Skip to main content

Questions tagged [logging]

Recording activity on the system (or of a particular program) for later reporting and analysis. Logins, logouts, web server page requests, etc might all be logged.

Filter by
Sorted by
Tagged with
0 votes
0 answers
8 views

Does Libvirtd record the start and end timestamps of a session when establishing a connection through the 'virsh' tool?

For instance, when initiating a connection to Libvirtd using the command 'virsh -c qemu+tcp://user@host/system', I attempted to locate the session logs within 'journalctl' and 'audit.log' but was ...
Ainur Sagirov's user avatar
0 votes
0 answers
61 views

My Wordpres site is consuming too much bandwidth [closed]

I have a website studiofutbol.com.ec and it is consuming too much bandwith, I installed awstats to have a better understanding on what is going on and I found this: Dynamic PHP Script file is ...
atrik's user avatar
  • 101
1 vote
1 answer
49 views

Can UFW log rule changes?

Is there a way to make UFW log changes made to firewall rules over time? I have some automated tooling that temporarily blocks IP addresses from time to time and there seems to be a foot-gun in there ...
John Rix's user avatar
  • 143
0 votes
1 answer
45 views

How to see logs older than 12 hours in Azure

I've turned on app logging to stream the logs. The problem's that the streamer is only active in 12 hours (and default timout is 2). Certain issues in our case occur rather rarely, so when a user gets ...
Konrad Viltersten's user avatar
1 vote
1 answer
79 views

How can multiple NGINX pods in Kubernetes write logging into their own separate files?

I have an NGINX installation (used as a web proxy) inside a built Docker image in Kubernetes that will eventually have to be upgraded to run multiple pods to handle the traffic volume. The log output ...
semmelbroesel's user avatar
0 votes
0 answers
6 views

Elasticsearch Lifecycle policy losing configuration

I have Kibana, Elasticsearch, and Filebeat running in an AKS cluster. Filebeat is configured to capture logs from a few applications in my cluster, send to an index created each day, apply an ingest ...
Ricardo Lima's user avatar
-1 votes
0 answers
11 views

Getting insight on network activities to decide IPTables rules

I'm trying to decide on IPTable rules for a system but I'm not 100% sure of everythings that needs to be able to talk to it so I'm trying to log every network activity to analize. I've gave a look at ...
Erick Jorge Louis Mendes Nolet's user avatar
0 votes
0 answers
36 views

How to view the springboot logs stored on s3 bucket using loki promtail EKS

After enabling the loki on EKS with S3 storage, the folders (fake,index,loki_cluster_seed.json) are created inside the s3 bucket . s3_bucket_folder What this each folder consists & how the logs ...
saranya dec19's user avatar
0 votes
0 answers
30 views

Peak in access log when playing around with cookie consent

One day we made some tests with cookie consent, including disabling it for a short time and switching to another cookie banner provider. On this day, the requests and unique users in server's access ...
Abid's user avatar
  • 135
0 votes
0 answers
24 views

How to Reduce Log Storage Volume on GCP (aka delete logs) when documented methods fail

I need to somehow reduce the cost of GCP Log Storage after excessive logging event. gcloud logging logs list and then gcloud logging logs delete does not help, the logs are still accessible and the ...
Jay Z's user avatar
  • 1
0 votes
0 answers
26 views

Unreadable Outlook Log Files

For a few weeks now we have two users who need to login into a "domain-login"-window upon starting outlook. We suspect our crm or ad fs to be responsible but can't know for sure. Therefore I'...
lkswtf's user avatar
  • 1
0 votes
0 answers
35 views

K8s and Linux Audit Logs Missing From Splunk OTEL Collected Logs

I'm migrating from the Splunk Connect for Kubernetes Helm Chart to the SignalFX Splunk Otel Collector Helm Chart. I'm having trouble translating the custom filters that we have in the SCK chart to add ...
Dejon Gill's user avatar
0 votes
0 answers
25 views

how do I make powerdns-recursor log its match to its RPZ?

I have powerdns-recursor on hundreds of machines set up with a rpz zone loaded from a distant server. Everything works fine. The rpz contains only malware domain to avoid, so on most machines I need ...
dominix's user avatar
  • 456
0 votes
1 answer
77 views

Configure what gets logged in event viewer

My server generates around 2.5GB of logs everyday and i just cant store it, upon some investigation i discovered that of my 854,608 logs 394,880 of them looks like this: The Windows Filtering ...
Afor's user avatar
  • 3
0 votes
0 answers
79 views

Collecting logs from Kubernetes container file system (not from stdout or stderr)

I am trying to find a way to get Promtail collect logs from a container file system. These logs were not generated using the standard output, which automatically gets discovered by Promtail. They have ...
kloudkid's user avatar
0 votes
0 answers
46 views

Kubernetes pod name or print something unique in the pod logs entries or any alternative (rsyslog implementation)

I have implemented Rsyslog server for fetch the pod logs from EKS nodes (Rsyslog client). Everything is working fine but in the logs I need pod name or something uniq to identify the log entries ...
Harish KM's user avatar
0 votes
1 answer
55 views

Is there a way to prevent log spamming with rsyslog?

