Questions tagged [logging]
Recording activity on the system (or of a particular program) for later reporting and analysis. Logins, logouts, web server page requests, etc might all be logged.
2,892
questions
0
votes
0
answers
8
views
pam_unix logs: xrdp-sesman:session session opened for user USERNAME(uid) by (uid=0)
recently I found a lot of these type of logs:
pam_unix(xrdp-sesman:session): session opened for user username(uid=some_uid) by (uid=0)
From what I read is xrdp-sesmam-session that is "opening&...
1
vote
0
answers
14
views
After creating relying party trust in ADFS, how to validate configuration is correct using SAML tracer
I created a relying party trust in ADFS.
To test, I log into IDP, initiate link, select the relying party, enter credentials, then the application page will display.
How do I perform this validation ...
0
votes
1
answer
58
views
Cannot add Kubernetes metadata as label to Loki container logs in FluentBit
I am trying to gather container logs in Kubernetes environment using FluentBit, Loki and Grafana.
I would like to append Kubernetes Pod name as label so when I query the logs in Grafana, it would be ...
0
votes
0
answers
30
views
Fluentd tail config for HashiCorp Vault audit/server logs from stdout
I'm trying to figure out a way to get both the audit and server logs from HasiCorp Vault container (both logs go to stdout of the same container and they have a different structure):
Audit example:
...
0
votes
0
answers
27
views
Watchguard logs incoming SMTP connections has an dst_user entry. Where can I change this entry?
Hello fellow Exchangers,
as mentioned in the title any incoming smtp connection is routed correctly to our onpremise microsoft exchange server and the logs look as described here:
https://www....
0
votes
1
answer
53
views
Nginx not logging after Logrotate
I've a nginx reverse proxy with custom log files (depending on hostname)
pwd : /var/log/nginx/domain/fqdn.(log|err)
Since some time (maybe after switching to Ubuntu 23.10), my log files are very often ...
0
votes
1
answer
50
views
nginx custom log format to log header value when exists
environment setup
I have nginx webserver and simple backend application. this backend app has custom response header in certain condition (for example: X-Real-Status) and it's running behind nginx as ...
0
votes
0
answers
32
views
Looking to monitor activity regarding connection attempts to closed ports on my system, what log file in should i look in? Ubuntu
I'm looking to monitor activity regarding connection attempts to closed ports on my system, as part of a server side portknocking implemetation. However, I am confused about what log file in ...
0
votes
0
answers
13
views
Where can I find the output of exim's 'debug_print'? -- years later
There is an old thread:
Where can I find the output of exim's 'debug_print'?
(so yes I did search for existing questions, I did find an exact match , but I'm not allowed to comment + it's ...
0
votes
0
answers
24
views
How to get MariaDB slow query logs to show up on RDS
I have a MariaDB instance on RDS which I would like to enable slow query logs for.
Following the documentation, I've created a paramter group which is assigned to the database.
When I make changes to ...
0
votes
1
answer
129
views
how can I configure All-in-one WAZUH for log retention?
I installed WAZUH all-in-one no kibana no elastics, and I want to write a code where I can make 40 days of log retention, Any advice or guides for this solution?
0
votes
0
answers
52
views
Changing nginx default log format sometimes doesn't work
I've recently set up fail2ban to work with my custom nginx logging format (called "main"), I have all my sites logging to a different *.access.log file. I still had to change the default ...
0
votes
1
answer
108
views
Making Tomcat log in /var/log
I'm trying to make our Tomcat 9 server log its internal log in /var/log instead of ${catalina.base}/logs.
I tried to change the destinations in logging.properties, but the logs directory in ${catalina....
0
votes
1
answer
67
views
Postfix Log - Get entries for certain mail only
The standard Postfix log Format is something like
Feb 4 15:03:53 mail postfix/smtp[31148]: xyz
The 31148 seems to be the process id, so this does not necessarily change if I send another mail. At ...
0
votes
2
answers
142
views
Syslog-ng multiple filters
I am fairly new to syslog-ng and I have the following issue. I have a Checkpoint firewall that sends the logs to a Splunk server. Due to the huge amount of data sent by the firewall, I tried to filter ...
0
votes
0
answers
29
views
The way of logging at action of controller in Ruby on Rails for debug purpose
I am just trying to know if router is reaching to specific action of controller.
In js, we are using console.log and var_dump in php.
I tried with puts but it didn't work and I think it's because of ...
0
votes
0
answers
169
views
How to be sure to keep all the logs regarding a MySQL table data but filter Google Cloud SQL maintenance queries logs made by localhost GCP SQL?
