Tag Info

New answers tagged

1

You can log SFTP sessions / activity (example below), but the log messages will be written to /var/log/messages. I don't know if you can configure auditd to "scan" the /var/log/messages file after that, but here it goes: vi /etc/ssh/sshd_conf # override default of no subsystems Subsystem sftp /usr/libexec/openssh/sftp-server # Change this to ...


0

Here are some details on what is required: http://www.slideshare.net/rainergerhards1/using-wildcards-with-rsyslogs-file-monitor-imfile The version will become 8.6.0 stable on December, 2nd 2014.


1

Based on Brian Armstrong's answer, here's something with a little more explanation and a correction. This handles the log created by postgres on OSX installed by Homebrew. Located at /etc/newsyslog.d/postgresql.conf: # logfilename [owner:group] mode count size(KB) when flags [/pid_file] [sig_num] ...


0

On RHEL5, last -F isn't available. If you want to have only the last informations from a specific year, you need to use last -t. ex: last -t 20140101000000 show everything before 2014. last -t 20130101000000 show everything before 2013. if you run a diff between the 2 commands, you can have only informations for 2013. See Getting "year" with ...


2

Schannel event logging should get you some log information. This will log to the Event Log, however, so you'll need to find some manual way to correlate it with your IIS logs. An Schannel event 36880 will be generated upon each successful negotiation. Correlating them to IIS logs is going to be a bit of a pain, to be sure, but I think this is just about the ...


0

I think you forgot to update the policy file: #SOURCE DEST POLICY LOG LEVEL LIMIT:BURST $FW net ACCEPT net all DROP $LOG # The FOLLOWING POLICY MUST BE LAST all all REJECT $LOG


0

I'm assuming this machine has an additional 'admin' network port in addition to the ports used for routing traffic? npf.conf(5) mentions: procedure "log" { # Note: npf_ext_log kernel module should be loaded, if not built-in. # Also, the interface created, e.g.: ifconfig npflog0 create log: npflog0 } which implies you should ...


2

One possible solution would be to use a wrapper for sendmail command, for example you can create a script like this: #!/bin/sh # file: sendmail-wrapper-php # env vars: ${HTTP_HOST}, ${REMOTE_ADDR}, ${SCRIPT_NAME}, ${PWD}, ${UID} # .... # check and alert #send email. /usr/sbin/sendmail -t -i $* and php_set_envs.php to sets some PHP variables to the ...


2

As an update to this post rsyslog 8.5 (currently development but soon to be stable) does support wildcards, I've tested this and can confirm it is working.


0

To have these messages end up in - for example - /var/log/haproxy.log you will need to do two things: * configure your syslog to accept network logs - at least on localhost * configure haproxy to send events to 127.0.0.1 on local2/local3 or any such facility So, your haproxy.cfgs global section would look something like: global log 127.0.0.1 ...


1

For example, like this: chmod 755 /var/log/nginx && chmod 644 /var/log/nginx/*.log && chmod 644 /var/log/nginx/*.gz this way anyone will be able to cwd and read the contents of the /var/log/nginx directory and read the *.log files. You should also check the log rotating configuration so the permissions won't be changed again. For the last ...


1

Beware this setting will override your ability to limit client connection. There is a parameter in main.cf to suppress the anvil process. This parameter is called smtpd_client_event_limit_exceptions. The purpose of this parameter is to exclude some client from smtpd_client_*_count/rate_limit restrictions. In your case, you should specify it in main.cf ...


0

You could try the newrelic stuff, they give two weeks trial with full power of their PHP profiler (pretty easily to get the cart of most consuming scripts). You could also use dtrace or systemtap, depending on the OS to track down the consuming script, but this is more complicated (but also more experience-giving and skillful) way.