I have AuditD running and one process like to constantly spawn children processes that do the same activity. Is there a way to have rsyslog not send in the same log message again? The hard part is the ...
Jason's user avatar
  • 3,941
0 votes
0 answers
28 views

Detect spurious non http/https traffic on nginx and tread differently

I have a nginx server that's facing internet and listening to http and https. I am trying to process the logs (with graylog) but there is some non http/https traffic that is breaking my import process,...
aseques's user avatar
  • 709
0 votes
1 answer
52 views

Fresh Apache (re-)install ignoring default vhost

I was trying a few thing for a custom "default" Apache vhost and nothing seemed to work, I always got the /var/www/html/index.html served instead of other contents or errors I wanted to ...
Yosko's user avatar
  • 167
0 votes
0 answers
136 views

Re-configuration of rsyslog

Probably a bit of an "off-kilter" question, but I want to conduct some experiments with rsyslog. I'd like to configure it to log nothing except the messages that I send with logger. This is ...
Seamus's user avatar
  • 295
0 votes
0 answers
55 views

pam_unix logs: xrdp-sesman:session session opened for user USERNAME(uid) by (uid=0)

recently I found a lot of these type of logs: pam_unix(xrdp-sesman:session): session opened for user username(uid=some_uid) by (uid=0) From what I read is xrdp-sesmam-session that is "opening&...
res1's user avatar
  • 125
1 vote
0 answers
44 views

After creating relying party trust in ADFS, how to validate configuration is correct using SAML tracer

I created a relying party trust in ADFS. To test, I log into IDP, initiate link, select the relying party, enter credentials, then the application page will display. How do I perform this validation ...
rashmi byali's user avatar
0 votes
1 answer
273 views

Cannot add Kubernetes metadata as label to Loki container logs in FluentBit

I am trying to gather container logs in Kubernetes environment using FluentBit, Loki and Grafana. I would like to append Kubernetes Pod name as label so when I query the logs in Grafana, it would be ...
Balint Laszlo's user avatar
0 votes
0 answers
49 views

Fluentd tail config for HashiCorp Vault audit/server logs from stdout

I'm trying to figure out a way to get both the audit and server logs from HasiCorp Vault container (both logs go to stdout of the same container and they have a different structure): Audit example: ...
jacktaaniels's user avatar
0 votes
0 answers
34 views

Watchguard logs incoming SMTP connections has an dst_user entry. Where can I change this entry?

Hello fellow Exchangers, as mentioned in the title any incoming smtp connection is routed correctly to our onpremise microsoft exchange server and the logs look as described here: https://www....
erai's user avatar
  • 1
0 votes
1 answer
71 views

Nginx not logging after Logrotate

I've a nginx reverse proxy with custom log files (depending on hostname) pwd : /var/log/nginx/domain/fqdn.(log|err) Since some time (maybe after switching to Ubuntu 23.10), my log files are very often ...
guillaumearnx's user avatar
0 votes
1 answer
169 views

nginx custom log format to log header value when exists

environment setup I have nginx webserver and simple backend application. this backend app has custom response header in certain condition (for example: X-Real-Status) and it's running behind nginx as ...
sadegh mohebbi's user avatar
0 votes
0 answers
54 views

Looking to monitor activity regarding connection attempts to closed ports on my system, what log file in should i look in? Ubuntu

I'm looking to monitor activity regarding connection attempts to closed ports on my system, as part of a server side portknocking implemetation. However, I am confused about what log file in ...
kagami's user avatar
  • 1
0 votes
0 answers
50 views

Where can I find the output of exim's 'debug_print'? -- years later

There is an old thread: Where can I find the output of exim's 'debug_print'? (so yes I did search for existing questions, I did find an exact match , but I'm not allowed to comment + it's ...
GraemeV's user avatar
0 votes
0 answers
71 views

How to get MariaDB slow query logs to show up on RDS

I have a MariaDB instance on RDS which I would like to enable slow query logs for. Following the documentation, I've created a paramter group which is assigned to the database. When I make changes to ...
Toby Osbourn's user avatar
0 votes
2 answers
369 views

how can I configure All-in-one WAZUH for log retention?

I installed WAZUH all-in-one no kibana no elastics, and I want to write a code where I can make 40 days of log retention, Any advice or guides for this solution?
SSD's user avatar
  • 1
0 votes
0 answers
95 views

Changing nginx default log format sometimes doesn't work

I've recently set up fail2ban to work with my custom nginx logging format (called "main"), I have all my sites logging to a different *.access.log file. I still had to change the default ...
user9503's user avatar
0 votes
1 answer
263 views

Making Tomcat log in /var/log

I'm trying to make our Tomcat 9 server log its internal log in /var/log instead of ${catalina.base}/logs. I tried to change the destinations in logging.properties, but the logs directory in ${catalina....
Alexis Dufrenoy's user avatar
0 votes
1 answer
142 views

Postfix Log - Get entries for certain mail only

The standard Postfix log Format is something like Feb 4 15:03:53 mail postfix/smtp[31148]: xyz The 31148 seems to be the process id, so this does not necessarily change if I send another mail. At ...
Netnoob's user avatar
  • 11
1 vote
2 answers
458 views

