Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [logging]

Recording activity on the system (or of a particular program) for later reporting and analysis. Logins, logouts, web server page requests, etc might all be logged.

67
votes
7answers
75k views

Log all commands run by admins on production servers

It is company policy for admins to login to the servers via a personal username, and then run sudo -i to become root. Upon running sudo -i, sudo will create an environmental variable called SUDO_USER,...
66
votes
12answers
122k views

Do you have any useful awk and grep scripts for parsing apache logs? [closed]

I can use log analyzers, but often I need to parse recent web logs to see what's happening at the moment. I sometimes do things like to figure out top 10 ips that request a certain file cat foo.log ...
56
votes
6answers
12k views

The corporate benefits of using MSI files

What are the advantages of using .msi files over regular setup.exe files? I have the impression that deployment is easier on machines where users have few permissions, but not sure about the details....
40
votes
3answers
32k views

Better logging for cronjobs? Send cron output to syslog?

I am looking for a better way to log cronjobs. Most cronjobs tend to spam email or the console, get ignored, or create yet another logfile. In this case, I have a Nagios NSCA script which sends data ...
13
votes
7answers
17k views

How to log every linux command to a logserver

I want every single command typed to go to a logserver. Already configured is the syslog-ng to send all logs to the logserver. I'm interested in any and all methods to do this. I would expect ...
18
votes
11answers
23k views

Any freeware IIS log analyzer? [closed]

It would be nice to use ASP.NET, but PHP is ok too, and should be hosted in IIS6. EDIT: the logs are from our intranet site.
7
votes
3answers
27k views

Remote Desktop failed logon event 4625 not logging IP address on 2008 Terminal Services server

When I use the new remote desktop with ssl and try to log on with bad credentials it logs a 4625 event as expected. The problem is, it doesn't log the ip address, so I can't block malicious logons in ...
7
votes
1answer
2k views

UFW logs blocked request on open port, what am I missing?

Nov 29 15:17:15 hostname kernel: [397768.554884] [UFW BLOCK] IN=eth0 OUT= MAC=[mac] SRC=[ip] DST=[ip] LEN=52 TOS=0x00 PREC=0x00 TTL=52 ID=17050 PROTO=TCP SPT=56152 DPT=80 WINDOW=65535 RES=0x00 ACK ...
36
votes
6answers
56k views

Reduce SNMPd logging verbosity

SNMPd on my CentOS systems is sending log messages to syslog every time it receives a query from my monitoring tools. Is there a way to lower the verbosity of SNMPd? It adds a lot of clutter to the ...
26
votes
4answers
11k views

Is it possible to get OpenSSH to log the public key that was used in authentication?

I have a production system where several different people are allowed to log in to a single account - the account is for the application and not for the person as we don't have personal accounts on ...
18
votes
6answers
15k views

Turning a log file into a sort of circular buffer

Folks, is there a *nix solution which would make the log file act as a circular buffer? For example, I'd like log files to store maximum 1Gb of data and discard the older entries once the limit is ...
7
votes
3answers
7k views

Avoid logging of certain missing files into the Apache2 error log

I'd like to avoid logging some missing files (that gives a 404) into the Apache2 error log. I want to do this on an Eclipse update site for my plugin. Problem is that the Eclipse P2 code tries to ...
10
votes
1answer
45k views

Apache: Configure “LogLevel debug” for certain modules only?

I want to debug some authentication & authorization issues on my webserver, particularly with mod_authnz_ldap and other mod_auth* modules. So I set LogLevel debug in the Apache configuration, ...
10
votes
2answers
27k views

how to filter rsyslog messages by tags

I have several applications and scripts that I want to redirect the output to custom files. I launch those applications using command | logger -t TAG I would like to filter these messages based on ...
14
votes
2answers
14k views

Where & how can I see IIS7 log entries for a specific web site?

All IIS7 is telling me is a folder (i.e. C:\inetpub\logs\LogFiles) which contains a couple of subfolders. How can I tell which subfolder/file I should look at? What is the logic behind this folder/...
2
votes
2answers
398 views

Strange GET requests in logs

I'm getting the following GET requests in my apache logs: 109.230.251.14 - - [29/Mar/2011:16:28:18 +0100] "GET http://209.191.92.114/config/pwtoken_get?login=jackmcphee232&src=ygodgw&passwd=...
2
votes
2answers
4k views

What rule can I use in ModSecurity to log POST payload for a specific site?

