Questions tagged [logs]

Configuring or analysing log files (text files where programs output error and informational messages, useful for debugging and troubleshooting).

341 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
2
votes
0answers
857 views

Extract particular words from Rsyslog %msg% facility

After lot of search on Google and reading all manuals available on man page and internet, I finally ask here. In my scenario, I have one rsyslog server working with mysql and a custom template ...
2
votes
0answers
163 views

rsyslog.conf only partly honored

I followed this description on how to enable audit for Samba (entry of Aug 10, 2009) and wanted to get all additionally enabled logging in a special log file (/var/log/samba/log.audit). The mentioned ...
2
votes
1answer
95 views

starts logging when the limits are hit

/etc/security/limits.conf. The file is responsible to limit resources of users/groups on a Linux server. Unfortunately, the file does not generate any logs (or the case could be that I do not really ...
2
votes
0answers
339 views

smartd custom logfile on systemd + journald based system

An excerpt from smartd manpage reads: -l FACILITY, --logfacility=FACILITY Uses syslog facility FACILITY to log the messages from smartd. Here FACILITY is one of local0, local1, ..., local7, or ...
2
votes
0answers
3k views

find ount what [flush-8:0] is writing

Using iotop, I found out that [flush-8:0] is doing a lot of hard disk activity, which explains the annoying slowdowns. However, I can't figure out what's the actual cause behind this flushing. No ...
2
votes
0answers
447 views

Logwatch ignores self-defined service, but explicit setting --service $service works

I am using SSLH on my server to accept both SSL and SSH connections on Port 443. As the logs of sshd and apache2 show each incoming connection via SSLH originating from 127.0.0.1, I want to add the ...
2
votes
0answers
239 views

Nested filtering in rsyslogd

I'm using rsyslogd and trying to figure out why things like if $hostname startswith 'd.42ba7373' and $programname == 'app' then /var/log/bla2app work just fine, but if $hostname startswith 'd....
2
votes
0answers
569 views

Terminal logging via putty on AIX (including smitty)

I use a terminal logging method on my Ubuntu Desktop for the GNOME-terminal (it's good when I use SSH in GNOME-terminal): Implementation As root: apt-get install bsdutils As the normal user: ...
2
votes
1answer
1k views

How to log processes in daemon-mode?

I would like to save the standard output of the program motion in a text file. If I don't use motion in daemon-mode I would simply do it by: motion > log.txt But what is the equivalent when I run ...
1
vote
0answers
18 views

How to configure auditd to collect logs from /proc

I've been looking for this for about 2 days and have come up empty handed. I am looking for a way to build a threat alert for linux based credential dumping in splunk. To do this I need to be able to ...
1
vote
0answers
31 views

Continuously display new content of a file that contains a given word

When using less pressing Shift-F takes to the end of the file, and continuously display new contents. Is there any option (with any *nix tool) to continuously display new content which contains a ...
1
vote
0answers
71 views

Airflow log rotation

I am about to use logrotate for the first time, I went through man page and some web guides. I am trying to achieve rotation every week and deletion of the logs that are older than 7 days (I want to ...
1
vote
0answers
25 views

Headless armbian device stopped responding to ssh

I have a headless device (Orange Pi Zero) running Armbian that I use to experiment with. Today it suddenly stopped responding to SSH (my only means of interacting with the device): mark@mark:~$ ssh ...
1
vote
1answer
10 views

Capabilities of Sudoers and Sudoreplay Logging and Playback

Is the sudoers file in RHEL limited to configuring logging to only what is typed on the keyboard, output on the screen, or errors thrown, or can it go beyond this? For example, if I want to record a ...
1
vote
0answers
16 views

Collecting Logs in full depth

We have a Linux server, whose logs are collected by EventLog Analyzer on a Windows machine. I need to collect logs of events in full detail format, e.g /home/aa/bb/a.xlsx /home/xxx/sss/b.doc ...
1
vote
0answers
17 views

My wlan0 connection drops ~ every 5 minutes. Using USB and rtl8192cu. Where to find log info and how to fix?