Syslog-ng multiple filters

I am fairly new to syslog-ng and I have the following issue. I have a Checkpoint firewall that sends the logs to a Splunk server. Due to the huge amount of data sent by the firewall, I tried to filter ...
Daniel D.'s user avatar
0 votes
0 answers
54 views

The way of logging at action of controller in Ruby on Rails for debug purpose

I am just trying to know if router is reaching to specific action of controller. In js, we are using console.log and var_dump in php. I tried with puts but it didn't work and I think it's because of ...
Alan Daniela's user avatar
0 votes
0 answers
202 views

How to be sure to keep all the logs regarding a MySQL table data but filter Google Cloud SQL maintenance queries logs made by localhost GCP SQL?

I enabled the flag General_log for a Google Cloud SQL MySQL instance to get all the queries logs in Google Cloud Logging. I get all the queries users make, but also all the queries made to probe and ...
jwtrees's user avatar
  • 111
0 votes
1 answer
161 views

Why rotatelogs from apache produce files smaller than specified max size?

I use the following rotatelogs command from Apache : /usr/sbin/rotatelogs /var/log/somelogfile 1GB If I send 1GB of content to it (for testing), it produces the following files : somelogfile....
tigrou's user avatar
  • 111
0 votes
1 answer
177 views

What do these logs mean? Is someone attempting to hack into my server via ssh?

Today I woke up to a a very large number of logs for ssh, and I can only assume someone is trying to gain access to my linux server. Here are the logs -- Logs begin at Wed 2023-08-02 08:59:10 EEST, ...
Codrut's user avatar
  • 111
0 votes
1 answer
84 views

Microsoft Defender: extract Automatic log upload data

Is there a way to extract this automatic log upload table from defender: my goal is to use this information to aid in responding to the System alert: Cloud Discovery automatic log upload error alert ...
HarriS's user avatar
  • 101
0 votes
3 answers
776 views

Exchange Server: Is it possible to find out which user marked an email as read?

We are running a self hosted Exchange 2016 Windows Server 2016 Datacenter. There is a shared mailbox used by multiple users. Users have been told to mark emails in this account only in special cases, ...
Thariama's user avatar
  • 106
0 votes
0 answers
40 views

SSH_CLIENT variable bringing the server's IP instead of the client's IP when connecting via SSH

I need to monitor the SSH access logs of an Oracle Linux Server 7.9 to determine which machines accessed this server throughout the day. However, the logs display the IP of the server itself instead ...
Guilherme Oliveira's user avatar
0 votes
1 answer
134 views

What IAM permissions are required to change audit log settings in Google Cloud?

In our Google Cloud project, we have granted the following IAM roles to certain users, but they are unable to make changes to the audit log settings. Project Editor Logging administrator When I try ...
Tanaka's user avatar
  • 1
0 votes
1 answer
111 views

Apache LogFormat: what does %f mean?

I have checked the apache logformat from - https://httpd.apache.org/docs/2.4/mod/mod_log_config.html I am not able to understand what does "%f" parameter mean in apache log format. The ...
Yogesh Tembe's user avatar
1 vote
0 answers
187 views

What solution to use in order to visualize journald/syslog logs via a Web UI (e.g. self-hosted web app, web page or plugin for Nagios and friends)

I am running a single virtual, private root server (VPS) and finally managed to setup all daemons to nicely log to syslog. All logs are collected by journald and organized into sylog facilities (mail, ...
user2690527's user avatar
-2 votes
2 answers
451 views

What updates `/var/log/btmp`? How to stop it?

Before providing an answer, please read the question till then end. ESPECIALLY THE SECTION on "Solutions" I am not looking for! I have a server which runs SSH on a public IP address. ...
user2690527's user avatar
1 vote
2 answers
740 views

Can a service managed by systemd send its logs somewhere other than /var/log/messages?

We have a RHEL 8 server where we have a few python applications installed for data management and analysis, notably JupyterHub and Airflow. We have these set up with systemd unit files so we can start,...
raphael's user avatar
  • 171
0 votes
0 answers
167 views

Is there a Apache module can fully log HTTP requests, in a non processed way?

I'm looking for an Apache module that is able to log the RAW content of HTTP requests, unprocessed. Here is one example : POST https://foobar/ HTTP/1.1 Host: foorbar Connection: keep-alive Content-...
tigrou's user avatar
  • 111
0 votes
0 answers
1k views

How to get output of STDOUT to GCP cloud logging

Hey I have a job running on a gcp VM where some imported libraries are logging to stdout with the print or python logging library, and I also have written a lot of code where the output is logged to ...
Matt Elgazar's user avatar
1 vote
1 answer
431 views

Discover process that exhausted my memory and CPU limits on Ubuntu

I have a DigitalOcean droplet running Ubuntu 22.04.2 LTS (GNU/Linux 5.15.0-89-generic x86_64). My website went down at approximately Fri Dec 01 6:48 AM GMT. From var/log/apache2/access.log, I ...
Jaime Montoya's user avatar

1
2 3 4 5
59