Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [logging]

Recording activity on the system (or of a particular program) for later reporting and analysis. Logins, logouts, web server page requests, etc might all be logged.

0
votes
0answers
3 views

tomcat logging per context instead of catalina.out

Using logging.properties and the default tomcat 8 juli (java.util.logging) logging, is there a way to configure logging such that all logging for context ABC goes to log ABC.log instead of ( or in ...
0
votes
0answers
12 views

Can docker log levels be made useful by actually filtering by level?

mag 21 16:58:17 computer dockerd[13008]: time="2019-05-21T16:58:17.345353593+02:00" level=info msg="ccResolverWrapper: sending new addresses to cc: [{unix:///var/run/docker/containerd/containerd.sock ...
0
votes
1answer
26 views

Trying to send output to log file with tee using systemd but the log file isn't being created?

I want to run a node application via systemd and have its output go to both stdout and a log file. The node app is in the folder named www/www.appname.com and I want to have the log file in www/log....
1
vote
1answer
149 views

Why SSL does not work between my 2 servers?

I have 2 servers with Ubuntu 18.04: monitoring.example.com (with ELK on a single server) www.example.com (with Filebeat) on the server ELK Create directories to store SSL certificates $ sudo mkdir ...
1
vote
0answers
33 views

Writing MongoDB logs to a remote logging server

I am trying to forward MongoDB logs from several remote servers to a central logging server. To do this, I changed my mongod.conf files to use syslog like so: systemLog: destination: syslog ...
0
votes
0answers
8 views

PSAD only send notifications for scans coming from a given IP range

I installed PSAD on a honeypot-kind of installation, the idea is to catch the port scans coming from within my organization's network. The organization has a class B network, and for the love of me ...
0
votes
1answer
96 views

Why can't set bin log for MariaDB in Debian 9?

It is simple to set bin log for mysql in centos,just uncomment the line in /etc/my.cnf. Before uncomment in my.cnf. #log_bin = /var/log/mysql/mysql-bin.log Uncomment it in my.cnf. log_bin = /var/...
0
votes
0answers
12 views

Modified X-Forward-For header does not show up in logs

I am running a haproxy behind the aws ALB. In order to prevent logging spoofed IP addresses in the haproxy we are modifying the X-Forward-For header taking the last IP only from the list using: http-...
0
votes
0answers
35 views

Logrotate not removing the logs

I have the following logrotate script /path/to/folder/*.logs { daily rotate 30 notifempty sharedscripts copytruncate compress dateext preremove if file --mime-type "$1" ...
0
votes
0answers
18 views

Firewalld Logging

Im using firewalld on my centos7 router [192.168.1.254]. Through the router im forwarding all packets @port 22 & 80 to 192.168.1.10 [another centos7 workstation]. Please advise how may I log all ...
0
votes
0answers
26 views

Logging - Apache Access log Unknown Characters Ubuntu

Hi I would like why access.log on apache looks like this? Could someone help me? at the bottom part it appears appears to be good. ^_?^H^@^[D?\^@^Ciym?\x??^K~?_?O?HeR"^33 ^[>>?RwIe^R??^...
0
votes
1answer
50 views

Stackdriver logs stopped appearing in GCP Stackdriver Logging Console

Background I have a Flask server running on GCE's container-optimized image. This server prints a log for every request. Normally, I can view the logs my application prints in GCP Stackdriver Logging ...
-1
votes
0answers
50 views

In regards to the W3C log format for IIS what does the sc-win32-status mean?

I don't really know what this means, I did however notice from another question that if I type net helpmsg # in cmd I'll get a result. Where do these numbers and where do they come from? Are they ...
2
votes
2answers
114 views

Best practices for giving outside developer SSH access?

N00b here - I'm upgrading my website so that it isn't using a deprecated version of MySql/ PHP. I'm not comfortable enough with the code so I'm using an outside developer. Due to this being database ...
0
votes
1answer
67 views

Issue : log-rotate is not working

I am configuring log rotation one of my production server. I am having a weired issue. I have configured the log rotation for a file on daily basis. But unfortunately the rotation is not working. I ...
1
vote
2answers
42 views

Getting sensible information out of Windows Update log

I'm parsing history.log from debian hosts to produce a csv with dates/packages/versions. After running a suite of tests in testing environment, I then update those packages on actual hosts. I want ...
1
vote
0answers
42 views

