Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [logging]

Recording activity on the system (or of a particular program) for later reporting and analysis. Logins, logouts, web server page requests, etc might all be logged.

0
votes
0answers
11 views

Stackdriver logs stopped appearing in GCP Stackdriver Logging Console

Background I have a Flask server running on GCE's container-optimized image. This server prints a log for every request. Normally, I can view the logs my application prints in GCP Stackdriver Logging ...
0
votes
0answers
16 views

Security Onion not displaying status of host running OSSEC agent in Kibana

I am deploying an instance of Security Onion to a test environment. In order to test OSSEC, I stood up an Ubuntu Linux host with assigned IP of 192.168.200.4 and installed the OSSEC agent. Following ...
5
votes
1answer
3k views

Django with Apache and mod_wsgi: no system log unless setting Debug = True

I'm using apache web server and mod_wsgi to transfer request to django. $ apache2ctl -v Server version: Apache/2.4.10 (Raspbian) Server built: Sep 17 2016 16:40:43 I'm using this apache site to ...
-1
votes
0answers
15 views

In regards to the W3C log format for IIS what does the sc-win32-status mean?

I don't really know what this means, I did however notice from another question that if I type net helpmsg # in cmd I'll get a result. Where do these numbers and where do they come from? Are they ...
0
votes
1answer
13 views

Logwatch does not report on httpd (apache2)

Problem: I'm using Debian GNU/Linux 8 and my Logwatch does not have a "Begin httpd" section at all for my Apache pools. /usr/share/logwatch/default.conf/logfiles/http.conf is set for some custom ...
2
votes
2answers
94 views

Best practices for giving outside developer SSH access?

N00b here - I'm upgrading my website so that it isn't using a deprecated version of MySql/ PHP. I'm not comfortable enough with the code so I'm using an outside developer. Due to this being database ...
0
votes
1answer
37 views

Issue : log-rotate is not working

I am configuring log rotation one of my production server. I am having a weired issue. I have configured the log rotation for a file on daily basis. But unfortunately the rotation is not working. I ...
0
votes
1answer
3k views

Event ID 521 - Critical Logging Failure on Domain Controllers

I'm tasked with the monitoring and analysis of variious logs via our SIEM solution; LogRhythm. I noticed a few weeks back that we had large volumes of this event originating from all of our domain ...
2
votes
1answer
2k views

Logstash: Failed to flush outgoing items

First of all, I'm a total newbie to logstash. Despite the fact that I've managed to achieve some basic logging (trying to parse an apache log file without the build in COMBINEDAPACHELOG). However, I ...
4
votes
4answers
4k views

How do I secure my Asterisk server?

Our asterisk server was compromised. some calls were made to Asia countries last weekend. Thought we have improved our network configuration, we still want to determine how the intrusion was done, we ...
0
votes
1answer
22 views

Extracting responses from Microsoft DNS Server Analytical logs

Is it possible to extract the DNS responses from Microsoft DNS Server Analytical logs (Microsoft-Windows-DNS-Server/Analytical)? The logs contain a field called "PacketData" in the EventData section ...
1
vote
2answers
31 views

Getting sensible information out of Windows Update log

I'm parsing history.log from debian hosts to produce a csv with dates/packages/versions. After running a suite of tests in testing environment, I then update those packages on actual hosts. I want ...
1
vote
0answers
27 views

Using linux environment variable in rsyslog template

I'm trying to add an environment variable to my rsyslog template. I tried using 'getenv()' function without any luck, I always get an empty string in return. I'm attaching an example of my rsyslog ...
0
votes
1answer
2k views

Remotely diagnosing server 2012 boot problems with no KVM

I have a rented dedicated server that seems to have run into some issues. Unfortunately I have rented from a company who will only give hardware support leaving me in the dark. My server had been ...
36
votes
6answers
56k views

Reduce SNMPd logging verbosity

SNMPd on my CentOS systems is sending log messages to syslog every time it receives a query from my monitoring tools. Is there a way to lower the verbosity of SNMPd? It adds a lot of clutter to the ...
-1
votes
0answers
23 views

Apache security - Drupal 8 related

In one of the log entries I see something strange which to me suggest an attempt to execute code. I have never seen this and cannot yet decipher this, does anyone have any idea what this log entry ...
0
votes
0answers
18 views

