Tag Info

New answers tagged

0

This sounds like a job for.. Logstash!!! But seriously though, install Logstash on your central logging server, and push the logs there with Logstash-Forwarder, using the Lumberjack protocol. In Logstash, you can setup multiple outputs, which can be Elastic and local flat files with whatever format you want.


1

It has been known in the *nix and network community for a long time that logging usernames can sometimes divulge the password of an account. For example: Someone types the username, and accidentally hits return twice. This will result in two login failures being logged, one for the username, and one for the password in the username field.


0

I think the problem here is the "*" in your config and then having the date in the filename for your logfile. You basicly tell the logrotate to keep 52 versions of every file that matches the "/var/log/localhost_access_log.*.txt" expression, which in your case is one logfile for each day. I'm not sure though why it immediately creates all 52 versions, but in ...


2

TL;DR: AppEnforce.log indeed logs the context incorrectly (at least for "Script Installer" technology). The Test I created a deployment type with the following attributes: Technology: Script Installer Installation behavior: Install for system Logon requirement: Whether or not a user is logged on Installation program visibility: Hidden Installation ...


0

For the first question perhaps you should post your config. The option to delete logs older than 90 days is maxage 90


0

The error message means that when mod_proxy_fcgi tried to check what protocol version was being used, it didn't get any version it accepts. It's explained in the comments around bug 56110 - however, that bug pertains to logging the error message, not the actual cause. There's been another report of this in bug 57398. You could add your logs to that one; it ...


0

It is possible to log disconnects (would actually be resets or fin packets depending on the situation). Some discussion of this over here: http://unix.stackexchange.com/questions/126937/can-iptables-be-used-to-monitor-tcp-timeouts-resets-system-wide. And logging dropped packets: http://www.thegeekstuff.com/2012/08/iptables-log-packets/ You can log ...


0

The machine path variable is stored in the registry at: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment\Path user variables are under: HKEY_CURRENT_USER\Environment To audit objects in Windows to have to do two things. First turn auditing on, which you already did. it should be enough to enable: Success for Audit ...


0

pstree seems fine for this. Consider: $ pstree -p 3281 nginx(3281)─┬─nginx(3282) ├─nginx(3283) ├─nginx(3284) ├─nginx(3285) ├─nginx(3286) └─nginx(3287) And use -s to see parents: $ pstree -p -s 3287 systemd(1)───nginx(3281)───nginx(3287)


0

For me, this seemed to be a problem with upstart, which was routing the logs for php-fpm to it's own custom location, e.g.: /var/log/upstart/php5-fpm.log There's also some bugginess with ubuntu Precise, 12.04 that may contribute to the lack of logging ability: https://bugs.php.net/bug.php?id=61045 If you're still running that version.


1

AFAIK that external logging is a yum extra and not available natively with rpm. You can query the RPM database, rpm -qa --last gives a history of when the current RPM packages were installed, but no information on package deletes.


0

Just for future reference, I finally discovered what the problem was. This was actually due to a CentOS kernel due to timesync tx control register not set as expected. References: https://groups.google.com/forum/#!topic/springdale-users/bBqrE545sYo http://bugs.centos.org/view.php?id=6810 In the end this problem simply resolved itself after I upgraded to ...


0

access_log supports if: (access_log path [format [buffer=size [flush=time]] [if=condition]];) access_log /var/.... if $crawler; Source: http://nginx.org/en/docs/http/ngx_http_log_module.html


0

You might want to check at what logging level your device is configured to run. Step-by-step information on configuring logging message levels and types is available here.


0

Event Log is written to disk often enough. But... not to disk itself, but to disk cache. There are 2 layers of such caching: OS level (how to flush: http://stackoverflow.com/questions/85595/flush-disk-write-cache-from-windows-cli) RAID controller level - some of them have battery backup, some don't. Check your hardware...


0

Use this: *.info;user.*;mail.none;authpriv.none; /var/log/messages; I added "user.*" part, which causes syslog daemon to accept LOG_USER messages.


1

It is simple, someone accesses http://ip.add.re.ss. That retrieves a page without hostname. You can make a default virtual host in Apache that returns 404 to the visitor to minimize the effect of these requests.


1

A ping every 10 seconds really isn't going to cause any performance issues. The AWS pings are probably sent directly from Amazon (Heroku is on the Amazon AWS marketplace, so it's probably hosted by them) to keep statistics on uptime/latency/etc. If someone was probing your box it would be followed up with more invasive scans.


0

lookup the man page of "logrotate" or make it yourself by shell script. there is no magic to it. if you know how to make it by hand, just put it all together in a txt file and you have it. also check out the man page of the tool "tail". it is designed to display the "tail" or more precisely the latest X lines of a file. "man tail" gives you more information ...


1

Add following in your logrotate configuration (new file under /etc/logrotate.d/) /mnt/usb_storage/log.txt { rotate 5 # Change this to number of files you need to preserve monthly prerotate /usr/bin/sed -e '1,100000d' < /mnt/usb_storage/log.txt endscript postrotate ...


3

Your are attempting to reinvent wheels. Logrotate does this efficiently: https://www.linode.com/docs/uptime/logs/use-logrotate-to-manage-log-files http://www.rackspace.com/knowledge_center/article/understanding-logrotate-utility https://www.digitalocean.com/community/tutorials/how-to-configure-logging-and-log-rotation-in-apache-on-an-ubuntu-vps Rather ...


1

This is a bug introduced in CoreOS 561 when the default file system was changed from btrfs to the overlayfs. I found a workaround to basically format the filesystem using btrfs when a host is first started, and that seems to be working for now. Include the following in your CloudInit: #cloud-config coreos: units: - name: ...


2

The standard template for remote forwarding uses a traditional BSD Syslog format. Try to use the predefined template RSYSLOG_SyslogProtocol23Format to forward in syslog-protocol format with structured data. E.g.: *.* @logserver;RSYSLOG_SyslogProtocol23Format


1

This question was correctly answered on stackoverflow by one of the authors of Passenger. Here's a copy of his answer. Restarting Nginx would actually make the log file come back. It's just that you're not using the right method to restart Nginx, because your Nginx install was installed from source. Init scripts, e.g. /etc/init.d/nginx and service nginx ...


0

This will concatenate all log* files (including gzipped) into log.all Just replace "log" to use it l='log'; test -f ${l}.all && rm ${l}.all; ls -1tr ${l}* | xargs zcat -f >> $l.all


0

As far as I know, the time you can see in the log is the time when the request arrived at the server. The reason why you don't see the requests in the correct order is that you typically also log information which is only known once the request is processed (return status, response length etc.). I see two options: change your parser sort the input before ...


0

The configuration of even a not-so-big logging infrastructure (eg.: tens of servers generating, together, several hundreds MBs of LOGs per day) is quite a challenging task. In your question, you "touch" several critical points. I'm going to address them, starting from the explicit questions. "is it possible to have rsyslog write locally (on the client) ...


0

Short answer: Yes. It is possible... and done regularly. Longer answer: Create a new file in /etc/rsyslog.d (i.e. 60-remote.conf) and add single line: *.* @remote.logging.server.net (be sure to replace "remote.logging.server.net" with your actual remote server you want to centralize on.) You can also add various filters to only send warnings & ...


2

Other than combing through the event logs, looking for Logon Type 10 (Remote Desktop) in the Security Log, or looking at the TerminalServices channel event logs, you'll need to use third party software. In addition to TSL mentioned above, here is one other I've used with success in the past - Remote Desktop Reporter http://www.rdpsoft.com/products If you ...



Top 50 recent answers are included