Tag Info

New answers tagged

0

The configuration of even a not-so-big logging infrastructure (eg.: tens of servers generating, together, several hundreds MBs of LOGs per day) is quite a challenging task. In your question, you "touch" several critical points. I'm going to address them, starting from the explicit questions. "is it possible to have rsyslog write locally (on the client) ...


0

Short answer: Yes. It is possible... and done regularly. Longer answer: Create a new file in /etc/rsyslog.d (i.e. 60-remote.conf) and add single line: *.* @remote.logging.server.net (be sure to replace "remote.logging.server.net" with your actual remote server you want to centralize on.) You can also add various filters to only send warnings & ...


1

Other than combing through the event logs, looking for Logon Type 10 (Remote Desktop) in the Security Log, or looking at the TerminalServices channel event logs, you'll need to use third party software. In addition to TSL mentioned above, here is one other I've used with success in the past - Remote Desktop Reporter http://www.rdpsoft.com/products If you ...


1

Nginx by default will output a combined log format (NCSA). GoAccess will automatically recognize it if you pick the first option from the configuration dialog (or permanently uncomment the NCSA Combined Log Format from your config file.) If you are interested to log the request time, then you need to modify your nginx config file and add your custom log ...


1

GoAccess says right on their page: Apache/Nginx Common/Combined + VHosts If your logs aren't parsing, then you'll need to look into the GoAccess logs and see what is wrong. Additionally: GoAccess allows any custom log format string. So you may need to look into how to instruct the tool on your custom format.


0

It is possible to install the Microsoft-Windows-IIS-Logging ETW provider on a Windows 7 workstation. This is done by identifying the components of the ETW provider and importing those to the Windows workstation. On the target server that has the ETW provider installed, run the following command to query installed ETW providers: logman query providers ...


-2

Came here because one of our Customers Servers was upgraded from Debian Etch (4.0) to Jessie (8.1) last week and /var/log/syslog had no activity since then. It turns out that in Debian 7 sysklogd was replaced with rsyslog. Just installed rsyslog-Package as mentioned in http://jonsimpson.co.uk/log/2014/syslogd-updated-debian and syslog is up and running ...


-2

You can use this too.. truncate /opt/package/logs/*.log --size 0 Here all log files in the /opt/package/logs will become empty..


4

You can use Microsoft's log parser utility. It has the capability of dumping into a SQL database as well as having the ability to create a checkpoint file so that it only imports records it hasn't processed. It can be used either as a stand alone executable or programmatically invoked via an ActiveX control


0

Alternatively, there's a way to do it online Enter command mode in screen via 'Ctrl-a :' and use the 'logfile' command with the name of the file you want as argument logfile whatevernameyoulike.log Source: screen man page


1

Since it's only Layer 7; just install something such as DDOS Deflate or null route the IP Range. To null route the IP: route add -host 222.186.129.X reject ip route get 222.186.129.x Output RTNETLINK answers: Network is unreachable To null route the whole subnet: route add -net 222.186.0/24 gw 127.0.0.1 lo Or to install DDOS Deflate: wget ...


1

It depends on the syslog on your server systems. In case of RSYSLOG you can just so set up your config like that: mail.* @@other-server.example.net:10514 Source: http://www.rsyslog.com/sending-messages-to-a-remote-syslog-server/ EDIT If you want to replicate mail.* log on the same server just add another line with the same condition: mail.* ...


0

#!/bin/bash while read line; do echo $line > /tmp/output.log mail -s 'Event Msg.' 'email@gmail.com' < /tmp/output.log done < <(tail -n0 -F /var/adm/messages)


1

You can also disable history using command set +o history This would be per shell. To make it permanent put it in /etc/profile More details.


1

Check out Sumo Logic, it offers a cloud to cloud integration with Akamai, with rich out-of-the-box content, utilizing cloud monitor. Setup is a breeze, and you don't have to concern yourself with batch downloading/processing anything on-prem. https://www.sumologic.com/2013/10/09/akamai-and-sumo-logic-integrate-for-real-time-application-insights/ ...


0

You can trigger an action for identified messages as explained here. In Suricata you can find an example of use.


0

I'm not sure if you ever worked out how to do this, but I was looking at something for my own environment that's similar and I think the only way to do it is to setup patterns for each client. I've tested them both in the grok constructor and they return valid fields. If you just wanted to have a field for Client A (10.16.64.68:6813/97613) and Client B ...


1

You have the possibility to pipe logs to a program when using CustomLog. An example usecase would be log rotation, as desribed here: rotatelogs Depending on your skills, you could write a custom logger which would only log under whatever critera you desire. The benefit here would be, that you wouldn't have to restart or reload Apache at all. Here a more ...


1

You can use the third argument of the CustomLog directive to specify a condition which determines whether or not to log that request. The third argument can be an environment variable or as of Apache 2.4 it can be an expression (like checking HTTP_COOKIE). http://httpd.apache.org/docs/2.4/mod/mod_log_config.html#customlog ...


0

Your problem is most likely a bug in wheezy's rsyslog. You're looking to set $PreserveFQDN on. You'll need to set it on top of your file (logs configured prior to this directive would still tell about your hostname, instead of your FQDN). And maybe you've done it already. The thing is: It works fine everywhere I've been able to check (openbsd 5.4 rsyslog4 ...


0

I tried adding syslog to the tty group: sudo adduser syslog tty and it seems to work after service rsyslog restart and re-logging in. And just for fun, the hard-to-read-but-more-generic version: adduser $(awk '/^\$PrivDropToUser/ {print $2}' /etc/rsyslog.conf) $(stat -c "%G" $(tty))


0

Have you tried SysInternals TCPView for Windows? https://technet.microsoft.com/en-us/library/bb897437.aspx I use this when I want to see the IP's of servers/devices etc connecting to a hub transport server via SMTP Port 25.


1

Either you are using a buggy version of nginx or your test method had some flaws. I have just confirmed that $gzip_ratio in a log_format definition works perfectly fine in nginx 1.9.1. I have seen $gzip_ratio to only equal - when no compression was performed. In all other cases it held a numeric value.


0

Sorry, I'm so stupid. Found a solution 10 minutes after posting the question. You should add a FILTERING rule to the log-definition at the website level, that will filter http-requests targeted to the virtual subdirectory (by looking at the URL field for example). More info here: ...


0

The following PowerShell clears all the event logs on the local machine, including the operational/debug/setup logs programmatically (without instantiating the "wevtutil" process). To clear just one log, modify the code accordingly. It's not perfect, however, sometimes the Debug logs are held open by something, and this does not generate any errors. ...


2

Yes, your VPS is always under attack. But no, that's not what this log entry shows. This is legitimate activity. It's anacron, running the daily /etc/cron.daily/lighttpd job, as you saw. In the (corrected) lighttpd cron script, you can see that the script is running su www-data, and the log file shows root changing user to www-data.



Top 50 recent answers are included