No new Jenkins logs being written

I just noticed my Jenkins last wrote jenkins.log in /var/log/jenkins for more than 6 months ago. This is from my Jenkins config: # log location. this may be a syslog facility.priority JENKINS_LOG=/...
1
vote
1answer
2k views

How to configure nDPI for iptables

I am new to nDPI, I have installed nDPI but when I add rules like; iptables -I OUTPUT -m ndpi --http -j REJECT it shows error iptables v1.4.7: Couldn't load match `ndpi':/lib64/xtables/libipt_ndpi....
4
votes
2answers
927 views

gzip_ratio not printing in nginx logs

I'm configuring the nginx access_log to output in JSON format to use with other tools. The data I want includes info about the compression. I have gzip on, but the only thing I'm getting for the ...
0
votes
0answers
25 views

Unable to send php7.3 fpm-alpine error logs to std within docker containers

I cannot get the php-fpm error logs appear in docker std. So far I've tried many suggestions but for some reason no progress at all. I am posting my whole setup so that someone could kindly help me to ...
1
vote
1answer
35 views

Distinguish ssh connections from different origins behind NAT

I have a jump server, that many of the clients that connect to it, are sitting behind a NAT, unfortunately, all those clients also uses the same user to connect. Given I have root access for the jump ...
1
vote
3answers
936 views

Syslog does not record logs received over TCP to a file

I am trying to setup a centralized rsyslog server on CentOS 6.5 for Cisco routers and switches. On the Cisco devices, I've set the correct date/time and enabled timestamps, logging to the server over ...
1
vote
0answers
34 views

TLS websocket proxy with deep packet inspection/traffic logging

I have a very specific scenario in which maschines (IoT) are communicating with a central server over websockets. I need to inspect the websockets traffic (wss/tls) for audit and monitoring reasons (...
0
votes
1answer
1k views

Log rotation in nginx

I've found an example of doing log rotation in Nginx here But a simple test with: set $date "2018-08-24"; access_log /home/tim/log/access-http-$date.log default; produces a log file named ...
0
votes
1answer
22 views

Appending new lines in Tomcat Catalina log rotate

Application running on Tomcat is using log4j for some unknown reason is appending (randomly) new log lines somewhere in the middle of the log file log4j.properites looks like: log4j.rootLogger=INFO, ...
1
vote
1answer
15 views

logrotate doesn't seems to work as expected

Below is my log rotation configuration for /var/log/messages. /var/log/messages { rotate 4 size 100M missingok notifempty compress delaycompress sharedscripts ...
0
votes
0answers
12 views

php fpm log executed script

when taking a look at my /var/log/php-fpm.log I notice a lot of [02-Apr-2019 18:01:16] WARNING: [pool wordpress] child 26356 exited on signal 11 (SIGSEGV - core dumped) after 492.828741 seconds from ...
5
votes
4answers
8k views

Wildcard support for InputFileName in rsyslog?

We have log files with names that match a certain pattern but frequently change. Is there a way to specify a wildcard or pattern for rsyslog to include via InputFileName? Example: InputFileName: /...
2
votes
0answers
42 views

What causes these strange characters (@^@^@^@^) in /var/log/messages? [duplicate]

One of my servers stops responding occasionally, today I checked the logs and I seen the attached entries. I assumed it uses too much memory and crashes, but seeing this log, I am not sure, what can ...
0
votes
1answer
1k views

Centos server reboots itself

I am running centos 6.x on my server. It rebooted itself at 10.30am and 11.13am today. I checked /var/log/messages file and couldn't understand. What can be cause to reboot? My log file (I couldn't ...
0
votes
1answer
989 views

Get Unique IP Address and # of Access

I found the following code to see which IP Addresses has the highest hits: FILE=access.log; for ip in cat $FILE |cut -d ' ' -f 1 |sort |uniq; do { COUNT=grep ^$ip $FILE |wc -l; if [[ "$COUNT" -gt "...
0
votes
0answers
25 views

IIS operation cancelled by client is logging response code 0 instead of 500 after request header logging

We have IIS 8.5 hosted REST based Web API services. The default logging is W3C format. Client can cancel the ongoing request and these are logged with the status code of 500. When request header ...
0
votes
3answers
159 views

Rsyslog Remote Logging: Garbled Text when using TLS

I've set up Rsyslog with TLS on two Debian machines and configured remote logging (log-server, log-shipper). However, I am getting "garbled" Text in the logs on the server: Oct 22 07:58:45 log-...
0
votes
3answers
922 views

AWStats LogFormat for AWS Elastic Load Balancer

Hoping someone can point out what is wrong with the LogFormat I'm attempting to use with the access logs generated by Amazon ELB. Multi-line for ServerFault readability: %time5 %elb %host %host_port ...
0
votes
0answers
21 views

What all does a system state restore point save the state of in Windows Server 2016?

