Questions tagged [logging]

Recording activity on the system (or of a particular program) for later reporting and analysis. Logins, logouts, web server page requests, etc might all be logged.

Filter by
Sorted by
Tagged with
0
votes
0answers
13 views

Amazon CloudWatch Agent Logging Error and Output

I am having an issue with CloudWatch Agent on a specific EC2 instance. I have tested on several other instance with no issue. I have attached the defined CloudWatch Agent IAM Role specified here to ...
0
votes
0answers
10 views

A generic ad-hoc colourizer for output, based only on regexes on the command line?

When I use grep with colour (by default) it will highlight the matched text in red. This is very helpful. But (absent -A/-B/-C args) it doesn't show lines that don't match. Is there any unix command ...
1
vote
1answer
53 views

My Node.JS program running on an internet-facing server is printing impossible text to the stdout log. Have I been compromised?

(EDIT: Turns out the "strange behavior" is explained by a simple oversight. Keeping this question here in case anyone else overlooks it) I hope I am asking this question right. I have a ...
0
votes
0answers
14 views

Apache log analysis tool for mod_logio output

I've set up Apache log files to collect both the request and answer size with mod_logio and its combinedio log file. I hope it will help me get a better understanding of the POST and PUT requests ...
1
vote
0answers
21 views

CentOS USER_CMD logs auditd

We are trying to start logging all executed commands by users (including root) on CentOS using auditd with type=USER_CMD, how we can do it? We already getting commands, starting with sudo, but not ...
-1
votes
0answers
11 views

Logs filling up disk due to huge number of 403 errors coming from proxy attempts on my Apache2/Ubuntu server?

I have an Ubuntu/Apache 2 web server I set up recently. I quickly ran into a problem with proxy abuse, which I documented here: https://superuser.com/questions/1644188/i-disallowed-use-of-proxy-...
-1
votes
0answers
23 views

How Do I Set Permissions on lastlog to 660?

sudo chmod 660 lastlog. Perms are changed to 660. Reboot VM (Ubuntu 20.04 LTS on GCP) lastlog perms reset back to 664 I have no idea what is doing this. How to I get 660 to stick? Googled for an hour ...
-1
votes
0answers
14 views

How to stop Apache logging new line \n requests?

how to stop this requests in my website access.log? 1.2.3.4 - - [08/Apr/2021:04:36:22 +0200] "\n" 400 3066 "-" "-" I have already tried with this SetEnvIf directives in ...
0
votes
0answers
20 views

Can you anonymise all IP addresses in AWStats, and delete previous history logs?

In AWStats, is it possible to anonymize all IP addresses, so stats are generic as possible and reduce any links to personal information? Also, is it possible to disable AWStats from saving history ...
0
votes
0answers
23 views

Showing journalctl log entries with relative timestamps?

I am using journalctl (from systemd v237) to look at some logs for some systemd logs. By default it shows the timestamp of the log entry on the left, in the email date style. Is it possible for ...
1
vote
0answers
37 views

6281 Event failure

In our network, we are receiving constant event failures in this category. Can somebody explain what may be the reason? Event 6281 occurred at 02-04-2021 10:07:16. Date Time: 02-04-2021 10:07:16 Event ...
0
votes
1answer
17 views

Identifying user activity/processes from log message on remote machine - 10.0.0.2 - user A, using service account B trying to connect to 10.0.0.3

I just inherited an older Linux server. I am getting asked to identify and stop a process initiated by a user. How can I go about identifying what process a user is executing that matches the logs ...
1
vote
1answer
54 views

Detecting Windows Physical Console Logon

I'm trying to find a way to detect a logon where someone is physically at the machine. I know you can do it with Type 2 but the issue is that events get logged when services make a logon request such ...
0
votes
1answer
49 views

Weird IP address value in apache log

I have been running this instance of apache 2.4.17 for a long time. It is used as a proxy to a number of applications at the back. Recently I upgraded Piwik/Matomo, and it caused a bit of issue in the ...
0
votes
0answers
24 views

Nginx/Openresty keeps creating an empty log file and writes in the previous one causing logs to never get rotated

My Django app runs on an nginx/openresty server. The user running the server is root:root but typically the app is owned by webapp:webapp. This means logs get created and written on by root. The ...
0
votes
1answer
84 views

how to send alert on the same incident using logs-based metrics

On GCP we have created various logs-based metric where we basically are looking for log entries with some keywords like 'error', 'warning' etc... We also created alerts based on those metrics. Most of ...
1
vote
0answers
36 views

Delete old SSH session recordings

Recently I've been testing SSH Session recording in Fedora + Cockpit as a method of auditing. This has been working pretty well, but it records too much information, and more importantly, picked up a ...
0
votes
1answer
237 views

Docker-Compose Logs From Interval Process are Queued?