I enabled the flag General_log for a Google Cloud SQL MySQL instance to get all the queries logs in Google Cloud Logging. I get all the queries users make, but also all the queries made to probe and ...
0
votes
1
answer
155
views
Why rotatelogs from apache produce files smaller than specified max size?
I use the following rotatelogs command from Apache :
/usr/sbin/rotatelogs /var/log/somelogfile 1GB
If I send 1GB of content to it (for testing), it produces the following files :
somelogfile....
0
votes
1
answer
80
views
What do these logs mean? Is someone attempting to hack into my server via ssh?
Today I woke up to a a very large number of logs for ssh, and I can only assume someone is trying to gain access to my linux server.
Here are the logs
-- Logs begin at Wed 2023-08-02 08:59:10 EEST, ...
0
votes
1
answer
50
views
Microsoft Defender: extract Automatic log upload data
Is there a way to extract this automatic log upload table from defender:
my goal is to use this information to aid in responding to the System alert: Cloud Discovery automatic log upload error alert ...
0
votes
3
answers
142
views
Exchange Server: Is it possible to find out which user marked an email as read?
We are running a self hosted Exchange 2016 Windows Server 2016 Datacenter.
There is a shared mailbox used by multiple users.
Users have been told to mark emails in this account only in special cases, ...
0
votes
0
answers
26
views
SSH_CLIENT variable bringing the server's IP instead of the client's IP when connecting via SSH
I need to monitor the SSH access logs of an Oracle Linux Server 7.9 to determine which machines accessed this server throughout the day. However, the logs display the IP of the server itself instead ...
0
votes
1
answer
59
views
What IAM permissions are required to change audit log settings in Google Cloud?
In our Google Cloud project, we have granted the following IAM roles to certain users, but they are unable to make changes to the audit log settings.
Project Editor
Logging administrator
When I try ...
0
votes
1
answer
94
views
Apache LogFormat: what does %f mean?
I have checked the apache logformat from - https://httpd.apache.org/docs/2.4/mod/mod_log_config.html
I am not able to understand what does "%f" parameter mean in apache log format. The ...
1
vote
0
answers
106
views
What solution to use in order to visualize journald/syslog logs via a Web UI (e.g. self-hosted web app, web page or plugin for Nagios and friends)
I am running a single virtual, private root server (VPS) and finally managed to setup all daemons to nicely log to syslog. All logs are collected by journald and organized into sylog facilities (mail, ...
-2
votes
2
answers
230
views
What updates `/var/log/btmp`? How to stop it?
Before providing an answer, please read the question till then end. ESPECIALLY THE SECTION on "Solutions" I am not looking for!
I have a server which runs SSH on a public IP address. ...
1
vote
2
answers
247
views
Can a service managed by systemd send its logs somewhere other than /var/log/messages?
We have a RHEL 8 server where we have a few python applications installed for data management and analysis, notably JupyterHub and Airflow. We have these set up with systemd unit files so we can start,...
0
votes
0
answers
71
views
Is there a Apache module can fully log HTTP requests, in a non processed way?
I'm looking for an Apache module that is able to log the RAW content of HTTP requests, unprocessed. Here is one example :
POST https://foobar/ HTTP/1.1
Host: foorbar
Connection: keep-alive
Content-...
0
votes
0
answers
742
views
How to get output of STDOUT to GCP cloud logging
Hey I have a job running on a gcp VM where some imported libraries are logging to stdout with the print or python logging library, and I also have written a lot of code where the output is logged to ...
0
votes
0
answers
302
views
Discover process that exhausted my memory and CPU limits on Ubuntu
I have a DigitalOcean droplet running Ubuntu 22.04.2 LTS (GNU/Linux 5.15.0-89-generic x86_64). My website went down at approximately Fri Dec 01 6:48 AM GMT. From var/log/apache2/access.log, I ...
0
votes
0
answers
11
views
Is there a way to detect which requests have been made using same connection in Apache log?
I use mod_log_config and mod_log_forensic to log all requests made to an Apache server.
Some of those requests use Keep-Alive and I would like to find out which requests have been made using the same ...
0
votes
1
answer
119
views
How can I monitor journald to invoke a program on a condition?
Before I reinvent the wheel and start scripting, is there a simple way (or existing tool) that can watch the systemd journal and take actions when certain log entries or conditions are detected?
...
0
votes
0
answers
185
views
Connect multiple hosts running promtail to loki running on a separate host
Hi all first time posting here.
I have 3 different servers. This is the setup I want to achieve:
Server1 (51.25.365.12): promtail
Server2 (51.25.78.215): promtail
Server3 (216.25.36.54): promtail, ...