I'm fairly certain, all though not all together certain that it saves / restores the state of: The Registry Installed Software Server Settings (which I would assume generally get installed in the ...
8
votes
7answers
5k views

BASH shell session logging on remote host

What's the best method of logging a BASH shell session to a file on the host machine? The preferred output format would be equivalent to PuTTY's "printable output" log setting, as viewed by the user ...
2
votes
3answers
965 views

Finding process name that changes windows time

I have a problem in my server that the system time is automatically getting changed by a day and getting back to normal. I have some software installed for time sych. But the master clock seem to be ...
0
votes
1answer
1k views

IIS 8.5 Enhanced logging not working when adding custom field

I have Windows Server 2012 R2 Standard with IIS 8.5. I added the enhanced logging custom filed for our website (on site level): X-FORWARDED-FOR as described in: https://www.iis.net/learn/get-started/...
0
votes
1answer
12 views

Configuring Apache to log referrer url

I'm trying to make Apache server log the referrer URL in all requests including 404 and 200 for example someone has embedded an image hosted on my websites on his own website. the image is loaded ...
-4
votes
4answers
4k views

Clamav. WARNING: No clamd server appears to be available

I have clamav.log full of these messages, what might be the problem and how to fix this? I have Debian clamav-0.97.6+dfsg-1~squeeze1 spamassassin-3.3.1-1 dovecot-pop3d-1.2.15-7 postfix-2.7.1-1+...
7
votes
2answers
5k views

Nginx log to syslog on TCP port

I need to redirect Nginx access and error logs to a remote syslog server. From http://nginx.org/en/docs/syslog.html I saw that I can do: error_log syslog:server=192.168.1.1; However I need to ...
4
votes
6answers
5k views

How to analyse logs after the site was hacked

One of our web-projects was hacked. Malefactor changed some template files in project and 1 core file of the web-framework (it's one of the famous php-frameworks). We found all corrupted files by git ...
3
votes
4answers
6k views

How can I generate Windows Logs for testing purposes?

I'm trying to test some Splunk-y things with my Windows logs. But I want to be sure of the logs that are coming in so I can be sure I'm keeping and discarding logs properly. What I'm really looking ...
0
votes
2answers
991 views

Samba nmbd server, how to address error messages in logs?

The following messages are dumped into the server logs endlessly. This limits the usefulness of logwatch. Is there a way to fix whatever the issue is or to turn off these messages? Reducing the log ...
-2
votes
1answer
20 views

How to see all incoming requests to my server? [closed]

I have a third party app and I would like to see how it communicates with the server. Why kind of software/server I am supposed to run to log all possible connections attempts to all possible ports? (...
0
votes
3answers
1k views

Make Apache send a copy of requests to a script

Let's say we have a huge list of clients (~30) all running on the same server under different users (and other security settings). I need to write a "spy/logging" script which is able to handle all ...
4
votes
1answer
2k views

How are filters combined in syslog-ng?

If I've got an entry in syslog-ng log { source (src); filter (filter1); filter (filter2); filter (filter3); filter (filter4); destination (all_log) } And, say filter4 is a very ...
0
votes
1answer
19 views

Tomcat - Application logs can't be cleared without stopping

I have some Tomcats where the application log (the one with [tomcat name].[hostname].[node].[webapp].log name format) can't be cleared unless I stop the Tomcat and clear the log. The log size turns ...
0
votes
2answers
1k views

Log Location Url Responses of 301 redirects from IIS

Is there a way to log 301 redirects returned by IIS with the (1) request Url and the (2) location Url of the response? Something like this: Url, Location /about-us, /about /old-page, /new-page ...
0
votes
1answer
34 views

Do not log successful apache requests

I want to get rid of superfluous logging in Apache. I've find tutorial how to use setenvif module for that purpose, setting variable dontlog. The only problem is, I don't see on the criteria list ...