0

Use cron to execute a script that scan the mail.log file every minute. //every minute * * * * * * php -f /path/to/script.php I thing with this solution you have to use a database to remember scanned entries


0

Finally I've found an intermediate solution : server { ... error_log /var/log/nginx/errors.log; location ~* \.(?:jpg|jpeg|gif|png|ico|cur|gz|svg|svgz|mp4|ogg|ogv|webm|htc)$ { try_files $uri =410; access_log off; log_not_found off; } } This code avoid error logging for no critical files. Thank you for your help


-1

If you have sysstat installed on your Centos6 you should have sar logs in /var/log/sa You can view those with sar command. Other than that I would recommend installing atop; and running atop daemon. It will provide you with system state snapshots in 10 min intervals. If you need more frequent snapshots it can easily be adjusted. Once setup you can ...


2

The remote port number is available to your application in the environment variable JK_REMOTE_PORT. There's no corresponding JkRequestLogFormat string to log the remote port, but it can be logged in a standard Apache mod_log_config request log with %{remote}p in LogFormat.


-1

Please stop this madness. It's very impractical to list the local host's mac/IP address every time you need this feature (not to mention the cases where these details can change while running the dump), and the pcap library has this facility already. You just have to use 'inbound' in the filter, and you'll only see the received packets on the interface, ...


1

Since version 2.0.0 snoopy is able to log arbitrary environmental variable. However, recent contribution pointed out that logging owner of tty is fairly effective and elegant answer to the question of "Who executed that command, as root?". Disclosure: I am snoopy maintainer.


0

The correct answer is that the process reading the log and the process writing the log are not related in any way. They are separate processes and not threads. They do not share memory and they have their own file handles with their own file handle pointers. Neither affects the other in any way. The kernel won't stop a write to a file because some other ...


-3

I was also looking for a config file like syslog.conf to cross reference the local0-7 facilities to the program that is writing to them. It appears that such a config file does not exist. To find out what program is writing to the log, you'll have to open the log file and find the program name next to column next to the colon, for example... ...


0

I would suggest logging console critical and logging buffered 64000 debug which lets you use the sho log command to see historical output without clogging the low-speed physical console with messages, while still receiving critical or higher messages on the console. Also useful when using the log buffer are correctly setting your system time (with NTP or ...


0

For some reason logging stop after working without a problem. Here is the solution : http://serverfault.com/a/545623/109483 Unlike the poster there, I'm not upgrading from Squeeze because I did a fresh installation of Wheezy but still had the same problem. Interestingly the solution is similar. Thanks.


2

I'm not sure there is a way to log the "show" commands themselves into an archive. You can achieve beyond logging config mode changes using Accounting TACACS+ features (an example with the ASA firewall is shown below, but same concept applies to switches/routers): http://www.cisco.com/c/en/us/td/docs/security/asa/asa72/command/reference/cmd_ref/a1_72.html ...


1

As stated in nginx documentation, direction error_log can't be used inside if context. Syntax: error_log file | stderr | syslog:server=address[,parameter=value] [debug | info | notice | warn | error | crit | alert | emerg]; Default: error_log logs/error.log error; Context: main, http, server, location For filtering error_log entry, you ...


0

big trouble in little squid 3.4? default points to accesses logging access_log /var/log/squid/access.log Below acls without log access_log none my_acl Does not work, all is logged on access.log I already try changing the order of this two lines (low to up and up to low) but does not work. Have you any idea?


1

Bah, I finally found the answer after a long time digging. The problem, in my case wasn't that logrotate was failing. That error message is fine, and doesn't actually stop logrotate. The problem was that nginx was not releasing the file handle to the log file upon receiving the -USR1 signal from kill. Long story short, the reason it was not reloading the log ...


1

I'd say that if the syslog messages about sessions opening and closing are getting through, then rsyslog is presumably doing its thing at both ends (but confirm it by sending to syslog on the gateway using logger). Also, the fact that the log file gets created on the gateway suggests that the log messages are being mishandled on the gateway, rather than ...



Top 50 recent answers are included