0
votes
1
answer
41
views
Windows Event Collector (WEF) Event Viewer unresponsive
We are using Windows Event Collector (WEF) to forward defined security events to a special server. After some days of using this solution, navigating to "Subscription" within the Event ...
0
votes
0
answers
66
views
Enable $RepeatedMsgReduction only for specific log file
If this were the script for routing messages to log files in rsyslog.conf, is it possible to activate RepeatedMsgReduction only for app_log?
if ($syslogfacility-text == "auth") then {
...
0
votes
0
answers
271
views
Datadog not collecting logs from file in Kubernetes cluster
I am trying to configure Datadog agent on AKS Cluster and to read logs from file location at /var/log/datadog/messages.log in each service pod.
It is streaming all the metrics except logs from file ...
0
votes
0
answers
65
views
session logging on CentOS stream
I had a Centos 8 installation with a working session logging setup (sssd, tlog). On any ssh login to the server the session was logged and sent to a syslog server. All the logins are local logins (/...
0
votes
1
answer
131
views
NFS Stale mounts logging and tracing
We have a large filesystem exported via NFS and mounted to several Linux Servers.
These mounts seem to go stale for some seconds during the last days making the apps using those mounts to freeze.
...
2
votes
1
answer
357
views
Postfix: How to log to syslog only?
I have Postfix 3.8.1 on Ubuntu 23.10. How do I configure Postfix to log to syslog only? My syslog daemon is journald.
According to my understand, Postfix should log to syslog, if maillog_file is not ...
0
votes
0
answers
269
views
Windows event id 4673 audit Failed attempt to perform a privileged operation
I am consistently receiving this error message from agents, and I am receiving a significant number of them daily from a single agent, while the other agents are also receiving the same error message.
...
0
votes
0
answers
129
views
Add the name of the file analyzed to the e-mail (logcheck)
I use logcheck to receive apache logs. My question is how to configure logcheck to add the name of the file that is analysed in the email. Example: at the moment I have this:
This email is sent by ...
0
votes
1
answer
494
views
Fluent-bit in Kubernetes cannot input timestamp data properly
At my company, I built a K8s cluster with Terraform and configured a logging system with EFK (Elasticsearch, Fluent-bit, Kibana).
k8s and Elasticsearch use AWS's EKS and Opensearch Servcie (ES 7.10), ...
2
votes
1
answer
73
views
How to make logwatch show a reboot event in the report?
Our environment consists of several workstations and servers, all RHEL (CentOS 7) and with logwatch (currently v7.4.0) installed. A custom cron job sends daily logwatch reports via email. The command ...
0
votes
1
answer
309
views
How to stream Kubernetes log files to a different location using fluent-bit?
I have a requirement where I want the log files of all the Kubernetes containers stored in the location /var/log/containers/ to be kept persistent even after a cluster restart or node issue. I have ...
0
votes
0
answers
226
views
php-fpm - How to log `NOTICE`s to stdout, everything else (`E_ALL`) to stderr?
As far as I understood the configuration docs, it is only possible to enable/disable specific log levels:
# ini, E_NOTICE disabled entirely.
error_reporting=E_ALL & ~E_NOTICE
display_errors=stderr
...
0
votes
1
answer
194
views
Rsyslog not writing any logs from Cisco network devices - all other remote syslog works fine
tcpdump confirms valid syslog is coming in from multiple remote systems - servers and Cisco network equipment.
OS is Linux RHEL 8.8
The servers all come in fine and write to disk, and are shown as ...
0
votes
0
answers
26
views
syslog diff or comparison that reorders identical lines to ignore race conditions?
Sometimes when debugging intermittent boot problems, it would be advantageous compare two exerpts from syslog: One leading to a working system, and one leading to the symptom. However, diff is not ...
0
votes
0
answers
251
views
Logging all http requests to domain
I bought a domain name and I would like to log what http requests it receives. Logging the requests headers, url, type and message body. Looking for an easy/affordable solution. Standing up an Apache ...
0
votes
1
answer
455
views
How can I connect standard output and error of a systemd service to a file with a date in the path?
I would like to run a server process under systemd, and append its standard output and error to a file, where the file path has a date in it, like this:
/initech/logs/tps-report-app/sales/2023/09/11/...
0
votes
1
answer
68
views
CentOS 7: Postfix logs got cleared when running history -c. How can I investigate what happened the day the log was cleared?
By default, running history -c has no way of also deleting /var/mail/maillog, right?
How can I investigate what happened the day the log was cleared, or (by definition) when the new maillog was ...