Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [logging]

Recording activity on the system (or of a particular program) for later reporting and analysis. Logins, logouts, web server page requests, etc might all be logged.

-1
votes
1answer
17 views

How to see all incoming requests to my server?

I have a third party app and I would like to see how it communicates with the server. Why kind of software/server I am supposed to run to log all possible connections attempts to all possible ports? (...
0
votes
1answer
15 views

Tomcat - Application logs can't be cleared without stopping

I have some Tomcats where the application log (the one with [tomcat name].[hostname].[node].[webapp].log name format) can't be cleared unless I stop the Tomcat and clear the log. The log size turns ...
0
votes
1answer
28 views

Do not log successful apache requests

I want to get rid of superfluous logging in Apache. I've find tutorial how to use setenvif module for that purpose, setting variable dontlog. The only problem is, I don't see on the criteria list ...
0
votes
1answer
10 views

Filter docker messages from syslog

Looks like docker is writing duplicate messages to syslog. For instance Mar 6 23:53:45 ip-xx-xxx-xxx-xx docker[45287]: 2019/03/06 23:53:45 GET 200 xx.xxx.xxx.xxx /cas/...
1
vote
0answers
24 views

Apache CustomLog using Content-Type

Using Apache 2.4, I am trying to create a custom log file format which will only log out page views, instead of all request resources (images, css, etc). The site is built using PHP and therefore the ...
0
votes
1answer
21 views

logstash charset error (gelf)

I had some trouble with Logstash and Nginx (all running on Docker). On my docker-compose file i was trying to enable logging from Nginx container to Logstash: nginx: container_name: nginx image: ...
1
vote
2answers
27 views

How can I extract tag from syslog message, and us it as path variable?

I have severals servers logging to the central syslog server, which collect the logs using syslog-ng. I send logs with a tag using the logger command : $ logger -n 01.02.03.04 "Hello from $HOST at $(...
0
votes
1answer
12 views

Unique ID for sftp user in log

I am logging SFTP behaviour in /var/log/auth.log. Output looks like this May 27 05:58:16 test-server sshd[20044]: User child is on pid 20049 May 27 05:58:16 test-server sshd[20049]: subsystem request ...
2
votes
1answer
33 views

Rsyslog, exclude logs

i have a custom daemon that gives logs to rsyslog facility "local1" with two security levels - "info" and "debug". I need to write "info" logs to /var/log/info and "debug" logs to /var/log/debug. I ...
-1
votes
0answers
43 views

logger or echo dont save logs to /var/log/syslog nor to container logs

I have docker host with one container, I am logging to container as below docker exec -it containerA /bin/bash , then I execute logger text > /proc/self/fd/1 output is not shown in /var/log/syslog ...
0
votes
0answers
24 views

log4j2 in Tomcat 8: Unexpected log rotation

I tried to fix a log rotation problem with log4j2 in a webapp running on Apache Tomcat/8.0.32 (Ubuntu) on Ubuntu 16.04.4 (see related stackoverflow question). Tomcat runs on OracleJRE 1.8.0_181. I ...
2
votes
1answer
32 views

How to prevent Git client hanging during post-receive hook

I have a Git repository that contains a collection of config files and python scripts. On the server repository, I have a post-receive hook that will: checkout the master branch, setup a python ...
4
votes
2answers
55 views

Reducing the verbosity of auditd, my minimal rules catch stuff they should not (apparmor)

My auditd rules and my needs are fairly simple, I want only to log root actions. # auditctl -l -a always,exit -S all -F euid=0 -F perm=x -F key=ROOT_ACTION That is the only rule, and it works: type=...
0
votes
0answers
27 views

Support for extended ASCII characters in rsyslog

My rsyslog server is not able to correctly decode messages containing extended ASCII characters such as some french letters; e.g. é, ç. I have done a lot of search in google and tried many things but ...
1
vote
2answers
527 views

How can I see in Windows Server 2012 AD what users were logged in to certain computers

Is it possible with Windows Server 2012 AD what users were logged in to certain computers? I would like to see list of all users that were using some computer. i.e. logged to certain computers ever or ...
0
votes
0answers
19 views

Real-time viewing of XML logged events

I have a number of systems that generate XML events and I want to record these events centrally so they can be viewed in realtime. The only thing the different events have in common is that they are ...
0
votes
2answers
35 views

Is there unique information or other reasons a Windows event 'Message' should not be discarded?

