Questions tagged [logging]

Recording activity on the system (or of a particular program) for later reporting and analysis. Logins, logouts, web server page requests, etc might all be logged.

Filter by
Sorted by
Tagged with
0 votes
1 answer
11 views

How can I log the UID in UFW log file permanently?

I have here a debian 10 with installed UFW. I want to know the user or uid of the processes of the connections which are logged by UFW. To log the UID I have add --log-uid to the log rules in /etc/ufw/...
user avatar
  • 929
0 votes
1 answer
30 views

Mysql constantly writing to binlog, rapidly using up disk space

My Ubuntu server started running a high amount of IO operations. The server has a few WordPress websites on it, but they get at most a few dozen views per day. In a couple of days 30GB of disk space ...
user avatar
  • 103
0 votes
0 answers
15 views

Command logging for chroot ssh users

I have a ubuntu server that allows users access via ssh. When they log in they are contained to their chroot directory. I'm looking for a way to log commands used by the users. I've tried using snoopy ...
user avatar
0 votes
0 answers
13 views

How to set up a server to allow the root user to track down historical outgoing requests?

I woke up this morning and found an unexpected outgoing spike in traffic from my virtual server. What commands/settings should I have been using to allow myself to track down the who/what initiated ...
user avatar
  • 101
0 votes
1 answer
26 views

rsyslog - how to tag and apply ruleset by line contents?

I am cleaning up and standardizing our log handling, adding fluentd and ELK. This part is working fine, since nginx is logging to its own file: input(type="imfile" tag="app.nginx" ...
user avatar
0 votes
1 answer
37 views

Why is the FascistLogging ssh logging mode named that?

The docs describe Fascist Logging mode quite well, so I understand what it does. Basically it is a variant of debug logging enabled with FascistLogging yes But why is it named that? I'm sure the ...
user avatar
  • 131
0 votes
1 answer
49 views

Aggregate multiple log files in a directory

I have k3s single node cluster running on a machine. I do not have any logging infrastructure set up yet and I'd leave this as a future learning experience for now. On that k3s I run some cron jobs ...
user avatar
  • 146
0 votes
0 answers
26 views

Rspamd log entries halt every 5 mintues

I'm not sure this problem is specific to rspamd, but I'm finding it interesting. Every five minutes, 6-7 seconds after the five minute mark, log entries halt for the service. For example, it's 19:57:...
user avatar
0 votes
0 answers
13 views

Exclude Specific Event from writing to Windows Event Log

Is it possible to exclude a specific Event ID from being written to the Windows Event Log if the process name in the log is a specific predefined process? If it is possible how do I do this? There is ...
user avatar
0 votes
1 answer
32 views

Mysql database often stops and won't restart

Server: Linode Dedicated 4G Ubuntu 18.04, Webmin + Virtualmin Every now and then, mysql server stops and fails on restarting. Here is the logs I was able to find: Apr 11 20:54:57 bamboo kernel: [ 2082....
user avatar
  • 199
0 votes
1 answer
45 views

Set INFO/ERROR priority for messages logged to journal via stdout and stderr?

We have many production apps (first and third-party) that leave logging up to the process that runs the app and just log to stdout for INFO and stderr for ERROR logs (ie only 2 log priorities: INFO|...
user avatar
  • 541
0 votes
1 answer
17 views

Drop-down menu for "Field name" does not show log_struct() logged jsonPayload in GCP LBM menu "Create logs metric" though logs in the Logs Explorer

I need LBMs on Google Cloud Platform of metric type "Distribution" to make time series charts with values like counts or duration for many labels in one go. Example: for 10 different steps ...
user avatar
0 votes
1 answer
42 views

How to register Ansible actions in Windows Event Log?

Ansible: 2.9 Windows: W2k16 Server I'm searching for a method to register (log) Ansible actions in remote Windows host. For example, when I work with win_command module for echo test command, I can't ...
user avatar
  • 13
0 votes
0 answers
11 views

Ubuntu Server Error

I've been getting the following error for about a month. truncate: cannot open '/var/log/modsec_audit.log' for writing: Operation not permitted https://support.plesk.com/hc/en-us/articles/115003182625-...
user avatar
0 votes
0 answers
57 views

Nftables logging with ulogd

Recently I started looking into nftables since it's going to be iptables successor. While doing so I came across some logging difficulties as maintaing separate log files for different services, and ...
user avatar
0 votes
0 answers
9 views

Apache httpd log url of outgoing redirects

Is it possible with Apache Httpd to log all urls for outgoing http redirects? This could help with http type open redirect vulnerability.
user avatar
  • 495
0 votes
1 answer
45 views

Why some companies like cisco follow different syslog messaging format rather than rfc 3164 (BSD syslog) and rfc 5424 (IETF syslog)?

