Questions tagged [logging]

Recording activity on the system (or of a particular program) for later reporting and analysis. Logins, logouts, web server page requests, etc might all be logged.

Filter by
Sorted by
Tagged with
0 votes
0 answers
8 views

pam_unix logs: xrdp-sesman:session session opened for user USERNAME(uid) by (uid=0)

recently I found a lot of these type of logs: pam_unix(xrdp-sesman:session): session opened for user username(uid=some_uid) by (uid=0) From what I read is xrdp-sesmam-session that is "opening&...
res1's user avatar
  • 125
1 vote
0 answers
14 views

After creating relying party trust in ADFS, how to validate configuration is correct using SAML tracer

I created a relying party trust in ADFS. To test, I log into IDP, initiate link, select the relying party, enter credentials, then the application page will display. How do I perform this validation ...
rashmi byali's user avatar
0 votes
1 answer
58 views

Cannot add Kubernetes metadata as label to Loki container logs in FluentBit

I am trying to gather container logs in Kubernetes environment using FluentBit, Loki and Grafana. I would like to append Kubernetes Pod name as label so when I query the logs in Grafana, it would be ...
Balint Laszlo's user avatar
0 votes
0 answers
30 views

Fluentd tail config for HashiCorp Vault audit/server logs from stdout

I'm trying to figure out a way to get both the audit and server logs from HasiCorp Vault container (both logs go to stdout of the same container and they have a different structure): Audit example: ...
jacktaaniels's user avatar
0 votes
0 answers
27 views

Watchguard logs incoming SMTP connections has an dst_user entry. Where can I change this entry?

Hello fellow Exchangers, as mentioned in the title any incoming smtp connection is routed correctly to our onpremise microsoft exchange server and the logs look as described here: https://www....
erai's user avatar
  • 1
0 votes
1 answer
53 views

Nginx not logging after Logrotate

I've a nginx reverse proxy with custom log files (depending on hostname) pwd : /var/log/nginx/domain/fqdn.(log|err) Since some time (maybe after switching to Ubuntu 23.10), my log files are very often ...
guillaumearnx's user avatar
0 votes
1 answer
50 views

nginx custom log format to log header value when exists

environment setup I have nginx webserver and simple backend application. this backend app has custom response header in certain condition (for example: X-Real-Status) and it's running behind nginx as ...
sadegh mohebbi's user avatar
0 votes
0 answers
32 views

Looking to monitor activity regarding connection attempts to closed ports on my system, what log file in should i look in? Ubuntu

I'm looking to monitor activity regarding connection attempts to closed ports on my system, as part of a server side portknocking implemetation. However, I am confused about what log file in ...
kagami's user avatar
  • 1
0 votes
0 answers
13 views

Where can I find the output of exim's 'debug_print'? -- years later

There is an old thread: Where can I find the output of exim's 'debug_print'? (so yes I did search for existing questions, I did find an exact match , but I'm not allowed to comment + it's ...
GraemeV's user avatar
0 votes
0 answers
24 views

How to get MariaDB slow query logs to show up on RDS

I have a MariaDB instance on RDS which I would like to enable slow query logs for. Following the documentation, I've created a paramter group which is assigned to the database. When I make changes to ...
Toby Osbourn's user avatar
0 votes
1 answer
129 views

how can I configure All-in-one WAZUH for log retention?

I installed WAZUH all-in-one no kibana no elastics, and I want to write a code where I can make 40 days of log retention, Any advice or guides for this solution?
SSD's user avatar
  • 1
0 votes
0 answers
52 views

Changing nginx default log format sometimes doesn't work

I've recently set up fail2ban to work with my custom nginx logging format (called "main"), I have all my sites logging to a different *.access.log file. I still had to change the default ...
user9503's user avatar
0 votes
1 answer
108 views

Making Tomcat log in /var/log

I'm trying to make our Tomcat 9 server log its internal log in /var/log instead of ${catalina.base}/logs. I tried to change the destinations in logging.properties, but the logs directory in ${catalina....
Alexis Dufrenoy's user avatar
0 votes
1 answer
67 views

Postfix Log - Get entries for certain mail only

The standard Postfix log Format is something like Feb 4 15:03:53 mail postfix/smtp[31148]: xyz The 31148 seems to be the process id, so this does not necessarily change if I send another mail. At ...
Netnoob's user avatar
  • 11
0 votes
2 answers
142 views

Syslog-ng multiple filters

I am fairly new to syslog-ng and I have the following issue. I have a Checkpoint firewall that sends the logs to a Splunk server. Due to the huge amount of data sent by the firewall, I tried to filter ...
Daniel D.'s user avatar
0 votes
0 answers
29 views

The way of logging at action of controller in Ruby on Rails for debug purpose

I am just trying to know if router is reaching to specific action of controller. In js, we are using console.log and var_dump in php. I tried with puts but it didn't work and I think it's because of ...
Alan Daniela's user avatar
0 votes
0 answers
169 views

How to be sure to keep all the logs regarding a MySQL table data but filter Google Cloud SQL maintenance queries logs made by localhost GCP SQL?