Perhaps showing my ignorance, but is there any reason to keep the Message from a Windows event, when ingesting into a log system? Is it the case that these are composed of data from other attributes, ...
1
vote
0answers
46 views

SSHd logs in Docker container not shown by `docker logs`

When using CMD ["/usr/sbin/sshd", "-D"] in a Dockerfile, docker logs does not show the logging: cat > Dockerfile.stdout <<EOF FROM alpine:latest RUN apk add --no-cache openssh-server \ ...
0
votes
0answers
35 views

Apache log issue: AH00082: an unknown filter was not added: :

My error_logs are annoyingly filled with the following: [date] [core:error] [pid 1097:tid 1399] [client 123.123:123] AH00082: an unknown filter was not added: : I have seen references to similar ...
0
votes
0answers
35 views

Missing 503 responses in NGINX logs

I can see in my backend application logs that we're sending 503 responses. Yet I cannot find the corresponding log lines in the NGINX error.log or access.log. Do I need extra configuration to include ...
1
vote
0answers
37 views

Disable logging of requests from certain IPs apache2

I wan't to stop logging accesses from two of my local IPs, this is what I added to apache2.conf: ... <VirtualHost *:80> SetEnvIf Remote_Addr "192.168.0.1" dontlog SetEnvIf Remote_Addr "192....
1
vote
1answer
41 views

How to check which DNS Alias is used to access the server?

I have a host with a database installed on it. In order to access the database, the clients use a DNS Alias (CNAME) - AliasOne - and the database port. DNS Aliases are managed by colleagues in ...
0
votes
1answer
23 views

How to view memory usage of containers after reboot?

I have Docker containers running on my Ubuntu machine. Every so often (couple weeks) it becomes completely unresponsive. I suspect it's a memory leak issue with one of the containers. How can I view ...
0
votes
0answers
10 views

saving day old log files in /var/log/apache2/rotate with compression

One of the production servers at my work has a /varlog/apache2 directory that looks like this: servername.com-access.log rotated/servername.com-access.log-20190127 rotated/servername.com-access.log-...
0
votes
0answers
23 views

nginx save every request every made including headers

I want to set up a nginx rule that will log every request ever made on my site including cookies. For example for a single php script I can get the full request body with this code: print_r($_SERVER);...
0
votes
1answer
36 views

Logcheck doesn't have permission to read log files

I use logcheck to monitor log files, but instead of receiving reports by email I want to send them outside with bash script. So I've used -o: sudo -u logcheck /usr/sbin/logcheck -o 2>&1 | ...
0
votes
0answers
27 views

What are these 404 log entries /-/-/-/-/-/-/-/-/-/-/?

These log entries /-/-/-/-/-/-/-/-/-/-/ (in the 404 logs of my WordPress Redirection Plugin) must be some sort of attempted exploit, but of what? Traversing the directories looking for something? ...
0
votes
0answers
32 views

Log parser for Prometheus

I am implementing Prometheus monitoring solution. The RED Method ensure the service provided by our application meet our SLO and SLA. Thus, we want to extract the Rate, Error and Duration from our ...
1
vote
0answers
28 views

Convert absolute time in log lines to relative intervals

Given a normal text-format line-oriented log file with timestamps in absolute form, is there any convenient tool that converts them to relative time-intervals? e.g. 2019-01-11 19:31:35 UTC LOG: ...
0
votes
0answers
20 views

Does Debian keep log message from initrd

I currently face issues with LVM scanning for devices during a boot of Debian Stretch. The entire OS (but /boot) resides on a LV. I can see the relevant warning messages on the console but they do not ...
1
vote
1answer
56 views

rsyslog/syslog-ng pattern to log ssh and related sftp session for an user

I'd like to log an user specific ssh and following sftp session into a file which would have username in the filename: I have this: Jan 8 13:43:38 mx1 sshd[84622]: Connection from 17x.xx.xx.xx port ...
2
votes
1answer
57 views

system center operation management ( SCOM ) log collection and full text searching

I want to collect all events in all windows servers (nearly 50 server) (from windows event viewer) in SCOM, and full text search on it. My question is: how can I do it?
0
votes
0answers
29 views

nginx log application prefix

I want to separately log location prefix to access log. location /app1/ { proxy_pass http://backend1; } location /app2/ { proxy_pass http://backend2; } Right now my log looks ...
2
votes
1answer
129 views

Run a backup script at systemd shutdown (e.g. copy logs to S3 before instance termination by auto scaling)

I am trying to send log files to S3 before instance termination. I created .service file in /lib/systemd/system-shutdown/upload-backup.service, which is this. Description=Testing Before=shutdown....
1
vote
1answer
56 views

What is required for logging start/stop of the service?