I'm finishing setting up a used laptop (ca. 2015?) with a pretty current version of Debian. I have a USB wifi device that worked with a Raspberry Pi a few years ago. It's an rtl8192cu. To get it to ...
1
vote
0answers
62 views

rsyslog configuration without restart

I have a problem with logging. With my configuration below, I have to perform rsyslog restart if I want to have my application log file in /var/log. Also, I have to restart rsyslog it in case of log ...
1
vote
0answers
33 views

What causes log output to the active console?

I'm running Manjaro ARM 64bit on a Raspberry Pi (more specific question there), but this question is more general: Which settings might cause log output to be always displayed on the active console? I ...
1
vote
0answers
35 views

logging for proxycommand

I need to logging users that connected throw bastion host using proxycommand, I have used next command: $ ssh -i ~/.ssh/key.pem user@ip -o "proxycommand ssh -W %h:%p user_bastio@bastion" In ...
1
vote
1answer
24 views

how to get packets log which are dropped by rp_filter=1

I do need a log of packets which are dropped by rp_filter ... how to do this logging ? which logs how to enable.
1
vote
2answers
49 views

How can I find the latest log for multiple jobs in AIX and delete the latest one

I am new to unix. I am trying to find the latest log of multiple jobs and delete the latest one. Can I write a shell script for it? I have tried with basic commands, but there it is selecting a ...
1
vote
0answers
25 views

Recover accidentally flushed logs file

I have an Apache Tomcat running on CentOS7 server which had a file catalina.out of around 157MB in size. I was trying to download that file on my local system so I ran the tar -czf command but I ...
1
vote
1answer
25 views

Writing logs for openvpn in Ubuntu18

I've installed openvpn on Ubuntu18, and it works. I'd like to have a log containing only the times when users connect and disconnect. Found a hint how to do it at [https://github.com/furlongm/openvpn-...
1
vote
0answers
140 views

How to monitor system with `snort` and send emails about `alerts`

PROBLEM: I have been configuring snort on my systems and would like to get emails from the systems if there are any alerts. What I have tried is swatch but I can't find much documentation on it, can ...
1
vote
0answers
45 views

How to see laptop camera logs on Ubuntu

I would like to know if it is possible to discover when my laptop camera was used over the past 7 days. eg. Is there a log for that? I am running on a Ubuntu 18 machine.
1
vote
0answers
39 views

Docker Debian, getting some specific syslog in the docker container log

I have been installing SSH in the Debian Docker. Since I wanted to have some extra log, I also installed the Rsyslog as described in this question. Result was that some extra logs are created e.g. ...
1
vote
0answers
41 views

Debug log for WiFi processing

I am trying to integrate WPA2 into open network in AP side, and I managed through quite good so far, I am now able to encrypt and decrypt live traffic. However, stations are ignoring my messages, ...
1
vote
0answers
19 views

systemd looking for update-rc.d when I try to enable redis service in Ubuntu 14.04

I was trying to install redis from source in Ubuntu 14.04 and Ubuntu 16.04. I did followed everything exactly from this tutorial. Only difference was that my logfile path was /redis/logs/redis-server....
1
vote
0answers
29 views

journald flooded by kernel messages

My journald log was at some point filled up with kernel messages like this. Mar 12 05:03:53 workstation.mydomain kernel: FAT-fs (sdd1): FAT read failed (blocknr 1785) Each followed by a message ...
1
vote
1answer
42 views

Can be the journal path on a filesystem other than /?

I would like to store the default journal directory /var/log/journal/ on a mounted device, but I am not sure if I can do it due to the fact that journal is an important service which may already run ...
1
vote
0answers
47 views

why messages logs are zero

we have linux machine: more /etc/redhat-release Red Hat Enterprise Linux Server release 7.2 (Maipo) all message files under /var/log are ZERO how it could be ? what is wrong here ? -rw-------. 1 ...
1
vote
0answers
145 views

CentOS: Collecting and analysing logs using NXlog and OSSIM

Objective: Forward logs from all servers to OSSIM, correctly formatted and readable. Steps: Deploying one NXlog Collector/proxy node in each network zone - DONE Deploying one NXlog Collector/master ...
1
vote
0answers
27 views

Freeze Linux when log is full

Is it possible to configure a Linux server to stop all operations when it cannot create logs, similar to the security policy in Windows called "Audit: Shut down system immediately if unable to log ...
1
vote
0answers
42 views

Why are these DHCP log entries repeated

I see multiple entries from the same device for each attempt to connect. Consider these 3 entries from an iphone and 4 entries from another device. What do the "via ..." indicate ? What does the ":1" ...
1
vote
0answers
651 views

Howto see messages that are subject to net_ratelimit?