I enabled the flag General_log for a Google Cloud SQL MySQL instance to get all the queries logs in Google Cloud Logging. I get all the queries users make, but also all the queries made to probe and ...
jwtrees's user avatar
  • 111
0 votes
1 answer
155 views

Why rotatelogs from apache produce files smaller than specified max size?

I use the following rotatelogs command from Apache : /usr/sbin/rotatelogs /var/log/somelogfile 1GB If I send 1GB of content to it (for testing), it produces the following files : somelogfile....
tigrou's user avatar
  • 111
0 votes
1 answer
80 views

What do these logs mean? Is someone attempting to hack into my server via ssh?

Today I woke up to a a very large number of logs for ssh, and I can only assume someone is trying to gain access to my linux server. Here are the logs -- Logs begin at Wed 2023-08-02 08:59:10 EEST, ...
Codrut's user avatar
  • 13
0 votes
1 answer
50 views

Microsoft Defender: extract Automatic log upload data

Is there a way to extract this automatic log upload table from defender: my goal is to use this information to aid in responding to the System alert: Cloud Discovery automatic log upload error alert ...
HarriS's user avatar
  • 101
0 votes
3 answers
142 views

Exchange Server: Is it possible to find out which user marked an email as read?

We are running a self hosted Exchange 2016 Windows Server 2016 Datacenter. There is a shared mailbox used by multiple users. Users have been told to mark emails in this account only in special cases, ...
Thariama's user avatar
  • 106
0 votes
0 answers
26 views

SSH_CLIENT variable bringing the server's IP instead of the client's IP when connecting via SSH

I need to monitor the SSH access logs of an Oracle Linux Server 7.9 to determine which machines accessed this server throughout the day. However, the logs display the IP of the server itself instead ...
Guilherme Oliveira's user avatar
0 votes
1 answer
59 views

What IAM permissions are required to change audit log settings in Google Cloud?

In our Google Cloud project, we have granted the following IAM roles to certain users, but they are unable to make changes to the audit log settings. Project Editor Logging administrator When I try ...
Tanaka's user avatar
  • 1
0 votes
1 answer
94 views

Apache LogFormat: what does %f mean?

I have checked the apache logformat from - https://httpd.apache.org/docs/2.4/mod/mod_log_config.html I am not able to understand what does "%f" parameter mean in apache log format. The ...
Yogesh Tembe's user avatar
1 vote
0 answers
106 views

What solution to use in order to visualize journald/syslog logs via a Web UI (e.g. self-hosted web app, web page or plugin for Nagios and friends)

I am running a single virtual, private root server (VPS) and finally managed to setup all daemons to nicely log to syslog. All logs are collected by journald and organized into sylog facilities (mail, ...
user2690527's user avatar
-2 votes
2 answers
230 views

What updates `/var/log/btmp`? How to stop it?

Before providing an answer, please read the question till then end. ESPECIALLY THE SECTION on "Solutions" I am not looking for! I have a server which runs SSH on a public IP address. ...
user2690527's user avatar
1 vote
2 answers
247 views

Can a service managed by systemd send its logs somewhere other than /var/log/messages?

We have a RHEL 8 server where we have a few python applications installed for data management and analysis, notably JupyterHub and Airflow. We have these set up with systemd unit files so we can start,...
raphael's user avatar
  • 169
0 votes
0 answers
71 views

Is there a Apache module can fully log HTTP requests, in a non processed way?

I'm looking for an Apache module that is able to log the RAW content of HTTP requests, unprocessed. Here is one example : POST https://foobar/ HTTP/1.1 Host: foorbar Connection: keep-alive Content-...
tigrou's user avatar
  • 111
0 votes
0 answers
742 views

How to get output of STDOUT to GCP cloud logging

Hey I have a job running on a gcp VM where some imported libraries are logging to stdout with the print or python logging library, and I also have written a lot of code where the output is logged to ...
Matt Elgazar's user avatar
0 votes
0 answers
302 views

Discover process that exhausted my memory and CPU limits on Ubuntu

I have a DigitalOcean droplet running Ubuntu 22.04.2 LTS (GNU/Linux 5.15.0-89-generic x86_64). My website went down at approximately Fri Dec 01 6:48 AM GMT. From var/log/apache2/access.log, I ...
Jaime Montoya's user avatar
0 votes
0 answers
11 views

Is there a way to detect which requests have been made using same connection in Apache log?

I use mod_log_config and mod_log_forensic to log all requests made to an Apache server. Some of those requests use Keep-Alive and I would like to find out which requests have been made using the same ...
tigrou's user avatar
  • 111
0 votes
1 answer
119 views

How can I monitor journald to invoke a program on a condition?

