Questions tagged [logging]
Recording activity on the system (or of a particular program) for later reporting and analysis. Logins, logouts, web server page requests, etc might all be logged.
2,845
questions
0
votes
0
answers
19
views
Error handling in Cloud functions - Cloud Logging
I have a series of cloud functions and I want to get an alert when errors occur in them. I already have the alert set and it works.
I decided to use the Cloud Logging logs: functions.logger.error(...
google-cloud-platform
0
votes
0
answers
22
views
access.log of Nginx filling up space (Ubuntu 22 Server)
Recently I have deployed my website using node.js server and using Nginx as reverse proxy, also nginx handles SSL, and forwards the https to http server of node.js running at specific port. I am using ...
1
vote
0
answers
18
views
View logs from short lived containers in docker stack
Similar to this question, but with the intricacies of the docker stack added.
While debugging short lived containers on vanilla docker is "easy", you just do docker logs -f "...
0
votes
1
answer
39
views
Apache how to find cause of 404 with rewriterule ignored
So I have this
RewriteCond %{REQUEST_URI} (da-dk)/(.*)(/|\.php)$
RewriteRule ^(da-dk)/(.*)(/|\.php)$ /$2$3 [L]
But for some reasons example.com/da-dk/ gives "404 - not found"
I would like ...
- 97
0
votes
0
answers
42
views
Add mac address in rsyslog template
I am trying to add system/device mac address in syslog. No solution is working for me. Following command gives me mac address, just wanted to use in rsyslog template.
mac_addr=$(ifconfig en0 | awk '/...
1
vote
0
answers
15
views
LogStash and parsing OPNSenser logs
My logs are coming in as follows:
<134>May 24 14:39:32 edge.internal filterlog[2535]: 78,,,ffe6d10d1f27a42fc0edc3abb3a6d333,ovpnc1,match,pass,out,4,0x0,,63,61951,0,DF,6,tcp,60,10.8.0.2,20.44.17....
- 3,881
0
votes
0
answers
20
views
PROMPT_COMMAND duplicating commands on new sessions
Im playing around with PROMPT_COMMAND variable
Was testing out some ways to save all commands into a log file and got some ways using PROMPT_COMMAND + logger + rsyslog
Example export im using
export ...
- 23
0
votes
1
answer
31
views
Loggin bash_history using UTC timestamp when not using UTC as system time
I am aware that it is possible to add timestamps to bash_history.
The examples I've seen so far it always uses the current system time. And here is the problem for me: On the one hand, I like to keep ...
- 17
1
vote
1
answer
61
views
Systemd service not logging
I have a systemd service. No logs appear from it despite my best efforts. This is the service file:
[Unit]
Description=Load Balancer
[Service]
WorkingDirectory=/home/lb
ExecStart=/usr/lib/jvm/jdk-20/...
- 111
0
votes
1
answer
51
views
Do not log access to some php scripts
I would like to exclude from access.log access to some php scripts.
To do this, I did the following:
location ~ ^/lib/exe/(jquery|taskrunner|css|js)\.php$ {
access_log off;
#...
- 1
0
votes
0
answers
20
views
Cron job is wokring fine but new cron logs are not adding in cron log file
i mistakely press wq! in cron log file located /var/log/cron now new logs are not updateing in cron log file i serach many thing like
remove cron file and touch /var/log/cron Steel not updateing
...
0
votes
1
answer
48
views
When logging out to journald, when would you use a library and when would you use systemd config options to pipe StdOut/StdErr to journald
I've found library's that allow logging out to journald which suggests that, yes you should use a library where possible and log to journald from inside your app.
But then there are tools like systemd-...
- 115
0
votes
1
answer
17
views
For rsyslog - to what facility do ssh and scp belong to?
I am trying to send all the ssh and scp error messages to a pipe and to configure this in the rsyslog.conf I need to know the facility for these services. Does anybody know this or a resource where ...
- 3
0
votes
2
answers
64
views
Logrotate group of files if any member is eligible
I have a group of log files (they are related but that's application level and not relevant). I want to set up logrotate configuration on Debian linux to rotate the whole group (all the files) once ...
- 147
0
votes
0
answers
23
views
Audit logging in Microsoft 365 doesn't work for one tenant
I am taking care of a few Microsoft 365 tenants and I set up audit logging for all of them.
One of these tenant only provides administrative audit logs but no user audit logs (for example no logs ...
- 1
0
votes
2
answers
37
views
How I can Log what and who can access and where my S3 bucket?
Recently I received an email in order to tell me that some IE connections has access to my bucket:
eu-central-1|media.myapp | REST.GET.OBJECT|TLSv1|9|[Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1;...
