Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [filter]

Usually related with text filtering of some kind, like logs. This may also refer to email filtering. Note that there are other tags that are more appropriate for network and spam filtering.

0
votes
0answers
29 views

How to debug Mikrotik bridge filter forward rules not having any effect?

As part of diagnosing a different problem were trying to add a bridge filter rule that will stop all traffic from forwarding between two interfaces on a bridge. The router has two interfaces ether1 ...
0
votes
1answer
11 views

fail2ban filter matches no lines for xmlrpc attack

I'm trying to jail hosts that brute-force attack a web server, thereby creating (hundreds of) lines in /var/log/apache2/error.log of the form [Fri Feb 01 11:17:56.158739 2019] [:error] [pid 15870] [...
0
votes
0answers
23 views

How offer the teacher to block internet in the classroom?

I work for an high school. Currently we have an old Squid/SquidGuard, using explicit proxy fixed by GPO on Windows 10. Squid asks credentials (ntlm_auth), SquidGuard filters (blacklist) and logs ...
0
votes
1answer
38 views

exim filter regex discard rule

We are trying to discard all emails with a matching subject, example of subject: Subject: DOMAIN.COM Alert: NAME We have NOT received your payment We are trying to match any domain, Alert, and "We ...
0
votes
1answer
314 views

Apply Network Filter to Ovirt Guest without Rebooting

I am trying to change the clean-traffic IP address for a oVirt Guest VM. It works as long as I reboot the VM. ( Changed from within the Guest Virtual Machine Network Settings ) But for a production ...
0
votes
0answers
29 views

Exim filter - Matching FROM and TO

I have been receiving a lot of mailer-daemon spam lately ... It's obvious the spammer is spoofing the to & from fields so that mailer-daemon kicks in and delivers the actual message to me. I ...
0
votes
1answer
60 views

fail2ban filter for common apache exploits

Every day I see hackers/script kiddies looking for url's like: /webdav /site.tar /admin /htdocs.php etc. They sometimes hit my sites for several minutes looking for common exploits. Is there a ...
0
votes
1answer
60 views

Get mac address based on ip in filter wireshark

i am a test engineer writing some test cases. I am trying to write a test which has to be performed in wireshark. However, my collegues aren't that "into wireshark" and i would like to keep it as ...
0
votes
1answer
56 views

Exim filter TLD block is blocking more than just the TLD

Need to discard emails to and from ending in a specific TLD but having an issue, example of a filter: if first_delivery and ("$h_to:, $h_cc:" contains ".win$") or ("$h_from:" contains ".win$") then ...
0
votes
0answers
135 views

Postfix: Read input stream of a spawned content filter

Similarly to this question, I followed the documentation for an advanced content filter and ended up with the same configurations. main.cf content_filter = scan:localhost:10025 master.cf smtp ...
0
votes
0answers
35 views

eptables: allowed access only a few MAC

i use a bridge br0 to connect 2 networks eth0 anderen eth1. All devices from eth0 should have access to devices in eth1, nur only a few devices in eth1 should bei allowed to connect in eth0-devices. ...
1
vote
1answer
115 views

tc/netem filter explenation

Iam new to tc and i find it mighty confusing, i was able to find and bit understand little command flow, to issue delay on specific IP, but i dont tink it works properly - delaying all traffic ...
0
votes
1answer
71 views

Filter log for a location but allow passing request to proxy

I know how to filter logs for a location: # inside a http block log_format filter '0.0.0.0 - $remote_user [$time_local] "$request"' '$status $body_bytes_sent ' '"$...
1
vote
1answer
131 views

Filtering dpkg logs in syslog-ng

I am new to syslog-ng, and I am setting a syslog-ng, where I am receiving logs of syslog, auth.log and dpkg.log. Although I was able to get the logs for syslog and auth.log, but I am unable to write ...
1
vote
1answer
36 views

Fold burst of many emails into one?

We are running an SGE job scheduling system. Users can let SGE send out emails in case of jobs being cancelled. In the case of a user having large array jobs (say 100'000k entries) and killing all of ...
3
votes
1answer
161 views

Toggle postfix on and off

There's probably an answer to this already, but I just can't figure out how to search for it correctly. Situation: We have a failover situation for two nodes, using keepalived, passing a floating IP ...
2
votes
2answers
371 views

Powershell script - Find LogOn attribute - How from specific OU?

