Questions tagged [logging]

Recording activity on the system (or of a particular program) for later reporting and analysis. Logins, logouts, web server page requests, etc might all be logged.

Filter by
Sorted by
Tagged with
0
votes
0answers
8 views

nginx: log which requests where done over the same keep-alive connection

Is there any way to create a custom log file, that allows to see which requests were handled in the same keep-alive session? I'd like to create some logs and to estimate how often new sessions are ...
0
votes
1answer
18 views

Unable to write to `stderr` or `stdout` from Kubernetes pod to pod logs

I'm trying to debug why my application logs aren't being picked up by Promtail for ingestion into Loki. In order to exclude the complexities of my PHP application logging being the culprit, I'm ...
0
votes
0answers
11 views

Is it possible that personal access token is leaked thru' git log?

When cloning a Git repo with HTTPS URL, the password or access token can be put there in the URL after username, for example: git clone https://USERNAME:PASS_OR_TOKEN@github.com/some-project.git Is ...
0
votes
0answers
8 views

Time-based rotation of Docker logs

We are running a stack of Docker Swarm services and, according to our Privacy Policy, we have to keep logs only for the last 6 months, but no older. I was trying to achieve it through different ...
0
votes
0answers
93 views

Change Tomcat's catalina log file name

I'd like to change Tomcat's (8.5) catalina log file name format for the current day. I want the current log file for today to be with no date in the name and be only catalina.log because I want to ...
1
vote
1answer
88 views

DNS DDOS Attack - would like to understand log

As part of a DOOS attack (largely inefectual) I am currently seeing log messages of the form: <DATE> client <EXTERNAL-IP>#3074 (<NAME>): query: <SAME-NAME> IN RRSIG + (<...
3
votes
1answer
38 views
+50

Dynamic Error and Custom logs in apache 2 using wildcard subdomains

I'm trying to make a wildcard VirtualHost conf file for apache2, and I'm not sure how to handle the ErrorLog and CustomLog settings to put the logs where I want them to go. As you can see in the ...
-1
votes
1answer
21 views

Linux: Best solution to send new lines in log files to remote syslog? [closed]

We need to send new lines in an application Log to a remote syslog server. This server is a flow receptor and we could use any other format, but syslog seems to be the easiest way. What would be the ...
0
votes
1answer
22 views

OpenVPN server log - what is the “us=” identifier following the timestamp?

I use OpenVPN 2.3.10 in server mode, with logging set to verb 4. In the log, every line begins by a timestamp (Mon May 11 10:40:10 2020) and then us=, followed by a 5- or 6-digit number. What is this ...
0
votes
1answer
17 views

How to read docker json log files in a readable format?

I always back up docker json log files when I deploy a new image version. Is there a linux program or command that lets me browse the log output from backed-up json log files in a readable format ...
0
votes
1answer
33 views

How to log client ips when using nginx as load balancer?

I am using nginx with upstream for running the webserver and a TURN server on the same port: stream { upstream web { server 127.0.0.1:4444; } upstream turn { server 127.0....
0
votes
1answer
11 views

Apache not logging SVN traffic

We have a windows apache server which, among other things, serves the SVN repository files. Here is the configuration part: <IfModule dav_module> <IfModule dav_svn_module> &...
0
votes
0answers
16 views

Getting postfix to log to a file on docker

I have created a docker image based on Ubuntu 20.04 with postfix and dovecot. I also installed syslog-ng in hope to solve my problem, but it didn't work. Thing is, I want to use fail2ban to prevent ...
0
votes
0answers
14 views

Prevent error log filling with lines like “FastCGI sent in stderr: ”Unable to open primary script"

One of our sites gets hit quite a bit by requests to scripts which simply do not exist. This builds up in the error logs, with errors like "*534676 FastCGI sent in stderr: "Unable to open primary ...
0
votes
0answers
8 views

How can I send cloudwatch logs from multiple accounts to a clouwatch logs into central account?

I need some advice on implementing a data replication : I have 3 accounts where there is a CW log group with the same name, and my need is to implement a mechanism for a cross-subscription into a CW ...
0
votes
0answers
143 views

Forward IIS 7.5 logs to a remote server

From my understanding IIS 7.5 doesn't support logging to the Windows event viewer (correct me if I'm wrong). From my research into the Advanced Logging module, it doesn't allow you to write logs to ...
0
votes
0answers
12 views

Web based logs viewer for PM2 Logs [closed]

I'm using PM2 to start the node applications and every time I'm going to the location of the logs "/home/ubuntu/jenkins/.pm2/logs" to view the pm2 instances logs when there are any errors and ...
0
votes
0answers
9 views

How to define custom time format and different file for each other in a single rsyslog template?

