Questions tagged [logging]
Recording activity on the system (or of a particular program) for later reporting and analysis. Logins, logouts, web server page requests, etc might all be logged.
2,894
questions
0
votes
3
answers
4k
views
Apache2 - Can not open error log file
I'm installing Apache2 on Debian Wheezy.
After the file's mod /etc/apache2/sites-available/default-ssl, I wrote apache2 for running the service.
Sadly, the Linux shell backs this string:
(98)...
CommunityBot
- 1
0
votes
1
answer
27
views
Fresh Apache (re-)install ignoring default vhost
I was trying a few thing for a custom "default" Apache vhost and nothing seemed to work, I always got the /var/www/html/index.html served instead of other contents or errors I wanted to ...
- 167
0
votes
0
answers
23
views
Detect spurious non http/https traffic on nginx and tread differently
I have a nginx server that's facing internet and listening to http and https. I am trying to process the logs (with graylog) but there is some non http/https traffic that is breaking my import process,...
- 717
0
votes
1
answer
4k
views
Different stdout with supervisord using docker vs docker-compose
I have a service running inside docker using nginx and php-fpm. I have been beating my head against the wall to get all of the logs to redirect to stdout. The approach that I took was to use ...
CommunityBot
- 1
0
votes
0
answers
47
views
Re-configuration of rsyslog
Probably a bit of an "off-kilter" question, but I want to conduct some experiments with rsyslog. I'd like to configure it to log nothing except the messages that I send with logger.
This is ...
- 283
-2
votes
1
answer
365
views
Splunk Universal Forwarder on Windows : how many logs to forward?
Splunk Universal Forwarded
Windows Server 2019
When configuring the forwarder, a large variety of logs can be forwarded :
Application Logs
Security Log
System Log
Forwarded Events Log
Setup Log
In ...
- 2,465
1
vote
2
answers
213
views
Syslog-ng multiple filters
I am fairly new to syslog-ng and I have the following issue.
I have a Checkpoint firewall that sends the logs to a Splunk server. Due to the huge amount of data sent by the firewall, I tried to filter ...
- 2,465
3
votes
3
answers
20k
views
View headers of HTML requests to apache
Is there a good way of viewing a detailed version of incoming requests to apache? At the minimum I'd like to check for the existence of a specific header and check its value. Requests are not coming ...
- 470
25
votes
6
answers
113k
views
How can I enable logging for requests going through mod proxy
Is there a way to log requests going through mod proxy? I need a way to debug my configuration, because I don't seem to be getting where I should be. I need the following information:
headers of ...
- 1,920
0
votes
0
answers
22
views
pam_unix logs: xrdp-sesman:session session opened for user USERNAME(uid) by (uid=0)
recently I found a lot of these type of logs:
pam_unix(xrdp-sesman:session): session opened for user username(uid=some_uid) by (uid=0)
From what I read is xrdp-sesmam-session that is "opening&...
- 125
3
votes
1
answer
3k
views
Simple web tool for viewing log
I'm developing a server deployment script that installs a bunch of stuff and generates a log in the process. I'd like users of the script to be able to view what's happening, on a web page, in real ...
- 11
8
votes
1
answer
4k
views
Adding timestamps to supervisord logs
Is it possible to let supervisord add timestamps to the outputs in stdout_logfile and stderr_logfile? I couldn't find it anything about that in the documentation.
CommunityBot
- 1
1
vote
0
answers
24
views
After creating relying party trust in ADFS, how to validate configuration is correct using SAML tracer
I created a relying party trust in ADFS.
To test, I log into IDP, initiate link, select the relying party, enter credentials, then the application page will display.
How do I perform this validation ...
- 36.8k
2
votes
2
answers
2k
views
What is the meaning of these HAProxy configuration lines?
I've seen several examples (see below) of HAProxy logging configuration that all look like this:
/etc/haproxy/haproxy.cfg
global
log /dev/log local0
log /dev/log local1 notice
...
- 2,213
42
votes
11
answers
185k
views
Delete all of /var/log?
Can I delete everything in /var/log? Or should I only delete files (recursively) in /var/log but leave folders?
Does anyone have a good rm command line? (My admin skills leave me nervous.)
Note: I ...
- 101
0
votes
3
answers
6k
views
/var/log/messages Not Created Although restart rsyslog.service
I use centos7 and /var/log/messages has not worked for a while although I restarted rsyslog.service. Its size was always 0.
I then deleted the messages file, and restarted rsyslog again but it was ...
CommunityBot
- 1
0
votes
1
answer
104
views
Cannot add Kubernetes metadata as label to Loki container logs in FluentBit
I am trying to gather container logs in Kubernetes environment using FluentBit, Loki and Grafana.