I need to inspect POST payload for a specific website (the server is rather busy and I wouldn't turn on POST logging for the entire server). The server is LiteSpeed 5.0.7. SecRequestBodyAccess is set ...
43
votes
4answers
55k views

Make a Docker application write to stdout

I'm deploying a 3rd-party application in compliance with the 12 factor advisory, and one of the points tell that application logs should be printed to stdout/stderr: then clustering software can ...
16
votes
12answers
46k views

How to watch logs in real time via Terminal?

This is a basic question - in the movie "The Social Network" there are several scenes when the young Facebook staff is watching the PHP/Apache server logs on in their TERMINAL in real time. I'm ...
8
votes
7answers
5k views

BASH shell session logging on remote host

What's the best method of logging a BASH shell session to a file on the host machine? The preferred output format would be equivalent to PuTTY's "printable output" log setting, as viewed by the user ...
11
votes
3answers
5k views

Logging a “persons” activity in Linux

So I've read many of the posts related to this and have just come up more confused than before. There are recommendations for various tools including ttyrec, snoopy, acct, rootsh, sudosh, ttyrpld, ...
18
votes
6answers
23k views

How do I log CPU usage per process?

I have a box on Linode that's going through weird behavior. Every now and then CPU and disk I/O will shoot to 100% and the server becomes unresponsive and has to be booted. I'd like to investigate ...
20
votes
3answers
12k views

nginx logging to access.log.1 instead of access.log, logrotate failing?

I have an nginx instance that is set to log access to /var/log/nginx/access.log and errors to /var/log/nginx/errors.log, but as soon as logrotate runs each week, the file gets moves to *.log.1 and the ...
14
votes
2answers
11k views

How can I detect Slowloris?

I'm pretty sure I was under Slowloris attack. I set up an iptables rule to limit max connections to my webserver, but I'd like to know how I can figure out if it really was a Slowloris attack, and if ...
7
votes
4answers
34k views

Ubuntu 14.04 System Logging

I've set up an Ubuntu 14.04 Server (from an Ubuntu 12.04 Server) but today I wanted to look in the auth.log but this file is not used. It seems that ´syslog´ was deleted. How does Ubuntu 14.04 log? I ...
14
votes
6answers
63k views

How can I enable logging for requests going through mod proxy

Is there a way to log requests going through mod proxy? I need a way to debug my configuration, because I don't seem to be getting where I should be. I need the following information: headers of ...
11
votes
7answers
9k views

tail -f equivalent for MySQL logging database

It was decided that we should move to using a (MySQL) database for our application logs (it is a Java app using the logback lib). I am hoping to find something like tail -f that I can use with a ...
6
votes
3answers
52k views

Log LDAP access of the Active directory

I am looking for a method to log ldap access of a Active Directory domain controller. I want to be able to log the username and source IP address access to both 389, and 636(encrypted). A simple ...
6
votes
3answers
3k views

Could this server log mean my server is being used as a proxy?

I came across the following entry in my access.log: 58.218.199.147 - - [05/Jun/2012:12:56:04 +1000] "GET http://proxyproxys.com/ HTTP/1.1" 200 183 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5....
5
votes
3answers
12k views

Separate Nginx access log file for certain requests only

As far as I can see Nginx supports by default 2 log files: error_log (tracks issues related to the Nginx server itself) and access_log (tracks requests processed by Nginx). Whilst it is possible to ...
4
votes
1answer
4k views

logrotate cron job not rotating certain logs

I added two scripts in "logrotate.d" directory for my application logs to be rotated. This is the config for one of them: <myLogFilePath> { compress copytruncate delaycompress dateext ...
4
votes
1answer
42k views

Where are the ntpd log file located, and how can we configure the ntpd log file path?

I deal with that, ntpd as a daemon on my linux server by default configuring, but where should we look up the log file? Is there any log file normal, and if not , how can we configure that?
4
votes
3answers
2k views

Forward UNIX syslog to Windows Event viewer

I'm running a pfSense firewall which runs syslog and can forward it's logs to a remote syslog server. I'd like to be able to view these on my SBS 2011 server's event viewer, via a subscription. I ...
3
votes
1answer
14k views

Windows Domain Controller Authentication Logon Logging and Forensics

This question does not take Windows Server 2003 and older OSes into consideration. I know that for local logon (event ID 4624) also the logon type is logged (interactive, remote, etc.). Is there a ...
3
votes
2answers
546 views

In Postfix, how do I measure how much traffic is used by each user or domain?