Before I reinvent the wheel and start scripting, is there a simple way (or existing tool) that can watch the systemd journal and take actions when certain log entries or conditions are detected? ...
Nick's user avatar
  • 4,656
0 votes
0 answers
185 views

Connect multiple hosts running promtail to loki running on a separate host

Hi all first time posting here. I have 3 different servers. This is the setup I want to achieve: Server1 (51.25.365.12): promtail Server2 (51.25.78.215): promtail Server3 (216.25.36.54): promtail, ...
Curious Developer's user avatar
0 votes
1 answer
41 views

Windows Event Collector (WEF) Event Viewer unresponsive

We are using Windows Event Collector (WEF) to forward defined security events to a special server. After some days of using this solution, navigating to "Subscription" within the Event ...
HEGE's user avatar
  • 99
0 votes
0 answers
66 views

Enable $RepeatedMsgReduction only for specific log file

If this were the script for routing messages to log files in rsyslog.conf, is it possible to activate RepeatedMsgReduction only for app_log? if ($syslogfacility-text == "auth") then { ...
zeroKool's user avatar
0 votes
0 answers
271 views

Datadog not collecting logs from file in Kubernetes cluster

I am trying to configure Datadog agent on AKS Cluster and to read logs from file location at /var/log/datadog/messages.log in each service pod. It is streaming all the metrics except logs from file ...
CodeRunner's user avatar
0 votes
0 answers
65 views

session logging on CentOS stream

I had a Centos 8 installation with a working session logging setup (sssd, tlog). On any ssh login to the server the session was logged and sent to a syslog server. All the logins are local logins (/...
Spiros Papageorgiou's user avatar
0 votes
1 answer
131 views

NFS Stale mounts logging and tracing

We have a large filesystem exported via NFS and mounted to several Linux Servers. These mounts seem to go stale for some seconds during the last days making the apps using those mounts to freeze. ...
trikelef's user avatar
  • 528
2 votes
1 answer
357 views

Postfix: How to log to syslog only?

I have Postfix 3.8.1 on Ubuntu 23.10. How do I configure Postfix to log to syslog only? My syslog daemon is journald. According to my understand, Postfix should log to syslog, if maillog_file is not ...
user2690527's user avatar
0 votes
0 answers
269 views

Windows event id 4673 audit Failed attempt to perform a privileged operation

I am consistently receiving this error message from agents, and I am receiving a significant number of them daily from a single agent, while the other agents are also receiving the same error message. ...
Abdulaziz Aljaberi's user avatar
0 votes
0 answers
129 views

Add the name of the file analyzed to the e-mail (logcheck)

I use logcheck to receive apache logs. My question is how to configure logcheck to add the name of the file that is analysed in the email. Example: at the moment I have this: This email is sent by ...
Mehdi Birembaut's user avatar
0 votes
1 answer
494 views

Fluent-bit in Kubernetes cannot input timestamp data properly

At my company, I built a K8s cluster with Terraform and configured a logging system with EFK (Elasticsearch, Fluent-bit, Kibana). k8s and Elasticsearch use AWS's EKS and Opensearch Servcie (ES 7.10), ...
HJ S's user avatar
  • 1
2 votes
1 answer
73 views

How to make logwatch show a reboot event in the report?

Our environment consists of several workstations and servers, all RHEL (CentOS 7) and with logwatch (currently v7.4.0) installed. A custom cron job sends daily logwatch reports via email. The command ...
egeiter's user avatar
  • 21
0 votes
1 answer
309 views

How to stream Kubernetes log files to a different location using fluent-bit?

I have a requirement where I want the log files of all the Kubernetes containers stored in the location /var/log/containers/ to be kept persistent even after a cluster restart or node issue. I have ...
Gill Varghese Sajan's user avatar
0 votes
0 answers
226 views

php-fpm - How to log `NOTICE`s to stdout, everything else (`E_ALL`) to stderr?

As far as I understood the configuration docs, it is only possible to enable/disable specific log levels: # ini, E_NOTICE disabled entirely. error_reporting=E_ALL & ~E_NOTICE display_errors=stderr ...
goulashsoup's user avatar
0 votes
1 answer
194 views

Rsyslog not writing any logs from Cisco network devices - all other remote syslog works fine

tcpdump confirms valid syslog is coming in from multiple remote systems - servers and Cisco network equipment. OS is Linux RHEL 8.8 The servers all come in fine and write to disk, and are shown as ...
mkramer317's user avatar
0 votes
0 answers
26 views

syslog diff or comparison that reorders identical lines to ignore race conditions?

Sometimes when debugging intermittent boot problems, it would be advantageous compare two exerpts from syslog: One leading to a working system, and one leading to the symptom. However, diff is not ...
James Bowery's user avatar
0 votes
0 answers
251 views

Logging all http requests to domain

I bought a domain name and I would like to log what http requests it receives. Logging the requests headers, url, type and message body. Looking for an easy/affordable solution. Standing up an Apache ...
Nick's user avatar
  • 143
0 votes
1 answer
455 views

How can I connect standard output and error of a systemd service to a file with a date in the path?

I would like to run a server process under systemd, and append its standard output and error to a file, where the file path has a date in it, like this: /initech/logs/tps-report-app/sales/2023/09/11/...
Tom Anderson's user avatar
0 votes
1 answer
68 views

CentOS 7: Postfix logs got cleared when running history -c. How can I investigate what happened the day the log was cleared?

By default, running history -c has no way of also deleting /var/mail/maillog, right? How can I investigate what happened the day the log was cleared, or (by definition) when the new maillog was ...
Andrw's user avatar
  • 113

1
2 3 4 5
58