if you send SIGUSR1 to mongod after you have moved the logfile out of the way with logrotate. The following config is safe for the version I've tested - 2.6.6 on ubuntu 12.04 - the previous examples crashed the server. Put this into /etc/logrotate.d/mongod: /var/log/mongodb/mongodb.log { weekly missingok rotate 4 ...


2

Well the best idea would of course be to fix the site contents so there are no broken image links ;) With regards to the ErrorLog: It is not possible to customize the error log by adding or removing information. So you can't exclude specific error messages. It is possible to increase or reduce the verbosity of the ErrorLog with the LogLevel ...


1

In addition to the great answer from faker, the 302 response code is because of the HTTPS redirect you have configured. To verify if you are vulnerable to the same exploit via HTTPS, run these commands [source]: openssl s_client -connect yourdomain.com:443 [wait for the connection to initialise] GET http://www.yahoo.com/ HTTP/1.1 Host: www.yahoo.com Or ...


1

Log rotation in RHEL and RHEL-alike systems is handled by a scheduled nightly job called "logrotate". The configuration of logrotate is in /etc/logrotate.conf and /etc/logrotate.d/*.conf, The manpage for logrotate is at http://linux.die.net/man/8/logrotate and includes sample config files. You would need to add your custom log files to the logrotate ...


1

Personally I use syslog-ng to forward syslogs and cacti with SNMP and syslog plugin , to achieve this functionality - this allows for prioritising/highlighting of specific event types etc, and emailing upon certain events etc. Edit: if you do go down the cacti route, you may also find the threshold plugin useful; it can be configured to notify you when ...


1

Sure. I suppose if it's 'WINDROID device' then check you mail server (Exchange?) enable netlogon on it: nltest /dbflag:2080ffff Netlogon.txt file is created in %systemroot%/debug directory correlate timestamps inside log with time when account lockout happens... don't forget to disable netlogon logging at the end nltest /dbflag:0 Also you can try ...


1

In the past I've created symbolic links to /var/log/ areas so that Apache will serve the files. EG: # ln -s /var/log /var/www/logs You probably should consider some form of security on this logs folder, especially if publicly visible.


1

The question is slightly vague, but from the sound of it, I think you are asking if you can use svlogd to send syslog messages to another program besides rsyslogd. The answer is, any program that provided a syslog service would suffice. There is more than just rsyslogd that provides a syslog network service. However, the way runit was intended to ...


1

I would look to see if the connections were coming from some kind of web crawler. There has been a spike in the amount of connections that come from applications like http://www.majestic12.co.uk/ This particular service acts like SETI@Home or Folding@Home and aggregates crawled data from the distributed users back to a central location. Majestic12 uses ...



Only top voted, non community-wiki answers of a minimum length are eligible