I am trying to define custom log format and separate log file for each host in a single template. I am getting my desired log-line though following template. template(name="servers" type="string" ...
0
votes
0answers
13 views

parsing haproxy log with regex

I have two haproxy log line first: Apr 13 03:49:00 localhost haproxy[90729]: 23.134.3.12:35138 [13/Apr/2020:03:49:00.404] http-in~ website1.com_b/website1.com 0/0/1/12/13 301 906 - - ---- 2/2/0/0/0 ...
0
votes
0answers
24 views

Disable “Failed password” ssh logs

Bots are tirelessly trying to log into my server using ssh. That does not bother me, because my passwords are good, but I don't like the fact that ssh spam fills journald logs. I'd like to filter out ...
0
votes
1answer
29 views

Logrotate docker container's logs when user doesn't exist on host

I mounted my containers' logs to the host (e.g. /var/log/container1, etc). Now I want to use the host's logrotate. But suppose I need to do this: create 660 mysql mysql There is no mysql user/group ...
0
votes
2answers
62 views

How to customize nginx error log lines (omit datetime and severity)?

I have configured my nginx server's error log as follows: error_log syslog:server=unix:/dev/log,nohostname,tag= notice; This results in the following type of log lines (in systemd journal): apr 11 ...
0
votes
1answer
47 views

How to format ansible logs in a human readable way

I need ansible logs per host (server) so I am using logs_play module in ansible.cfg. callback_whitelist = log_plays But the output is not human friendly. See an example log below: Apr 10 2020 12:23:...
0
votes
0answers
17 views

Normalize client address in nginx logs

I have a log_format in nginx which uses the $remote_addr variable. It has a variable width -- it can for instance be 76.4.56.100. For alignment reason in the logs, I'd like these addresses to be all ...
0
votes
0answers
11 views

any way to know when nginx stalls a request, because uwsgi server ran out of workers

I'm having an nginx setup with a uwsgi server with n workers. if I perform n+1 requests in parallel, then the last request is stalled until one of the n uwsgi workers finished handling a request. I ...
0
votes
0answers
10 views

is there any reliable way to correlate nginx and uwsgi requests / logs?

I am having a setup with nginx + uwsgi. Both servers create logs. I wondered whether there would be any way to correlate nginx and uwsgi requests (und thus their logs) In most cases the requesting IP,...
0
votes
0answers
24 views

Logrotate: using number of files as criteria of logrotate

What I am trying to achieve is archive all log files if number of them in a folder exceed some number. Is it possible somehow ? EDITED: to be more detailed, I'll have possible several thousands of ...
0
votes
1answer
21 views

Monitoring users logged in with SSH-CA (certificates)

I was hoping to get some help with an approach that could be used... I am building out a solution that will use SSH-CA (that is, SSH where authentication is done via certificates). Flow is simple: ...
1
vote
1answer
113 views

How do I disconnect a VM from a Log Analytics workspace that has already been deleted?

I created a Log Analytics Workspace (LAW) and connected the SQL Server to it in order to test a theory. I then deleted the Log Analytics Workspace (LAW) but did not "Disconnect" it from the LAW. I ...
0
votes
0answers
14 views

Logging chrooted users with different socket/hide “/dev” folder

I have a few chrooted users on my sftp-server. Logging works as intended, but I have one simple question: Is it possible to hide the "/dev" folder for the users? My configuration now: module(load="...
4
votes
2answers
102 views

nginx. How to log ssl errors without blowing up the server logs

I have a web site, that is visited by many different mobile devices and embedded devices. Quite often I encounter the issue, that some devices cannot connect. The reasons can be: the device doesn'...
0
votes
1answer
91 views

Suppress “client denied by server configuration” Notices

I'm trying to remove the following notices from my error logs: AH01797: client denied by server configuration: /var/www/html/example.com/xmlrpc.php I previously had: LogLevel notice after ...
0
votes
1answer
42 views

Unindentified layout for RRAS logs [closed]

I stumbled upon an unknown layout, without headers, which neither NPS Log Interpreter nor IAS Log Viewer can seem to understand. My Google-fu is spent and I've found zero documentation about it. ...
1
vote
1answer
23 views