I would like to append Kubernetes Pod name as label so when I query the logs in Grafana, it would be ...
0
votes
0
answers
36
views
Fluentd tail config for HashiCorp Vault audit/server logs from stdout
I'm trying to figure out a way to get both the audit and server logs from HasiCorp Vault container (both logs go to stdout of the same container and they have a different structure):
Audit example:
...
0
votes
0
answers
29
views
Watchguard logs incoming SMTP connections has an dst_user entry. Where can I change this entry?
Hello fellow Exchangers,
as mentioned in the title any incoming smtp connection is routed correctly to our onpremise microsoft exchange server and the logs look as described here:
https://www....
- 1
4
votes
1
answer
932
views
Systemd service not logging
I have a systemd service. No logs appear from it despite my best efforts. This is the service file:
[Unit]
Description=Load Balancer
[Service]
WorkingDirectory=/home/lb
ExecStart=/usr/lib/jvm/jdk-20/...
8
votes
8
answers
26k
views
How to find "growing" files inside a linux system
I have a server that is constantly losing disk space so I reckon there must be some logs that I'm not aware of.
What is a good way to locate files that are constantly increasing in size?
0
votes
1
answer
84
views
nginx custom log format to log header value when exists
environment setup
I have nginx webserver and simple backend application. this backend app has custom response header in certain condition (for example: X-Real-Status) and it's running behind nginx as ...
- 8,752
0
votes
1
answer
57
views
Nginx not logging after Logrotate
I've a nginx reverse proxy with custom log files (depending on hostname)
pwd : /var/log/nginx/domain/fqdn.(log|err)
Since some time (maybe after switching to Ubuntu 23.10), my log files are very often ...
0
votes
0
answers
34
views
Looking to monitor activity regarding connection attempts to closed ports on my system, what log file in should i look in? Ubuntu
I'm looking to monitor activity regarding connection attempts to closed ports on my system, as part of a server side portknocking implemetation. However, I am confused about what log file in ...
- 1
21
votes
6
answers
51k
views
Mongodb - proper way to rotate logs
Mongo docs say that I can:
use -SIGUSR1 signal and get the old log renamed and current switched
use logrotate from OS
I want the OS's logrotate ability to zip old files and remove oldest, but see no ...
- 49
0
votes
0
answers
16
views
Where can I find the output of exim's 'debug_print'? -- years later
There is an old thread:
Where can I find the output of exim's 'debug_print'?
(so yes I did search for existing questions, I did find an exact match , but I'm not allowed to comment + it's ...
- 1
2
votes
1
answer
4k
views
How to configure nDPI for iptables
I am new to nDPI, I have installed nDPI but when I add rules like;
iptables -I OUTPUT -m ndpi --http -j REJECT
It shows this error
iptables v1.4.7: Couldn't load match 'ndpi':/lib64/xtables/...
CommunityBot
- 1
0
votes
0
answers
30
views
How to get MariaDB slow query logs to show up on RDS
I have a MariaDB instance on RDS which I would like to enable slow query logs for.
Following the documentation, I've created a paramter group which is assigned to the database.
When I make changes to ...
31
votes
2
answers
36k
views
How do you disable SMB printing support?
I'm running CentOS on a storage server that has to do file sharing for with Windows machines. SMB version is smbd version 3.5.5-68.fc13
I'm getting a lot of error messages in /var/log/messages ...
CommunityBot
- 1
0
votes
1
answer
157
views
Why rotatelogs from apache produce files smaller than specified max size?
I use the following rotatelogs command from Apache :
/usr/sbin/rotatelogs /var/log/somelogfile 1GB
If I send 1GB of content to it (for testing), it produces the following files :
somelogfile....
- 111
0
votes
1
answer
9k
views
Event ID 521 - Critical Logging Failure on Domain Controllers
I'm tasked with the monitoring and analysis of variious logs via our SIEM solution; LogRhythm.
I noticed a few weeks back that we had large volumes of this event originating from all of our domain ...
CommunityBot
- 1
0
votes
1
answer
5k
views
OpenVPN server dedicated log missing log.conf?
I'm trying to run an OpenVPN server with it's own log, not just writing to the Syslog with everything else. For some reason it looks like you can only set a different log location by using a command ...
CommunityBot
- 1
0
votes
1
answer
77
views
What IAM permissions are required to change audit log settings in Google Cloud?
In our Google Cloud project, we have granted the following IAM roles to certain users, but they are unable to make changes to the audit log settings.
Project Editor
Logging administrator
When I try ...
google-cloud-platform
0
votes
1
answer
160
views
how can I configure All-in-one WAZUH for log retention?