0
votes
0
answers
34
views
PHP-FPM slow log returning invalid results
The problem
I’m running PHP-FPM 7.4.30 under Apache 2.4 on RHEL 8, and I’m not able to get PHP’s slowlog to work properly. It won’t return valid information about long-running scripts.
When I enable ...
- 81
0
votes
0
answers
24
views
How to configure osquery with auditd
Who has expertise on how to work with osquery (or maybe you solved this problem):
Based on articles like this one - https://blog.palantir.com/auditing-with-osquery-part-two-configuration-and-...
0
votes
0
answers
96
views
nginx error logging generates upstream sent too big header while reading response header from upstream
When i add error_log('what ever') in my php scripts and there are to many in one script,
it generates a 502 error with "upstream sent too big header while reading response header from upstream&...
0
votes
0
answers
15
views
Apache Custom Error Log Entry
I have a rule in my Apache config like this:
<FilesMatch "xyz">
Order deny,allow
Deny from all
ErrorDocument 403 "Custom Response"
</FilesMatch>
In the error log it ...
0
votes
2
answers
47
views
Openldap LogLevel : Log timestamp in milliseconds
Does anyone know how to configure the Loglevel in Openldap to log milliseconds? The current loglevel 256 does log day and time (Jan 13 10:32:12). We have tried different levels none of them capable ...
0
votes
1
answer
28
views
using /usr/bin/script to record sessions, but readable .txt
How can I get the /usr/bin/script files to be "readable" .txt ?
For example I'm recording sessions like:
script "/path/`date "+%y%m%d-%H%M%S-term-session.txt"`"
When I &...
- 1
0
votes
0
answers
13
views
Nginx log record value in case of empty log_format variable
While trying to catch some edge cases i've noticed the difference in recording empty values.
Here is my example:
Nginx Log format part:
RCODE: $status | UPS: [$server_addr:$server_port|$server_name|$...
- 101
1
vote
2
answers
98
views
syslog-ng filter log by frequency to destination file
I have a syslog-ng that receives too many logs and I am trying a way to 'sample' them using some filter.
I assume editing the /etc/syslog-ng/syslog-ng.conf with something like
log { source(s_udp514); ...
- 109
1
vote
0
answers
32
views
Event Viewer works but logparser fails?
So, my Log Parser Query fails and states that the remote procedure call failed.
However, I am able to connect using the Event Viewer (which I hate); what does the event viewer use to connect that the ...
- 4,869
0
votes
0
answers
25
views
Discard less important logs during overload with fluentbit or fluentd
Assuming I could identify more or less important logs by pattern-matching them, is there a way to configure fluentd (or fluentbit) to do intelligent shedding (discards) when it starts to buffer to ...
- 541
0
votes
1
answer
352
views
In Rsyslog, how do you replace regex matches with custom text?
I'm trying to capture text via regular expression and replace the text with a custom string.
My current code successfully captures IP addresses, but I don't know how to replace the IP address with ...
- 3
0
votes
0
answers
8
views
Guard Authenticator hits
we have our codebase installed and rolling our from Google App Engine, using Compute Engine as well.
When looking back at the logs for a particular VM, I'm see a LOT of "Checking support on guard ...
0
votes
0
answers
58
views
SSL handshake error - log domain name with Nginx
Is it possible to extend SSL handshake error log to determine which domain was requested? Now I get log in the following format without any information about domain:
2023/02/27 12:27:58 [info] 60011#...
- 276
0
votes
0
answers
74
views
Squid Proxy Access logs not updating http_username when user uses different username
I'm using squid proxy on Ubuntu 22.04(LTS) with auth_param basic program /usr/lib/squid/basic_db_auth and it's working fine. I am able to add the users to the mysql database and able to use the proxy ...
-1
votes
1
answer
116
views
what the meaning of "logpath = %(nginx_error_log)s" in fail2ban jail log path?
I am running fail2ban on Ubuntu 20.04 server, and am looking over some of the default jails. In [nginx-http-auth] the default log path shows as logpath = %(nginx_error_log)s. What exactly does %(...
- 103
0
votes
0
answers
15
views
Access a log on a remote Windows server locally in near realtime
I am using Windows server 2019 and an application that creates .log text files.
I need a way to be able to copy these logs (well their contents) to another location via the internet in near real-time. ...
- 1
0
votes
1
answer
42
views
What is the proper way to configure Tripwire to handle automatic log rotations?
I installed tripwire by following this online documentation on a fresh ubuntu 22.x server. I followed the above documentation exactly and did not add any custom mods to either the cfg or the pol ...