Using linux environment variable in rsyslog template

I'm trying to add an environment variable to my rsyslog template. I tried using 'getenv()' function without any luck, I always get an empty string in return. I'm attaching an example of my rsyslog ...
0
votes
1answer
17 views

Logwatch does not report on httpd (apache2)

Problem: I'm using Debian GNU/Linux 8 and my Logwatch does not have a "Begin httpd" section at all for my Apache pools. /usr/share/logwatch/default.conf/logfiles/http.conf is set for some custom ...
0
votes
0answers
19 views

No new Jenkins logs being written

I just noticed my Jenkins last wrote jenkins.log in /var/log/jenkins for more than 6 months ago. This is from my Jenkins config: # log location. this may be a syslog facility.priority JENKINS_LOG=/...
0
votes
0answers
98 views

Unable to send php7.3 fpm-alpine error logs to std within docker containers

I cannot get the php-fpm error logs appear in docker std. So far I've tried many suggestions but for some reason no progress at all. I am posting my whole setup so that someone could kindly help me to ...
1
vote
1answer
35 views

Distinguish ssh connections from different origins behind NAT

I have a jump server, that many of the clients that connect to it, are sitting behind a NAT, unfortunately, all those clients also uses the same user to connect. Given I have root access for the jump ...
1
vote
0answers
63 views

TLS websocket proxy with deep packet inspection/traffic logging

I have a very specific scenario in which maschines (IoT) are communicating with a central server over websockets. I need to inspect the websockets traffic (wss/tls) for audit and monitoring reasons (...
1
vote
1answer
21 views

logrotate doesn't seems to work as expected

Below is my log rotation configuration for /var/log/messages. /var/log/messages { rotate 4 size 100M missingok notifempty compress delaycompress sharedscripts ...
0
votes
0answers
15 views

php fpm log executed script

when taking a look at my /var/log/php-fpm.log I notice a lot of [02-Apr-2019 18:01:16] WARNING: [pool wordpress] child 26356 exited on signal 11 (SIGSEGV - core dumped) after 492.828741 seconds from ...
0
votes
1answer
26 views

Appending new lines in Tomcat Catalina log rotate

Application running on Tomcat is using log4j for some unknown reason is appending (randomly) new log lines somewhere in the middle of the log file log4j.properites looks like: log4j.rootLogger=INFO, ...
2
votes
0answers
45 views

What causes these strange characters (@^@^@^@^) in /var/log/messages? [duplicate]

One of my servers stops responding occasionally, today I checked the logs and I seen the attached entries. I assumed it uses too much memory and crashes, but seeing this log, I am not sure, what can ...
0
votes
0answers
37 views

IIS operation cancelled by client is logging response code 0 instead of 500 after request header logging

We have IIS 8.5 hosted REST based Web API services. The default logging is W3C format. Client can cancel the ongoing request and these are logged with the status code of 500. When request header ...
0
votes
0answers
24 views

What all does a system state restore point save the state of in Windows Server 2016?

I'm fairly certain, all though not all together certain that it saves / restores the state of: The Registry Installed Software Server Settings (which I would assume generally get installed in the ...
0
votes
1answer
37 views

Extracting responses from Microsoft DNS Server Analytical logs

Is it possible to extract the DNS responses from Microsoft DNS Server Analytical logs (Microsoft-Windows-DNS-Server/Analytical)? The logs contain a field called "PacketData" in the EventData section ...
0
votes
1answer
19 views

Configuring Apache to log referrer url

I'm trying to make Apache server log the referrer URL in all requests including 404 and 200 for example someone has embedded an image hosted on my websites on his own website. the image is loaded ...
-2
votes
1answer
22 views

How to see all incoming requests to my server? [closed]

I have a third party app and I would like to see how it communicates with the server. Why kind of software/server I am supposed to run to log all possible connections attempts to all possible ports? (...
0
votes
1answer
23 views

Tomcat - Application logs can't be cleared without stopping

I have some Tomcats where the application log (the one with [tomcat name].[hostname].[node].[webapp].log name format) can't be cleared unless I stop the Tomcat and clear the log. The log size turns ...
0
votes
1answer
38 views

Do not log successful apache requests

I want to get rid of superfluous logging in Apache. I've find tutorial how to use setenvif module for that purpose, setting variable dontlog. The only problem is, I don't see on the criteria list ...
0
votes
1answer
52 views