I've got a Docker Container setup that includes two python programs running at the same time. Process A is a web server supported by flask that selects data from an SQLITE DB and puts it on a static ...
0
votes
0answers
31 views

PowerShell - Copy specific files depending on LastWriteTime and logging

My goal is to set a copy of files with a specific extension, depending on comparison of the 'LastWriteTime' parameter in both source & target directory, and to record it in a log. I'm nearly there ...
0
votes
0answers
35 views

Azure Activity Log with no “Event Initiated by” value

I was working on Azure Public Cloud and found that there're some events in Activity Log with no Caller value as seen below. This is an example: Operation name: Update SQL database Time stamp: Sun Mar ...
1
vote
1answer
46 views

networkmanager script failing, how to see full logs output

journalctl -u NetworkManager.service tells me dispatcher: 01-ifupdown [...] /etc/NetworkManager/dispatcher.d/01-ifupdown exited with error status 1 This is almost certainly a script we have hooked/...
0
votes
0answers
25 views

How do I color/format logs and also rotate without one action getting in the way of each other?

I have the following: A shell script which gets executed via screen and a screenlog gets generated using the flag -L. This shell script is just ncat (better version of netcat) listening on a specific ...
0
votes
0answers
51 views

“An unexpected network error occured” WinIOError Azure App Service

We are getting a sporadic error on our windows azure app service using a P3v2 instance. The error occurs when creating a temporary PDF file to email a customer. The exception trace occurs in System....
0
votes
1answer
33 views

Monitor Win10 RDP logins via a log file

I know there is the win10 event application to view recent logins, but is there a login history log file I can monitor or retrieve on Windows 10?
0
votes
1answer
300 views

Should I be concerned about attackers spraying for vulnerabilities on our webserver?

I'm running a webserver with monitoring software (Sentry.io) and I can see (failed) hits to the following endpoints: GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php GET /console/ POST /api/...
0
votes
1answer
70 views

Exclude remote syslog client logs from /var/log/syslog on host machine

Background: I have a lil Raspberry Pi server running the latest Raspbian OS running a number of network appliances to help manage a complex IOT LAN for a client. I have been using rsyslog to write ...
0
votes
1answer
71 views

Catch logs of containers created by a Docker executor of a GitLab Runner

Given a Docker Engine client (GitLab Runner) which creates and destroys containers dynamically through the Docker Engine API. Constraints The HostConfig.LogConfig.Type is always set to json-file and ...
1
vote
0answers
21 views

How can I ask journalctl to show records for all units except one?

journalctl -u ssh prints all records associated with the ssh unit. But how can I get all records not associated with the ssh unit? Things that don't work: journalctl -u '!ssh'; journalctl '!...
0
votes
1answer
65 views

How to rotate compressed log file on centos 7?

I have customized kafka server and the app is creating log files and configures log rotation. My problem is that I need to compress the rotation logs that were created. I tried to create new log ...
1
vote
0answers
25 views

Is that possible to let “multilog” program output human-readable file name instead of TAI64N timestamp name?

I am using "multilog" to do log rotation in debian server. When the log roates, "multilog" will create a filename as @TAI64N_timestamp.s or @TAI64N_timestamp.u. I know I can ...
0
votes
0answers
29 views

Access Denied on Event Logs Suscription

We got this requirement to centralize Event Viewers' Security logs from all Domain Controllers that belong to a single domain. The forest functional level is 2003. One DC is 2003 and the rest 2012. ...
0
votes
0answers
15 views

Virtual host CustomLog file size

I'm running the following CustomLog in my virtualhost: CustomLog /var/www/website/requests.log combined All HTTP requests are logged into this file. Everything is working fine only I want to limit ...
0
votes
0answers
61 views

haproxy logs in a container

I’m struggling to get access and health check logs from haproxy when I run it inside a container, so I’ve followed the instructions in the docs (Setting up logs using Docker | HAProxy Enterprise 2.2r1)...
0
votes
1answer
77 views

nftables - how to log only specific type of traffic

My nftables.conf file looks like this. #!/usr/sbin/nft -f flush ruleset table inet filter { chain input { type filter hook input priority 0; # allow ...
0
votes
0answers
33 views

Ban ip address from log

I have Ubuntu server and I have brute force attacks this is my log location /var/log/test/access_filter_error_log I want all requests (IP) coming there there automatically go on ban
1
vote
1answer
120 views

How to collect only container logs with Datadog without host and container metrics?