I would like to log entry when some service was started/stopped. For example this post (Last restart/start time of a windows service) explains how to view logs. The problem is, when I start/stop ...
1
vote
0answers
58 views

Details Log on IIS 8.5

On my IIS log I found errors that occur randomly when a client calls my WCF service. The error log is this: #Software: Microsoft Internet Information Services 8.5 #Version: 1.0 #Date: 2018-12-13 10:...
0
votes
1answer
31 views

How to let netfilter trigger a userspace hook when logging?

I would like to immediately process certain types of packets if/when they arrive with a custom (bash) script. As NetFilter is kernel space, I understand I need to look for a userspace logging tools ...
1
vote
0answers
30 views

Log loadballancing using HAproxy

I'm trying to loadballance logs to a pool of rsyslog server using HAproxy but I'm failing to find a suitable solution when the source is a single client. HAproxy opens a session to one of the backend ...
1
vote
0answers
60 views

Journalctl seems to be ignoring since and until

I'm trying to get the logs of a problem that's been happening for over a week by this point. I'm trying to use journalctl to print the logs but it doesn't seem to give me anything more or less than ...
1
vote
1answer
104 views

Kubernetes upgrade to 1.13.0 gives Forbidden error on kubectl logs

I've recently upgraded my on-premises Kubernetes cluster from 1.12.1 to 1.13.0 for obvious reasons, but now my kubectl running on the master node cannot get the container logs anymore from any node, ...
0
votes
0answers
55 views

Where to find logs from Postgres 11.1 on FreeBSD 11.2?

Having built Postgres 11.1 on my FreeBSD 11.2 machine, where might I find the logs output from Postgres. Specifically, when attempting to start Postgres for the first time, I get an error message ...
1
vote
1answer
64 views

How to ignore event source log

I have an event source running regularly. The problem is that http-get-dos from fail2ban will catch the IP if the user left the tab open for a large amount of time. So , I am thinking, how can I ...
1
vote
4answers
80 views

How do i remove the path names from the files i have archived.. UBUNTU

I've been tasked to archive certain files into a new directory at /home/archive/. I used this command: mkdir /home/archive cd /home/archive tar -cvf log.tar \ /var/log/auth.log /var/log/...
0
votes
0answers
24 views

Logs stopped on FTP server

I have FTP server which is receiving logs from Cisco-WSA, but suddenly the logs stopped, Checked the vsftpd service it's up and running, restarted it multiple times too. Checked telnet on ftp ...
0
votes
0answers
20 views

Heroku logging on papertrail gone missing?

I have a ruby app on Heroku that crashed. I'm trying to track down the logs to figure out why. When it crashed, after I rebooted, I looked at the logs, but it deleted the logs from before the reboot....
1
vote
1answer
62 views

AWS Elastic Beanstalk S3 log archiving and instance termination/recreation

I've recently moved an application to Elastic Beanstalk. I'm currently in the process of setting up log files to be archived. One of the business requirements is x days of log retention, which is ...
2
votes
0answers
28 views

BIND logging - general vs. unmatched

The BIND9 Administrator's reference manual states that the general category is "the catch-all; many things still aren't classified into categories, and they all end up here." On the other hand, the ...
0
votes
1answer
119 views

What is localhost.webcache in tcpdump

I'm trying to verify that a user is actually logging into my machine and I figured out that looking at tcpdump would be reasonable. I'm using the new omhttp module for Rsyslog to send logs via http ...
1
vote
1answer
51 views

How do I use Nagios to monitor a log file that generates a random ID

This the log file that I want to monitor: /test/James-2018-11-16_15215125111115-16.15.41.111-appserver0.log I want Nagios to read it this log file so I can monitor a specific string. The issue is ...
0
votes
1answer
61 views

Why doesn't my docker actually log anything?

I have the following python file: import time from datetime import datetime while True: time.sleep(1) print(datetime.now()) I've added it to a Dockerfile: FROM python:3.7 WORKDIR /...