0
votes
1
answer
45
views
Multiple logging managers for different services, or one with multiple databases (graylog)
I am creating a logging infrastructure for a company with 2 unrelated services. Is it better to have:
a single graylog instance that routes the logs from the two services
to different elasticsearch ...
- 23
0
votes
2
answers
242
views
NGINX crashed and weird logs on access.log
When I came back home just now, I was checking my webserver if it was still running and I noticed that my NGINX server was not running anymore.
I tried to restart my NGINX a few times by running the ...
0
votes
1
answer
169
views
How to disable ssl_request log on Apache?
Our internal Apache instance on a Windows server is regularly filling up the disk with C:\Apache24\logs\ssl_request.log.yyyy-MM-dd.log logs.
They seem to be rotated, although their sizes vary (200 - ...
- 589
0
votes
0
answers
31
views
Is it safe to delete folders/files under run/log/journal (not var/log/journal)?
I'm running CentOS in EC2 and I saw this post but my path is run/log/journal and not var/log/journal. And there're two folders under journal - e76430a3b6eb....d3d1dc73 and b30d0f2110ac....3ce88f
So, ...
- 13
1
vote
2
answers
32
views
Filter CGNAT IPs from Log
I want to identify heaavy users on a web API I would like to ignore CGNAT IPs . I looked at https://www.rfc-editor.org/rfc/rfc6598 Is this mandatory or can an ISP use any given IP ?
Is there a List ...
- 11
1
vote
0
answers
77
views
looking for "access denied" server log entries on network shared print jobs (Windows) after removing the 'Everyone' group
In an effort to try to remove the ability for users to print directly to an MFP shared printer, relegating the users to use their badge ID for more secure printing while in the office... Currently ...
- 11
1
vote
1
answer
207
views
postfix mail to relayhost gets bounced dsn=5.0.0: how to debug?
Postfix sends mail to relayhost, but relayhost bounces back with dsn=5.0.0 and no further details.
Q: How can I debug this in detail so that I can find out where I made the mistake?
Setup:
smtp-client....
- 23
0
votes
0
answers
13
views
apache httpd is returning response code 415 as per access_log, How to get full input, with data and all the header values
My endpoint URL is working with sample data, and in Test environment.
In production, apache httpd is returning response code 415 as per access_log, How to get full input, with data and all the header ...
- 101
0
votes
0
answers
86
views
nextjs/pino transport to aws linux2 syslog
I'm building my first NextJS project, and am using the recommended Pino for logging. This has worked great in development, but now I'm trying to figure out how to deploy it to production.
I think the ...
- 389
0
votes
2
answers
33
views
Will my Harddisk still be written when i delete a logfile in use on Debian?
Due some Bug testings there are tons of request made to my squid server on debian. Because it is a test i can't disable logging, restart the Server or block the requests. Due the growing size of the ...
- 131
0
votes
2
answers
352
views
fail2ban log activity even if IP has been banned anyway
I would like to know if there is a way to know if a banned IP is still trying to contact my server and what is he trying to do?
The fail2ban.log seems to show who has been banned, but not if a banned ...
- 3
0
votes
0
answers
42
views
For auditing purposes, how can we record all commands executed inside a kubernetes container?
We have enabled kubernetes audit logging that records the orchestration related activity.
Also, the underlying host audit logs have been enabled to capture the commands executed on the host.
But, once ...
- 1
1
vote
1
answer
177
views
How to debug what Windows Admin Center is doing?
I'm having issues with Windows Admin Center and the user interface doesn't really help troubleshooting them; thus I'd like to have a closer look at what WAC is actually doing with the servers it ...
- 69.7k
0
votes
1
answer
119
views
Import past log files into Sentry
We're exploring sentry.io
Is it possible to import historical logs into Sentry?
We're also looking at Prometheus and Grafana, and it looks like general SQL queries work for them, but it seems to me ...
- 131
-2
votes
1
answer
205
views
Splunk Universal Forwarder on Windows : how many logs to forward?
Splunk Universal Forwarded
Windows Server 2019
When configuring the forwarder, a large variety of logs can be forwarded :
Application Logs
Security Log
System Log
Forwarded Events Log
Setup Log
In ...
- 201
0
votes
1
answer
214
views
I can't find my Cloud Armour logs despite enabling them 15 mins ago. Is that kind of delay normal?
I'm trying to debug a waf rule. I've set it to preview in Cloud Armour and checked the policy is applied to all 3 of my services. I then went into Load Balancer and clicked edit (there's only one load ...
0
votes
0
answers
541
views
php-fpm access log to rsyslog
I am trying to find a solution for getting logs from php72 php-fpm yii2 application behind nginx on several numbers of servers:
at now application writes its logs to files on server disk, yii performs ...