This is the PowerShell script I use to find the LogOn attribute from users in Active Directory. Now rather than getting all users I want it to search only in a specific OU. The domain looks like this: ...
0
votes
0answers
204 views

Correct filtering of raw devices which are multipath components out of LVM

I have a HP MSA P2000 FC with dual controllers, dual HP SAN switches and a couple of servers with QLogic "ISP2532-based" 8G dual-port cards. Everything is connected "each to each" way. The OS is ...
0
votes
0answers
81 views

LVM: unable to add pv to vg in CentOS 7.3

I have a server with 6 disks, each pair are in raid1, and are presented to Centos as /dev/{sda,sdb,sdc} When installing CentOS, I set the root LVM VG on sdb as I planned to add sdc and sda as extra ...
0
votes
1answer
75 views

Filter pcap by subsecond detail?

I'm trying to export a subset of a pcap file given a start and an end message, this start and end message identification is currently done using ngrep on the raw data(because we have no dissector for ...
1
vote
1answer
3k views

Squid proxy_protocol_access with dstdomain acl

I'm configuring a squid proxy to work as a sort of a gateway for traffic egress. The environment in which this is deployed has a client that makes a request through a load balancer which then sends it ...
0
votes
2answers
489 views

unable to filter badly-formatted messages in syslog-ng

I am contacting you regarding an issue I have with syslog-NG. some of our devices (mainly HP switches and SANs) are sending syslog messages that do not respect the syslog RFC 5424 it seems. to give ...
2
votes
1answer
62 views

(“remotely”) Managing filters with Horde 3.3.13

I'm using Horde 3.3.13 (which is an old version I know) and uses the filters all the time. I know that thunderbird, for instance, also support filters. Is there a way to synchronize the filters on ...
0
votes
1answer
2k views

“mapper_parsing_exception” error from Elasticsearch failing to parse [timestamp] from %{COMBINEDAPACHELOG}

I've configured Logstash to filter httpd_access_log messages and grok the fields associated with COMBINEDAPACHELOG. However, I'm receiving errors like the following: [2017-02-10T15:37:39,361][WARN ][...
1
vote
0answers
369 views

Logstash syslog filter not applying to logs?

I'm looking through some syslog logs files in my ELK stack and noticed that all the syslog_severity fields are 'notice', when I can verify in the log files that they are not 'notice'. Seems like ...
1
vote
0answers
141 views

Logstash filter: syslog_pri always defaulting to notice?

I'm looking through some syslog logs files in my ELK stack and noticed that all the syslog_severity fields are 'notice', when I can verify in the log files that they are not 'notice'. Seems like ...
3
votes
1answer
2k views

SSH port filtered on machine only from within local network when using explicit ip address

To describe the situation, I need to define three machines. On the local network I have a machine (LAPTOP) and a machine (SERVER) connected over WAN and LAN to the router, respectively. The third ...
0
votes
1answer
348 views

How to filter wireshark capture to have only packets with local ip as source or destination

How to filter wireshark capture to have only packets with local ip as source or destination? The expression should be valid for both ipv4 and ipv6. I am obviously asking for an other solution than ...
0
votes
1answer
489 views

How to display only the source port with tshark

I can display the source and destination tcp ports with tshark -T fields -e tcp.port 1111,2222 2222,1111 [...] How can I display only the source port in order to get 1111 2222
1
vote
1answer
756 views

nginx multiple sub_filter not working

I have problem here. I've got nginx installed from apt on Debian, so it has the following output for nginx -V: nginx version: nginx/1.6.2 TLS SNI support enabled configure arguments: --with-cc-opt='-...
0
votes
1answer
1k views

negative WMI-Filter for security filtering in GPO

I need to create a group policy object (GPO) that will disable printer redirection for all computers except certain servers. I considered making a security group and adding all the computers except ...
0
votes
0answers
2k views

How to filter ObjectName in Windows logs with Advanced XML Filtering?

