345 reputation
113
bio website
location France
age
visits member for 3 years, 8 months
seen Dec 16 at 19:48

Jun
14
comment how to manage the whole /var/log for centralization?
I use splunk extensively, including forwarders. This is a fantastic tool.
Jun
13
comment how to manage the whole /var/log for centralization?
I will end up building a wrapper around text File Input Monitor to dynamically create configuration entries for each non-rsyslogd-managed file. Thanks!
Jun
13
comment how to manage the whole /var/log for centralization?
@JennyD: I do not know about your case but mine, details aside, is that I need to have these logs centralized without relying on the admins to always configure the forwarding - and a technical solution to that.
Jun
13
comment “POSSIBLE BREAK-IN ATTEMPT!” in /var/log/secure — what does this mean?
@Iain: true, but having experienced that on many servers when such attacks became fashionable years ago I saw a drastic reduction (almost to zero) of this noise in the logs.
Jun
13
comment how to manage the whole /var/log for centralization?
@JennyD: no, this is not a fairly urgent issue. The systems are handled by various people (they do know what will appear), the servers are peripheral helpers, not key servers etc. The background story is long but the TLDR; version is that it would be good to be able to feed these various logs to splunk> in a reasonably simple way, with the constraints mentioned in my question.
Jun
13
comment “POSSIBLE BREAK-IN ATTEMPT!” in /var/log/secure — what does this mean?
Another solution is to move the ssh server to a port other than 22. That should remove most of the messages (and break the standard "22/ssh", whether it is important or not depends on your system)
Jun
13
comment how to manage the whole /var/log for centralization?
Thanks for the comments, but as mentioned in the comment of the first answer I do not know which files will be present in /var/log - this is why I need to handle it as a whole. I will stress and highlight this in my question.
Jun
13
comment how to manage the whole /var/log for centralization?
Thanks - but the Text File Input Monitor module forces me to handle each file separately. I do not know which files will be created, this is why I wanted to handle /var/log as a whole (including all the changes: files appearing and disappearing)
Jun
13
comment how to manage the whole /var/log for centralization?
@Iain: that would have been the easiest solution (and directly implemented in splunk from the receiving side) but all of the logs are not created by rsyslog. Some are updated by the application itself (like the example I gave - Apache) and I also cannot assume that I will know all the services which log to a file in /var/log.
Apr
11
comment how to unify package installation tasks in ansible?
The zoo is fortunately only two animals large but this is the lowest number I can go to :)
Apr
10
comment how to unify package installation tasks in ansible?
This is more or less what I was expecting (unfortunately :)) so I wonder how salt manages to unify both package managers. Anyway, I will resort to a double configuration, then.
Apr
3
comment winbindd: kinit succeeded but ads_sasl_spnego_krb5_bind failed: Cannot contact any KDC for requested realm
I checked and there is a registration similar to the ones in point 3/ in my question: _ldap._tcp.pdc._msdcs.DOMAIN.EXAMPLE.COM has SRV record 0 100 389 someserver.example.com.
Apr
2
comment How to correctly register in my DNS servers whose IPs and names are handled by someone else?
I completely understand this and it is not my question. I know that a change of the IP will break both of the configurations and that the PTR will point to the example.com entry. Now since both of the configurations work I wanted to understand if one is preferred over the other.
Apr
2
comment How to correctly register in my DNS servers whose IPs and names are handled by someone else?
@MadHatter: I do not particularly fear it changing - what I meant is that neither of the solutions would protect me from a change of the IP (as opposed to having, say, myowngoogle IN CNAME www.google.com which would automatically adapt to changes on the www.google.comserver). This is why the question is about best practices and possibly standards in such a registration.
Apr
2
comment How to correctly register in my DNS servers whose IPs and names are handled by someone else?
@MadHatter: it is static (I mentioned in my question that DHCP is not used and the IP is hardcoded in the server - it is actually automatically reserved (and communicated to me) and updated in the example.com DNS)
Apr
2
comment How to correctly register in my DNS servers whose IPs and names are handled by someone else?
@TomTom: everyone did their job. The virtualization group registered the servers in the correct domain (from their perspective) and I want to register them in mine (for various reasons).
Mar
20
comment Is it possible to authenticate Outlook users with certificates on RPC over HTTPS?
Thank you, this is very instructive. I see however that "If the authentication exchange initially fails to identify the user, the browser will prompt the user for a Windows user account user name and password". Would you know if there is a way to disable this, i.e. to allow only NTLM authentication and reject the connection otherwise?
Dec
18
comment How to make an exception for a directory in Apache?
Perfect - this is it! Thank you!
Dec
7
comment why doesn't ntp recover after an Internet-less startup?
dynamic did the trick, thanks!
Dec
6
comment why doesn't ntp recover after an Internet-less startup?
I also never needed to sync one shot. This is clearly a possible case but a service restart cleans the status up.