I installed WAZUH all-in-one no kibana no elastics, and I want to write a code where I can make 40 days of log retention, Any advice or guides for this solution?
- 2,594
0
votes
0
answers
59
views
Changing nginx default log format sometimes doesn't work
I've recently set up fail2ban to work with my custom nginx logging format (called "main"), I have all my sites logging to a different *.access.log file. I still had to change the default ...
- 41
2
votes
3
answers
3k
views
how can I read old varnish logs?
In /var/log/varnish/ I have some old varnish logs, produced by varnishlog which, due to logrotated, are now in gz format:
-rw-r--r-- 1 varnishlog varnish 143068514 Aug 10 23:59 varnish.log.2017-08-...
- 4,607
0
votes
1
answer
80
views
Postfix Log - Get entries for certain mail only
The standard Postfix log Format is something like
Feb 4 15:03:53 mail postfix/smtp[31148]: xyz
The 31148 seems to be the process id, so this does not necessarily change if I send another mail. At ...
- 11
2
votes
1
answer
1k
views
Can I control frequency of AWS S3 bucket access log delivery?
I have enabled access logging for an AWS S3 bucket. Now I get log files delivered to my chosen destination. Each file has a name of the form YYYY-MM-DD-hh-mm-ss-guidguidguid with the time representing ...
- 166
0
votes
1
answer
129
views
Making Tomcat log in /var/log
I'm trying to make our Tomcat 9 server log its internal log in /var/log instead of ${catalina.base}/logs.
I tried to change the destinations in logging.properties, but the logs directory in ${catalina....
- 255
0
votes
0
answers
175
views
How to be sure to keep all the logs regarding a MySQL table data but filter Google Cloud SQL maintenance queries logs made by localhost GCP SQL?
I enabled the flag General_log for a Google Cloud SQL MySQL instance to get all the queries logs in Google Cloud Logging. I get all the queries users make, but also all the queries made to probe and ...
0
votes
0
answers
33
views
The way of logging at action of controller in Ruby on Rails for debug purpose
I am just trying to know if router is reaching to specific action of controller.
In js, we are using console.log and var_dump in php.
I tried with puts but it didn't work and I think it's because of ...
5
votes
4
answers
4k
views
Forward UNIX syslog to Windows Event viewer
I'm running a pfSense firewall which runs syslog and can forward it's logs to a remote syslog server. I'd like to be able to view these on my SBS 2011 server's event viewer, via a subscription. I ...
4
votes
2
answers
12k
views
How to forward windows log using Nxlog to rsyslog server(linux)?
Im using nxlog version 3.0 on WinServ2012 R2 Standard, i can forward the event logs under Eventviewer --> windows logs --> application, system, security. But Im not able to forward other log that is ...
- 618
0
votes
2
answers
443
views
Can't get dumpio on Apache 2.4 Oracle Linux 8.6 php 8
I can't get dumpio to log POST request data.
httpd.conf:
...
Include /etc/httpd/conf/httpd-le-ssl.conf
...
No LogLevel or dumpio related stuff in there.
httpd-le-ssl.conf:
<virtualHost *:443>
...
- 131
3
votes
3
answers
1k
views
Change format of IIS HTTP Error logging
HTTP.sys by default creates error log files under C:\Windows\System32\LogFiles\HTTPERR.
Is it possible to change the format of these log files to include other fields including cs-host and cs-uri-...
- 208
9
votes
2
answers
20k
views
What should be the right logs permissions for NGINX on CentOS?
on /var/log/nginx/ I have access and error logs. Some are .log errors and others have .gz
I think I messed up with the permissions. Some files are created by root/root, other files are created using ...
- 134k
2
votes
1
answer
740
views
Apache to log only requests generated by PHP
I'm not sure if this is possible, and haven't had any success yet. I'm trying to log page generation times at the web server level and currently have this working for all requests with mod_log_config ...
- 1
0
votes
1
answer
96
views
What do these logs mean? Is someone attempting to hack into my server via ssh?
Today I woke up to a a very large number of logs for ssh, and I can only assume someone is trying to gain access to my linux server.
Here are the logs
-- Logs begin at Wed 2023-08-02 08:59:10 EEST, ...
- 25k
0
votes
1
answer
56
views
Microsoft Defender: extract Automatic log upload data
Is there a way to extract this automatic log upload table from defender:
my goal is to use this information to aid in responding to the System alert: Cloud Discovery automatic log upload error alert ...
- 2,594
0
votes
3
answers
216
views
Exchange Server: Is it possible to find out which user marked an email as read?
We are running a self hosted Exchange 2016 Windows Server 2016 Datacenter.
There is a shared mailbox used by multiple users.
Users have been told to mark emails in this account only in special cases, ...
- 216