According to my understanding the popular syslog formats are: RFC 3124 (BSD syslog): Format: < priority >timestamp hostname application: message Example: <133>Feb 25 14:09:07 webserver ...
user avatar
  • 5
0 votes
0 answers
13 views

Log Event ID to display time of first boot on a Windows Machine?

Say I factory reset a machine, or just installed Windows on it. Is there a way to use Get-WinEventLog to find a log message to indicate this is the first time since the installation of the OS that the ...
user avatar
  • 4,767
0 votes
1 answer
65 views

rsyslog change timestamp format for specifix filter

I wish to change my rsyslog timestamp format to RFC-3339 of specific log file (msg). I have the following file /etc/rsyslog.d/10-zn.conf with the following content: :msg, contains, "my_prefix&...
user avatar
0 votes
1 answer
94 views

How to make Apache stop logging AH10244 [core:error] for 400 Bad Requests?

How do you make Apache (2.4.52) stop logging AH10244 [core:error]? [Sun Mar 13 05:23:47.884213 2022] [core:error] [pid 558:tid 140262206592768] [client 45.146.165.37:51872] AH10244: invalid URI path (/...
user avatar
  • 1,374
0 votes
0 answers
46 views

firewalld: outgoing NTP connection will be logged as blocked, but isn't blocked

I have configure firewalld on CentOS7 so it blockes all outgoing connections. Only the needed connections are white listed by adding some rules. Also I have add rules to enable logging of blocked ...
user avatar
  • 929
0 votes
1 answer
111 views

firewalld: logging of blocked outgoing connections

I have configured firewalld so that the firewall will blockes also outgoing connections. The outgoing traffic I need I have white listed by adding specific rules. This works fine. But now I want to ...
user avatar
  • 929
0 votes
1 answer
38 views

MySQL log filling up with unwanted "Status information" on server reboot due to SIGHUP

This has been plaguing me for a while, so it's time to ask. The MySQL error_log fills up with "Status information" when the server reboots due to SIGHUP. Here is a link describing the ...
user avatar
  • 1,374
0 votes
0 answers
72 views

Use Nginx for audit logs

I have a sensitive webapp used only internally. I want to log all the actions of my users for 90 days. To achieve that, I'm using a nginx reverse proxy that forwards all the requests to the webapp. I ...
user avatar
  • 140
1 vote
1 answer
324 views

GCP log Explorer and slow SQL query log with Cloud SQL

Is there a way to analyze SQL Slow query logs easily on log explorer or on some other GCP tool? Now log explorer writes log entries to multiple lines (textPayload divided) and it's hard to find out ...
user avatar
  • 11
0 votes
0 answers
166 views

Access PHP error log in AWS Elastic Beanstalk

I'm running a PHP web app on AWS Elastic Beanstalk, and I've been trying to diagnose some seemingly random (rare) issues users have been encountering after upgrading to PHP 8. On localhost, I'd have ...
user avatar
  • 121
1 vote
1 answer
65 views

Format SFTP Logs to have Username on Each Entry

I'm running a production server (Debian 10, standard OpenSSH package) that has Pure-FTPD running for legacy connections and SFTP for all our current connections. The SFTP server is setup with a chroot ...
user avatar
2 votes
1 answer
437 views

jsonPayload (structured logging) output from Python Google Cloud Function's logging needed to create Log-Based Metrics (LBM) in GCP

I need the jsonPayload in the logs of a Google Cloud Function instead of the textPayload. My aim is to use the keys of the dictionary as labels (see Log-based metrics labels) for Log-Based Metrics so ...
user avatar
0 votes
0 answers
45 views

Apache 2.4.51 URL Defence

I am running Apache 2.4.51 with PHP 8.1.0 on a Windows 10 PC. Recently, I noticed some entries in my log and corresponding alerts from Windows Defender. An example culprit causing an AV alert is https:...
user avatar
0 votes
0 answers
19 views

Prevent ufw to log lines based on string/keyword?