Get history of remote connections for a user

One of our disabled admin account credentials is still used to perform (failed) login attempts on some Windows servers from a bunch of other servers. The login attempts were made using Kerberos ...
0
votes
0answers
41 views

Centos 8 Getty restarting every 10 seconds

This is a new server setup, the messages log file is getting flooded with this every 10 seconds: Mar 21 14:12:34 server systemd[1]: getty@getty.service: Service has no hold-off time (RestartSec=0), ...
0
votes
1answer
62 views

How to remove bloat from my logs automatically

I was going over logs on a server with multiple vhosts/accounts, trying to figure which ones to delete because it is late in the month and an automated backup failed (I use Apache and/or Nginx). I ...
0
votes
1answer
49 views

Azure : How to process Azure Log events from Event hub and filter based on criteria

How to process Azure Log events from Event hub and filter based on criteria. We are trying to filter specific critical or security related Diagnostic and Activity logs before feeding into our Onprem ...
0
votes
0answers
59 views

Why does BIND perform a double query before answering NXDOMAIN for a RPZ (response-policy zone)?

The goal is to have a local DNS server with the following specifics: split DNS setup that resolves a FQDN (e.g. localdomain.com) to a local IP instead of the external IP use a RPZ (response policy ...
0
votes
0answers
13 views

Suricata - Log client connections and disconnections to the server

I have a server running multiple services, I use suricata to log tcp traffic. I don't need to see every request made by every client, I only need to log connections and disconnections of every client. ...
0
votes
1answer
24 views

I'm migrating a high traffic service to Kubernetes. What logging solutions should I be looking into?

I'm in the middle of migrating an existing service to Kubernetes on Linode. I'm researching some different logging and reporting options now that are more comprehensive than what I've been doing for ...
0
votes
1answer
24 views

can logstash package individual log types into packages an scp them over to a central node?

I am curious whether logstash only processes logs and streams them at the event/line level or can it package all apache access logs for example and send them over zipped up to a central node?
0
votes
0answers
83 views

How to set up GELF logging in Docker for Windows

I'm running Windows 10 Pro 1909 (18363.657) and would like to stream the containers stdout to a locally installed log monitor accepting GELF over UDP (it is seq in my case). I have tested my local ...
0
votes
0answers
21 views

PHP Custom Virtual Host Error Log

I am running Apache 2.4 and PHP 7. If I set PHP error logging on in php.ini logging works to the directory I choose. I would like to set a specific file for specific site error logging per virtual ...
0
votes
1answer
49 views

Finding a device that uses emoji in DHCP

Good morning, I tried searching for this already, but couldn't find much. Recently I ran into an issue where someone airdropped an inappropriate photo to another, and used a device name of only an ...
0
votes
1answer
29 views

User/Visitor tracking tool [closed]

Hello I'm looking for an user tracking tool/service for our apache 2.4 webserver on ubuntu. Goal is to track our users accross our page (all visited url's, exits, requests, redirects, errors and so on)...
0
votes
0answers
17 views

Add ssh user and protocol works [duplicate]

I want to grant a tech person ssh root access to my Oracle Linux Server 7.7 in the Oracle Cloud Infrastructure to configure something. How can I protocol/log for a ssh user everything he does? I am ...
0
votes
2answers
86 views

Aggregated logs from microservices into single web interface

I am wondering if a project exists that can collect all the logs from a bunch of microservices and tail them on a web interface. All of the logging solutions out there seem to neglect realtime viewing....
0
votes
1answer
50 views

Is it possible to automatically collect chromebook system logs for SIEM ingestion?

I'm planning to have a subset of end users running Chromebooks and would like to ingest system logs for those devices into a SIEM solution. Is there a way to do this? I see from Google ...
2
votes
1answer
147 views

pam_unix generates a lot of open/close sessions for my domain user

I setup a new VPS with ubuntu 18.04, including virtualmin/usermin. In auth.log I see a lot of su[12936]: Successful su for domain by root su[12936]: + ??? root:domain systemd-logind[148]: New ...
0
votes
0answers
12 views

Rotated logs with newsyslog, but PostgreSQL doesn't write to new one until I restart it

I installed PostgreSQL on my mac using homebrew and it's been working great. I recently increased the amount of logging going on because I need to use pgbadger, so naturally I set up log rotation ...

1
2 3 4 5
53