Tag Info

New answers tagged

0

Another option is to use pam. Stolen from page found in google: session optional pam_exec.so /path/to/your/script/or/executable For details see pam_exec(8) man page. The advantage is that you don't need to parse the logs to do it - it uses standard mechanism for plugging-in sessions. Depending on where you put it you can use it to send whenever user ...


3

Sure. It looks like it's a log from the European Conferences on Machine Learning and European Conferences on Principles and Practice of Knowledge Discovery in Databases Discovery Challenge 2005 competition. They've got a page describing the data format and a FAQ about the data on the site. (I could tell those were some old unix timestamps just by eyeballing ...


1

an alternative: you may run a filtering of secure log in a background to extract interesting events, like: tail -n 0 -f /var/log/secure | grep --line-buffered "sshd:session): session opened" > /var/log/sec-filtered and have a periodic task that checks for size of filtered output file to send it be e-mail and restart filtering on secure log.


3

One way to do this is to use syslog and redirect the message to email: Mail Output Module (ommail) for rsyslog smtp() driver in syslog-ng Another way is to use a log parser like SEC or Splunk.


3

First off, you mustn't use sudo in a bash script, it's non-interactive and so if you're required to use a password you won't be able to elevate. Below would be a basic example to install a single package, to install more you would add a package to the "for package in" line. The output is set to append to the existing file. #!/bin/bash apt-get update for ...


1

The above poster is close. tail allows you to see the last 10 lines in a file. The -f switch allows you to see new lines as they are appended to the maillog file. cd /var/log tail -f maillog Ctrl+c to escape. Seeing this is already written to a file called /var/log/maillog, not sure why you would want to create another file unless you are looking to ...


3

postfix logs each connection as it comes in, and the log lines look like Jul 8 16:25:15 swiss postfix/smtpd[11127]: connect from some.host.or.other [192.0.2.1] so you can tail -F your logfile (on my system it's /var/log/mail.log), use grep to filter the lines you want, and watch the live traffic.


2

That is not a good idea. Big part of the log rotation process is forcing applications to change the log file they are using. You to do that for a directory, you need to manage this for all the logs in it.


1

For those to which the accepted answer does not work: I had the same situation, but I was using (liferay -> tomcat) startup.bat and it always opened up tomcat console. The way to edit the startup.bat file, so that it outputs the log into a file was like this: Look for the line: call "%EXECUTABLE%" start %CMD_LINE_ARGS% and edit it, so it looks like ...


1

sysdig has turned out to be the solution I've been looking for. Their wiki has some exceptionally interesting examples for Disk I/O and so much more: Disk I/O See the top processes in terms of disk bandwidth usage sysdig -c topprocs_file List the processes that are using a high number of files sysdig -c fdcount_by proc.name "fd.type=file" See ...


1

You can use a "cheat" - in your /etc/pam.d/ssh(d) in the auth section you can add a log statement (pam_log) before the pam_unix or @include common-auth statements. If this statement is hit, then a password authentication has been attempted.


1

The answer to your question is No. At least, not without taking heroic measures (e.g., running DEBUG level and processing it with scripts) that are much harder than some sensible alternatives. That same [preauth] error is reported for no key or an invalid key. On the other hand, if they actually connect, your log will say explicitly Jul 7 15:59:38 ws6 ...


0

What file name are you using for HTTP error logging? I suspect you might be using the same filename as for HTTPS/SSL, if that is the case try renaming the file name to ssl_error.log instead of error.log for the above posted default-ssl file. Change - ErrorLog ${APACHE_LOG_DIR}/error.log To - ErrorLog ${APACHE_LOG_DIR}/ssl_error.log


0

Can someone please tell me why the Security Log doesn't know the IP address of people trying to log in and failing? Here is the cause for something like Remote Desktop. http://cyberarms.net/security-insights/security-lab/remote-desktop-logging-of-ip-address-%28security-event-log-4625%29.aspx There is no option in Windows to enable or disable the ...


1

Your first example sends both stderr and stdout to the file (2>&1) ; the MAILTO variable set in the cron will capture any output that is not redirected, and this combined with directing the output to the file means that no output is available for the cron to email. I'd suggest using tee to append the output to the file as well as sending it to stdout; ...


2

You forget to configure the inverse , besides writing your LAN requests to it's own log you need to exclude them from the regular log as well... # Where your access log is defined CustomLog logs/access_log common env=!fromlan Make sure that the SetEnvIf line is declared before the regular access log is.