I want to deploy a centralized log analysis tool on my domain. I'm currently configuring Windows to audit a shared network drive (read, write, access attempt of domain users) to forward Windows events ...
0
votes
1answer
80 views

Dumping Splunk Events

We have a nagios instance set up so that using MK-Livestatus and splunk, we are able to push all of nagios's alerts through livestatus's socket thanks to a call from splunk. However, splunk is now ...
1
vote
1answer
409 views

Add Filter Based on Client Certificate Name (OpenVPN)

Can anyone show me how to filter (change bandwidth, delay, etc) of one or more users connecting to OpenVPN based on their Client Certificate Name? Why I would like to use the Client Cert name is I ...
0
votes
1answer
725 views

how to control ldap users access using groupdn?

i am using openldap, nslcd and nss-pam-ldapd. i want to restrict users login to ldap client. i have configured this in centos6.5 without any problem using groupdn. but in centos 7, there is no ...
1
vote
0answers
28 views

How to block a users name from getting mail using postfix

I have a setup where I use /etc/aliases to define several email addresses for a user, e.g.: foo: user bar: user foo.bar: user However I want to block the users name (user@domain.com) from ...
-1
votes
1answer
1k views

HP ProCurve 2920, MAC filter

I have few HP 2920. They are connected to another HP modular switch via uplinks. When I check which devices are connected via MAC I can only see MAC addresses on uplink ports (idk why I can't see ...
2
votes
1answer
779 views

Use Windows PowerShell to find and delete files from specific owner

Because of a ransomware attack (no big deal, all recovered from backup) I want to clean up the directories and sub directories on the network share where the attack happened to create a lot of ...
0
votes
0answers
28 views

Emails ending up in gmail spam folder [duplicate]

Emails from my dedicated server are ending up in spam folder in gmail even though the server is not blacklisted and with good reputation - see below. the server level issues that would cause this ...
0
votes
0answers
165 views

Postfix capture messages exceeding limit

Is it possible to capture/filter messages that are exceeding the limit that has been set in the postfix configuration, and forward the captured mails to an external id? thanks in advance. EDIT : We ...
3
votes
1answer
6k views

Transparent HTTP/HTTPS domain filtering proxy [closed]

I want to set up a transparent HTTP/HTTPS proxy to filter outbound requests based on destination hostname (domain). The proxy itself should be non-intrusive and just forward traffic, not decrypt/...
1
vote
1answer
67 views

How to re-open the port?

I've a server with root access, I opened the 4022 port for ssh and it was working very well before, Today I try to connect on my server via ssh, but nothing happened, so I checked that via nmap and it'...
1
vote
1answer
3k views

Powershell to exclude Group Members from Dynamic Distribution List

I am attempting to remove specific users from a Dynamic Distribution List. I have searched and toyed with my PowerShell script for sometime with no luck. I'm sure it is something I am overlooking as I'...
1
vote
0answers
351 views

How do I set Host Groups on Fail2ban for Wordpress?

I'm trying to set up a custom filter for fail2ban on a wordpress site. I've been following this tutorial but when I try to test my custom filter, I get the error: server.failregex.RegexException: No '...
1
vote
0answers
855 views

rsyslog filter on authpriv facility in rsyslog.conf

This has been addressed in other post(s), but I still can't get this to work properly. I am trying to OMIT (discard) certain entries from being written to my " /var/log/secure ". Namely, any line ...
2
votes
3answers
441 views

How to filter a LDAP query for users which are authenticated? [closed]

I want to check if a user is authenticated right now for my Windows domain. For that I want to use an LDAP query. I learned that there is a group "Authenticated Users" (S-1-5-11) which might do the ...
0
votes
2answers
4k views

Logstash: UNIX Epoch time not getting converted to readable format

I have setup an ELK stack and I am trying to parse squid log entries. And I am having a problem trying to convert the following UNIX/Epoc time as 1442469455.757 to a human readable format. While ...
-1
votes
1answer
174 views

When should I use the different tables in iptables?

I am new to iptables and a bit confused. What I would like to know is, for example, if I need to block a certain IP from accessing my server, should I add the rule to the mangle table or the filter ...
1
vote
1answer
840 views

Exim - add footer to all outgoing emails except for one user

I am currently managing an email server that is being handled by Exim 4.85 This server currently adds a footer to all outgoing messages. The line that adds this functionality can be found on several ...
0
votes
1answer
852 views

Disable logging ip adress to access.log in lighttpd

I have my webserver configured with lighttpd/1.4.31. About 80% of all entries in lighttpd's /var/log/lighttpd/access.log consist of my own ip address. I would like to disable my ip address logging ...