Is it possible to prevent certain repeating lines to be logged in ufw log? I basically wants to stop all lines containing UFW BLOCK & SRC=192.168.0.202 Full line example: Feb 5 13:03:38 ddomain ...
user avatar
0 votes
0 answers
13 views

How can I write all commands from all users to a log file, preferably remote [duplicate]

If you need to give a contractor root access to a system, is it possible to log all issued commands and send them to a remote system? I appreciate that they can tear down anything on the local system ...
user avatar
  • 101
0 votes
1 answer
71 views

A user activity is detected from a disabled account in Active directory

I have disabled an user in my Active Directory (terminated the account). However, I am still getting the log that Event IDs 5379 (credential manager credentials were read.), 4673 (a privileged service ...
user avatar
  • 3
0 votes
0 answers
55 views

getting permission denied errors with cronjobs and logs on rpi

Hell everyone. I am running a raspberry pi 3B+. I have a a cronjob that runs a script (which seems to work fine) but when I look at the syslog I see errors, which you can find below. I can't really ...
user avatar
0 votes
0 answers
20 views

How do I log a particular user login event in my active directory

I have to log a particular "install" user logon in my Active directory. This user has the admin rights to install software and I need to understand where and who is using it. My first attemp ...
user avatar
  • 1,190
0 votes
1 answer
61 views

Nginx access log file in every x minute

I need to read the access log from nginx, do some post processing and send it as a csv to another server. But by default nginx generates access log in one single file. Is there any way to create the ...
user avatar
0 votes
0 answers
29 views

Introduction problems with some server log file

I have that problem, that my server is flooded with some kind of requests as you see it here: 26/Jan/2022 66.240.205.34 "Gh0st\xad" "-" 26/Jan/2022 139.162.145.250 "GET 400 26/...
user avatar
  • 1
0 votes
0 answers
30 views

PASSWORD - Password change log

Is there any way to check all password change logs for one specific user? I'm using macOS and since its based on Unix, I thought that this could be the place to post this question. Someone changed my ...
user avatar
0 votes
1 answer
57 views

What is OPTIONS * in apache logs?

Getting thousands per hour: 1017 "OPTIONS * I've tried to find more about this in Apache docs but could not.
user avatar
  • 1
0 votes
1 answer
57 views

Make special query log for a certain zone bind9

How do I make special query log file from a certain zone. While my current log config is logging { channel query_logging { file "/var/log/named/query.log" versions 5&...
user avatar
1 vote
1 answer
138 views

Finding deleted/imported files in SFTP server using logs

We have an SFTP server, I am trying to find out if some specific files have been deleted from the server or if they have even imported to the server or not. I'm going through the log files under /var/...
user avatar
  • 241
0 votes
0 answers
92 views

Change nginx temp & log folder on Windows

I installed nginx on Windows but when i execute it from a directory that's different from the folder that resides nginx.exe i get the following error: nginx: [alert] could not open error log file: ...
user avatar
1 vote
1 answer
377 views

systemd process stdout/stderr

When I run the service manually, it logs something when it starts. But I cannot find this log anywhere when it starts as systemd process. journalctl -u <service> only shows the records about the ...
user avatar
  • 111
0 votes
0 answers
38 views

Apache ErrorLog skip logging specific message

For one of my Apache vhosts, the error log is bloated with messages about "favicon.ico". I don't need these logged. I'm aware of the SetEnvIf directive that can be applied to CustomLog. Here'...
user avatar
  • 273
0 votes
0 answers
31 views

Did/When did the Apache Custom Log Format of SSL env vars change?

For years I have been accessing SSL custom log variables using directives like CustomLog /var/log/apache2/ssl_type_log "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x "%r" %b" ...
user avatar
0 votes
0 answers
6 views

Samba Logging Parameter to Disable process_name_query_request

Is there a way to disable the process_name_query_request and find_workgroup_on_subnet log entires in Samba's log, perhaps in one of the debug classes? There are so many entries, it makes it impossible ...
user avatar
0 votes
2 answers
108 views

Encrypt nginx log files

Is it possible to encrypt nginx log files? If so, would the logrotate saving time the best time to do so? The background for this is that the client is concerning about security issues that can happen ...
user avatar
0 votes
0 answers
139 views

syslog-ng duplicate log message

Not duplicate of this question because that one uses rsyslog on client whereas I use syslog-ng on both sides. I have a syslog-ng instance on both the client and the server and for whatever reason the ...
user avatar
0 votes
0 answers
34 views

Run systemd namespaced unit on failure of any unit

I have a namespaced unit to send an email saying that a given service has failed. I know that you can add OnFailure units to an individual unit in order to run the specified units when it fails. ...
user avatar
  • 101
0 votes
0 answers
105 views

clamdscan: Log verbose output to configurable file

When using clamdscan, I would like to have verbose output logged to a file. Specifically, the timestamp, file path and file name as well as the scan results should be logged to a specified file. At ...
user avatar
2 votes
0 answers
80 views

Can nginx log to an arbitrary UDP socket?

Is it possible to make nginx log its access logs to an arbitrary UDP socket, logging only the output of the log format? The syslog facility comes close but seems to insist on adding a header with the ...
user avatar
  • 285

1
2 3 4 5
56