Filter docker messages from syslog

Looks like docker is writing duplicate messages to syslog. For instance Mar 6 23:53:45 ip-xx-xxx-xxx-xx docker[45287]: 2019/03/06 23:53:45 GET 200 xx.xxx.xxx.xxx /cas/...
1
vote
0answers
29 views

Apache CustomLog using Content-Type

Using Apache 2.4, I am trying to create a custom log file format which will only log out page views, instead of all request resources (images, css, etc). The site is built using PHP and therefore the ...
0
votes
1answer
29 views

logstash charset error (gelf)

I had some trouble with Logstash and Nginx (all running on Docker). On my docker-compose file i was trying to enable logging from Nginx container to Logstash: nginx: container_name: nginx image: ...
1
vote
2answers
78 views

How can I extract tag from syslog message, and us it as path variable?

I have severals servers logging to the central syslog server, which collect the logs using syslog-ng. I send logs with a tag using the logger command : $ logger -n 01.02.03.04 "Hello from $HOST at $(...
0
votes
1answer
20 views

Unique ID for sftp user in log

I am logging SFTP behaviour in /var/log/auth.log. Output looks like this May 27 05:58:16 test-server sshd[20044]: User child is on pid 20049 May 27 05:58:16 test-server sshd[20049]: subsystem request ...
2
votes
1answer
87 views

Rsyslog, exclude logs

i have a custom daemon that gives logs to rsyslog facility "local1" with two security levels - "info" and "debug". I need to write "info" logs to /var/log/info and "debug" logs to /var/log/debug. I ...
0
votes
0answers
155 views

log4j2 in Tomcat 8: Unexpected log rotation

I tried to fix a log rotation problem with log4j2 in a webapp running on Apache Tomcat/8.0.32 (Ubuntu) on Ubuntu 16.04.4 (see related stackoverflow question). Tomcat runs on OracleJRE 1.8.0_181. I ...
2
votes
1answer
51 views

How to prevent Git client hanging during post-receive hook

I have a Git repository that contains a collection of config files and python scripts. On the server repository, I have a post-receive hook that will: checkout the master branch, setup a python ...
4
votes
2answers
77 views

Reducing the verbosity of auditd, my minimal rules catch stuff they should not (apparmor)

My auditd rules and my needs are fairly simple, I want only to log root actions. # auditctl -l -a always,exit -S all -F euid=0 -F perm=x -F key=ROOT_ACTION That is the only rule, and it works: type=...
0
votes
0answers
49 views

Support for extended ASCII characters in rsyslog

My rsyslog server is not able to correctly decode messages containing extended ASCII characters such as some french letters; e.g. é, ç. I have done a lot of search in google and tried many things but ...
1
vote
2answers
531 views

How can I see in Windows Server 2012 AD what users were logged in to certain computers

Is it possible with Windows Server 2012 AD what users were logged in to certain computers? I would like to see list of all users that were using some computer. i.e. logged to certain computers ever or ...
0
votes
0answers
20 views

Real-time viewing of XML logged events

I have a number of systems that generate XML events and I want to record these events centrally so they can be viewed in realtime. The only thing the different events have in common is that they are ...
0
votes
2answers
37 views

Is there unique information or other reasons a Windows event 'Message' should not be discarded?

Perhaps showing my ignorance, but is there any reason to keep the Message from a Windows event, when ingesting into a log system? Is it the case that these are composed of data from other attributes, ...
2
votes
1answer
114 views

SSHd logs in Docker container not shown by `docker logs`

When using CMD ["/usr/sbin/sshd", "-D"] in a Dockerfile, docker logs does not show the logging: cat > Dockerfile.stdout <<EOF FROM alpine:latest RUN apk add --no-cache openssh-server \ ...
0
votes
0answers
113 views

Apache log issue: AH00082: an unknown filter was not added: :

My error_logs are annoyingly filled with the following: [date] [core:error] [pid 1097:tid 1399] [client 123.123:123] AH00082: an unknown filter was not added: : I have seen references to similar ...
0
votes
0answers
98 views

Missing 503 responses in NGINX logs

I can see in my backend application logs that we're sending 503 responses. Yet I cannot find the corresponding log lines in the NGINX error.log or access.log. Do I need extra configuration to include ...
1
vote
0answers
41 views

Disable logging of requests from certain IPs apache2

I wan't to stop logging accesses from two of my local IPs, this is what I added to apache2.conf: ... <VirtualHost *:80> SetEnvIf Remote_Addr "192.168.0.1" dontlog SetEnvIf Remote_Addr "192....