In Postfix, how do I measure how much traffic is used by each user or domain? I can see no "out of the box" means of doing this with vanilla postfix, however, I am sure this is a pretty common need. ...
1
vote
1answer
1k views

Strange code in server access log

So I found this in my logs earlier today: 174.0.111.178 - - [17/Feb/2013:17:39:49 -0900] "k\x8a4\x8f\x9f\x1c\xfb\xb9\xf4\xb8\x97CI\xa3w\xeb\xf9\xb2\xb4\b\xb9\x04\x05\xe1M\x88C\xde\xed<\x13\b\xfd\b\...
9
votes
1answer
11k views

How to log original value of $remote_addr when using Real-IP

My environment has user requests passing through a number of systems: [Client] --> [ELB] ---> [nginx] --> [web] (ELB = AWS Elastic Load Balancer) Thanks to this answer, I have nginx determining and ...
3
votes
3answers
2k views

Filtering bad requests from Apache -> logger -> rsyslog to syslog-ng on a remote logging server possible?

EDIT: Thanks for the help Here is a quick idea of the setup: webserver X In apache httpd.conf: LogFormat "%v %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" vcombined CustomLog "|/...
2
votes
1answer
10k views

How do i view / enable kernel logs on an ec2 instance (amazon linux)?

I've got a amazon ec2 server that i'm playing around with TCP settings in the sysctl.conf to increase the number of concurrent TCP connections it can handle, and i want to be able to view the kernel ...
-3
votes
2answers
238 views

A software to analyze Apache log is needed [closed]

I have grep the Apache logs of my website for a specific period of time. I need a software to analyze it to see what are the most visitor IPs . My OS is Ubuntu. Would you suggest something? Thank ...
20
votes
5answers
45k views

How do I get rsyslogd to log a server's FQDN instead of it's short hostname?

I'm trying to implement a simple centralized syslog server using stock rsyslogd (4.2.0-2ubuntu8.1) on Ubuntu 10.04 LTS. At this point I have all my client nodes sending logs to the central server, but ...
23
votes
1answer
23k views

How can I let nginx log the used SSL/TLS protocol and ciphersuite?

My goal is to ensure proper security for clients connecting to my nginx. I'm following Mozilla's guide to configure TLS properly on my nginx installation, but I don't have an overview of the actual ...
40
votes
12answers
25k views

Tail multiple remote files

Is there a way to remote tail 2 files? I have two servers(a and b) behind a load balancer and I would like to do something like this if possible: tail -f admin@serverA:~/mylogs/log admin@serverB:~/...
14
votes
4answers
3k views

Log transport and aggregation at scale

How're you analysing log files from UNIX/Linux machines? We run several hundred servers which all generate their own log files, either directly or through syslog. I'm looking for a decent solution to ...
51
votes
5answers
15k views

Equivalent of logrotate on OSX

Is logrotate hiding somewhere on OSX, or is there an equivalent? It's not in /usr/sbin.
15
votes
8answers
154k views

Are there any RDP activity logs? - Windows Server 2008 R2

a few users have logged into a server through RDP. I would like to monitor activity, but do not know my way round Windows Server that well. I am hoping there are logs of some kind around that I can ...
10
votes
8answers
9k views

The most powerful open source web analytics tools? [closed]

Need some advices on choosing open source web analytics tools, including both of page tagging and log file analysis type. I know some of them: piwik, open web analytics, awstats and more... what are ...
28
votes
1answer
50k views

Where are the logs for ufw located on Ubuntu Server?

I have an Ubuntu server where I am blocking some IPs with ufw. I enabled logging, but I don't know where to find the logs. Where might the logs be or why might ufw not be logging?
12
votes
3answers
5k views

How can i send /var/mail/root again?

Through some misconfiguration I've a lot of emails in /var/mail/root and /var/mail/www-data How can I "loop" over these files and send each mail another time?
12
votes
4answers
13k views

How can I make syslogd email certain log messages to me?

I'd like to be able to get an email notification whenever syslogd logs something of, say err priority or higher. Assume this is a BSD compatible syslog daemon. Can this be accomplished? Should I ...