OS: Ubuntu 14.04.3 Kernel: 3.13.0 I am running Linux Virtual Server (with keepalived) on that server. All ok. As of today, there is more network traffic on the LVS, and at the same time I start ...
1
vote
0answers
232 views

Understanding Linux audit.logs for SSH - USER_AUTH

Let's say I have this entry in my Linux audit.log: type=USER_AUTH msg=audit(1357702397.903:2747564): user pid=15121 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:authentication acct="test" exe="/...
1
vote
0answers
128 views

Odd Characters in Log File

I checked my cron log files today for a script that I have scheduled and the saw the following errors/characters: \00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\ ...
1
vote
0answers
33 views

Log format documentation

I'm trying to create a log format for goaccess so it can parse my nginx logs but it's failing and I can't find the documentation on what the the placeholders mean in the first place. Where can I find ...
1
vote
0answers
31 views

Syslog is flooded with PF_RING messages

I have ntop running on a Debian 9 (Stretch) server, and it's flooding /var/log/syslog with the following messages every 10 seconds: Sep 21 11:51:18 brutus kernel: [67801.273760] [PF_RING] removing lo/...
1
vote
0answers
105 views

Rsyslogd - remove timestamp on certain logs

I'm trying to achieve the questioned here, but I need to discard the timestamp only on a specific log file. I.e. only /var/log/mylog.log should have no timestamps. Is that possible with rsyslogd?
1
vote
0answers
94 views

Remove new line in Postgresql log before sent to Graylog

i want to remove all new line in Postgresql log before sent them to Graylog. Example, 2018-08-30 00:00:00 WIB [29212] hi_user@myDatabase 172.21.253.44 LOG: duration: 1044.000 ms execute 32: ...
1
vote
0answers
44 views

Where do Logrotate files end up?

I've got a Graylog server that I configured logrotating on. /var/lib/graylog-server/journal/messagejournal-0/000*.log { size 2G create 550 ubuntu ubuntu rotate 5 } I came in one morning ...
1
vote
1answer
57 views

IP Logging with Ubuntu Server

I use Ubuntu to host my web sites. I would like to generate a log of every IP address that "touches" my Ubuntu installation - including ping, port scans, etc, not just http requests. What would be an ...
1
vote
1answer
715 views

IPtables logging is not working in CentOS 7

I want to log all the traffic which comes in and out from the port X. I have followed below steps. Edited /etc/syslog.conf , /etc/rsyslog.conf , /etc/systemd/system/rsyslog.service.d/rsyslog.conf ...
1
vote
1answer
144 views

`sudo` session logging in binary?

I recently started working on sudo and i am trying to explore and understand the different aspects of sudo logging - I/O and audit. I'm using sudo 1.8.22 package on Red hat linux 6.7. Does sudo write ...
1
vote
0answers
669 views

Counting User Agent visits from the access log for just the last 30 days

I'm trying to print a list of the most frequent visits from User Agents from the Nginx access log. I have so far come up with this: cat /var/log/nginx/access.log | awk -F\" '{print $6}' | sort | ...
1
vote
2answers
100 views

Pump command output as function argument

I have this extremely simple function in my script: # Used for debug tracing. log() { : echo "log: $1" } The idea is to be able to customize/turn off logging at a single place. Very crude. ...
1
vote
1answer
162 views

redundant systemd-journal-remote for systemd-journal-upload instances

I'm using systemd-journal-upload on serveral nodes to forward their journals to a single systemd-journal-remote sink, loghost01: /var/log/journal ├── <foo-bar> │ ├── system.journal │ └── ...
1
vote
0answers
892 views

how to know why Linux redhat machine performed reboot

we have cluster with redhat machines version 7.2 on pluto05 machine we saw that machine rebooted before one day uptime 13:51:06 up 1 day, 1:46, 2 users, load average: 0.30, 0.14, 0.08 and from ...
1
vote
1answer
151 views

Saving terminal output to file line-by-line (writing and closing file after every print)

I have a Python script running on a Linux machine which is printing output out to the terminal. Currently, I'm logging this output to a file using the script command. However, the problem with this ...