0

Use $http_host in your log_format to get the actual host that the client sent. You can also use that variable in access_log and error_log directives to split your logs by hostname.


0

Create the run files in /etc/sv/pants/ not /etc/service/pants/. Then a symlink should be created in /etc/service to /etc/sv/pants to activate the service. ln -s /etc/sv/pants /etc/service/ While creating the files directly in /etc/service works for just the service, it seems to cause problems when using logging as well. A service can be deactivated by ...


1

I've posted an answer to Bradd's question on AskUbuntu: http://askubuntu.com/a/490900/297973. Long story short, you may need to add $KLogPermitNonKernelFacility on to rsyslogd's config.


0

Ultimately for the most part these two features I've just learned to live without. Generally the data gets parsed down pretty well from filters, and fortunately Windows event logs already provide decent details of the event, so I just have learned to live with just digging into the message to get the information.


1

There's always a lot of "background noise" being generated by bots scanning random ip-ranges and trying for known vulnerabilities and exploits. It's a fact of modern digital life and you see evidence of that in your log files. Keep your systems patched and up-to-date and learn to live with that. When a lot of traffic is for more valid looking URL's that ...


2

Don't use the -v option of rsync, instead use --out-format: rsync --out-format="%n%L" -az user@r18:~/assets ~/18 >> ~/18/rsync.log 2>&1 Will only have output when you are transfering files, and no output when you don't. To have more fancy output look at the rsync.conf man page, in the "log format" section.


0

While not directly related to logstash OSSEC may be able to help out more in the alerting category. I'm sure you could define thresholds within the system to alert. http://www.ossec.net/files/auscert-2007-dcid.pdf For general alerting and monitoring a combination of factors is good. You could even expose a counter to nagios to do alerting for you if you ...


1

Borrowed from sensu FAQ: http://sensuapp.org/docs/0.12/faq#how-do-i-increase-log-verbosity You can adjust the process log level by setting LOG_LEVEL in /etc/default/sensu to either debug, info, warn or error. You will need to restart the Sensu process(s) after making the adjustment. This will work for both server and client. Don't forget to restart ...


0

The squid proxy log isn't really designed with giving you the type of detailed user activity logging your thinking of. Yes you can use Sarg to get a general idea as to user cache activity and traffic. However it will never give you the kind of granular detail your manager wants. I would recommend trying LightSquid it provides more detailed reports then ...


0

With regards to logrobot.com, there's now a free version of it that does exactly what you need and it can be downloaded here: http://www.logxray.com/logxray.zip To use it to address your concerns, you can run logxray this way: ./logxray localhost:emailing /apps/logxray autonda /var/log/messages 60m 'kernel|error|panic|fail' 'timed out' 1 ...


1

Why do you want to store the e-mails? Events are already stored in Zenoss's MySQL database? The e-mails are generated from the events. You can customize Zenoss's archive settings under the advanced tab - events in the left hand menu. You can query the tables like normal, and I suppose you could copy those tables too if you wanted...


0

Turns out someone had actively gone and changed the logrotate configuration file to the adm group rather than the primary group. Therefore breaking the permissions for logaccess.


0

Are you using logrotate? Adm Is the group usually assigned by the log rotate daemon. See http://linuxers.org/howto/howto-use-logrotate-manage-log-files


1

I'm using splunk on my work to handle a logs from a bunch of servers, some linux and some windows Highly advise you to look at splunk universal forwarder. With it you can choose, what logs to send and basically you can create any scenario on logs treatment, It's way easier to tune, then rsyslog, there is a deployment server, that can help you to manage ...


3

You should be able to do this by using rsyslog on your systems to send all the logs to a centralised log server. For applications that log via syslog this is fairly straightforward. For applications that log directly to files, rsyslog provides a Text File Input Monitor module that sends lines from a text file to rsyslog for processing. Regarding ...


0

You don't really want it done in Varnish. What you want is to do have something like varnishncsa talk directly to mongodb. That way if Mongo slows down page delivery isn't slowed down. We're currently playing with idea of building a varnishlogjson program to output (parts of the) varnishlog in JSON format, for insertion into hadoop, but maybe Mongo would be ...


1

Apache's CustomLog directive allows for evaluating environment variables in order to decide whether to log a message. And environment variables can be set depending on the URI using SetEnvIf. So to exclude all requests for URIs ending with wp-login.php from the combined custom log: SetEnvIf Request_URI "wp-login.php$" dontlog CustomLog ...



Top 50 recent answers are included