I not found answer on official website and support can't give an answer. So I ask the community. I want use Log Management without using Datadog Infrastructure. There is a link on the official site, ...
0
votes
1answer
148 views

fail2ban not working with SSHD using busybox-syslogd

I am running fail2ban (0.9.6-2) on Debian 9 with busybox-syslogd logging to /var/log/auth.log setup with the following line in /etc/rc.local to get logs written to file. /sbin/syslogd -O /var/log/...
0
votes
0answers
17 views

SSH entries filling up my system log [duplicate]

My system log is filling up with messages like the following: sshd[17572]: Invalid user admin from 71.213.202.114 port 45636 sshd[17572]: Received disconnect from 71.213.202.114 port 45636:11: ...
1
vote
0answers
25 views

How to show docker logs until container becomes healthy

I'm trying to create CI infrastructure for a project. We deploy application with docker. It usually takes some time, to start up application. I would like to see in my gitlab job logs my docker logs......
1
vote
0answers
105 views

nginx logging to unix socket fails with protocol error

debian stable, nginx version: nginx/1.14.2 I get the following error message (error.log) : connect() failed (91: Protocol wrong type for socket) configuration file : access_log syslog:server=unix:/var/...
1
vote
1answer
38 views

Where can I view successful logon attempts for SSHD?

I'm familiar with using log show | grep 'sshd: error: PAM: authentication error for $user from $ip_address' to look through failed logon attempts from various IP addresses. Is there an equivalent log ...
0
votes
0answers
76 views

Make journalctl keep all logs forever (SystemMaxUse = unlimited)

How do I configure journald so that it never, ever, ever deletes my logs. Yes, what I want to do is tell journald to keep writing until the disk (read: /var partition's filesystem) is full. No, I don'...
0
votes
1answer
23 views

Share multiple log files from multiple servers with multiple users

I need help finding a tool or application that can be used to share multiple log files from multiple servers with multiple users. Now we are doing it by adding all the log folders of the servers by ...
0
votes
0answers
129 views

Why is a labels stage in my Promtail's ingestion pipeline without effect?

This is a part of my Promtail scrape configuration on various hosts to collect journald log entries to a Loki instance: - job_name: journald journal: labels: job: journald ...
0
votes
0answers
18 views

Sending Zeek logs to Netwitness

I would like to know how to send Zeek logs to a Netwitness server. I've been searching and I can't find anything on how to send Zeek logs to a syslog server. Thank you
0
votes
0answers
35 views

HAPROXY Logging

Im running a containered haproxy service and im unable to change the log level to only "err" it keeps throwing alerts and notices when looking at "docker logs haproxy" my current ...
0
votes
1answer
61 views

Systemd python script won't log (buffer cause)?

Although the problem exposed here seems very similar, none of the solutions provided work. Context : Raspberry Pi Zero W, Raspbian Lite (2020-08-20) I want to register a python3 script as a service, ...
0
votes
1answer
48 views

Are firewall logs filled with incoming SSDP requests typical for networks with a Windows 7 box?

While reviewing firewall logs that were sent to me from a Windows 7 box (the box is not a server) on a tiny network, I saw thousands of incoming SSDP UDP entries. The SSDP entries were nearly ...
0
votes
0answers
76 views

journalctl --list-boots is not listing all boots

I have a Raspberry Pi running a custom Yocto image and it's using systemd-journald for logging. I'm wondering why there is a difference between: root@raspberrypi4:~# journalctl -o verbose | grep -e '...
0
votes
2answers
716 views

Nginx: Unknown log format error

I have a proxy set up that is taking UDP traffic to load balance internal DNS. It is routing the traffic properly to my backend DNS servers, but I cannot seem to get the log formatting to work ...

1
2 3 4 5
55