Tag Info

Hot answers tagged

44

All login attempts are logged to /var/log/auth.log. 1. Filter for brute-force interactive SSH logins Open a terminal, and type the below; if it's longer than 1 page you will be able to scroll up and down; type q to exit: grep sshd.\*Failed /var/log/auth.log | less Here's a real example from one of my VPSs: Aug 18 11:00:57 izxvps sshd[5657]: Failed ...


41

You can create a cron.log file to contain just the CRON entries that show up in syslog. Note that CRON jobs will still show up in syslog if you follow the following directions. Open the file /etc/rsyslog.d/50-default.conf Find the line that starts with: #cron.* uncomment that line, save the file, and restart rsyslog: sudo service rsyslog ...


33

If you use ext2/ext3/ext4 and formatted the disk when you installed you can do this nifty trick. sudo dumpe2fs /dev/sda1 | grep 'Filesystem created:' You might have to change the /dev/sda1 to reflect your setup. Relaying on the date of files, even the "creation time" (mtime) can give errors since upgrading packages might have replaced the file and made a ...


26

tail has the -f option: From the man page: -f, --follow[={name|descriptor}] output appended data as the file grows; -f, --follow, and --follow=descriptor are equivalent Thus if you type: tail -f [path_and_name_of_logfile] - you will see the output in the terminal as the log file itself is appended to. N.B. ...


22

All log files are located in /var/log directory. In that directory, there are specific files for each type of logs. For example, system logs, such as kernel activities are logged in syslog file. Some of the most common log files in that directory is : In directory apt there is a file history.log which saves all the package installation and removal ...


19

I would argue that monitoring logs is a weak solution especially if you have a weak password on an account. Brute attempts often try at least hundreds of keys per minute. Even if you have a cron job set to email you of brute attempts, it could be hours before you get to your server. If you have a public-facing SSH server, you need a solution that kicks in ...


16

Does Ubuntu log when USB devices are connected? Yes, Ubuntu logs when a USB device is connected. The file is /var/log/syslog. You can also view it by issuing the command dmesg -c or graphically using Log file viewer. Does this file deleted upon shutdown? No, This log does not get wiped upon shutdown. But after a size limit is reached these are rotated, ...


14

While tail is certainly the usual way to do this, it should be noted that less has the same feature and is sometimes more usefull. If you opened a file with less then you can press Shift + F to have it follow the file (i.e. it will display new lines, just as tail -f does). You can exit this mode with Ctrl + C You can also start less with the +F option, in ...


12

Ubuntu 11.04 installs rsylogd rather than syslogd which Firestarter was expecting. rsyslogd is configured using the file /etc/rsyslog.d/50-default.conf. You can edit this file gksu gedit /etc/rsyslog.d/50-default.conf and change the lines commented out that create the relevant logfile #*.=info;*.=notice;*.=warn;\ # auth,authpriv.none;\ # ...


10

You can install the package indicator-notifications which keeps track of notifcations that you receive. You can install with the following sudo add-apt-repository ppa:jconti/recent-notifications sudo apt-get update sudo apt-get install indicator-notifications You'll have to log out and log back in. It shows up as a mailbox in the top panel and turns green ...


9

The term "canary" as used here comes from coal mining originally. Coal miners used canaries to detect dangerous gases (if the canary they carried with them died, they knew they had to get out of the shaft/mine ASAP). As a result the term "canary" is now often used for anything that you use to get an (early) warning about a dangerous situation. In this ...


9

If the machine was shutdown properly then there must be a shutdown log logged in kern.log file in /var/log directory. After a shutdown whenever a normal boot occurs the OS writes the log for the same in kern.log. Hence every boot log must be preceded by a shutdown log if the booting and shutdown process was normal. Whenever a normal shutdown occurs ...


8

The area I look at is: sudo cat /var/log/kern.log | grep usb The output would look like the following: May 25 07:38:51 mycomputer kernel: [ 607.296847] scsi7 : usb-storage 3-1:1.0 May 25 07:38:54 mycomputer kernel: [ 609.790892] usb 3-2: new high-speed USB device number 3 using xhci_hcd May 25 07:38:54 mycomputer kernel: [ 609.817462] usb 3-2: ep 0x81 ...


8

Where most of log files located: /var/log/ Log filename: Xorg.0.log Xorg.1.log etc... Update: You can check out the log files: Click on System menu > Choose Administration > System Log or Applications > System Tool > Log File Viewer


8

Multitail is what you searching for: it has tons of features. look here for some screenshots. Also have a look at this question over there at serverfault.com


8

When you are ready to start recording a log file, type: script screen.log Now, until you stop the script, all input and output in the Terminal will be stored in screen.log. When you are done, just type: exit Your screen.log file will be in your Home folder (/home/user). This will do exactly what you are looking for. Source: Ubuntu Guide - How To Log ...


7

1. Step: Find out what problem you actually have When your filesystem is unexpectedly full, there are a lot of possible causes. See Eliah Kagan's answer for some more about this. In the vast majority of cases it should be easy to identify (and eventually repair) the real cause, so reformatting/reinstalling would not be necessary. So the first step is to ...


7

Depends on the application. Different applications have different logging systems; there's no one central log that contains all the output from all the programs that run on your system. That being said, a lot of programs do put their log files in the directory /var/log. The file /var/log/messages, in particular, contains output from the "system logger", ...


6

Some options are: Swatch and KSystemLog There's a log viewer built into Ubuntu, which can also open any log file, called System Log.


6

If you are using the defaullt shells all the commands are already logged to $HOME/.bash_history . There are several environment variables which affect the history keeping, you can read about those with: info bash Type: / HIST If you want to apply the setting to all users edit /etc/profile. Example: export HISTFILESIZE=5000


6

Use this command: ls -al /var/log/installer/syslog Creation date of installer log can tell you the installation date (since it's not modified after that). Found here: http://ubuntuforums.org/showpost.php?p=10591868&postcount=5 Another solution is using this command: ls -lt /usr/share/doc Above of the default documents you can find creation ...


6

Your cellphone video camera. Seriously. It's not physically possible for linux to record a log after the "Unmounting local filesystems" message. And for some reason, Ubuntu Oneiric never records any of the shutdown messages, even errors warnings and "[fail]s", at least not anywhere I can find them using sudo grep. If you have the plymouth splash screen on ...


6

If you copied and pasted the system files, manually reproducing them, then you should provide more information about what you did to copy and paste them, where you pasted them, anything you can remember. Even making an extra copy of all the system files on your machine is unlikely to cause anywhere near 100 GB of disk usage. Ubuntu requires less than 5 GB of ...


6

These logs are generated by the kernel, so they go to the file that receives kernel logs: /var/log/kern.log. If you want to redirect these logs to a different file, that can't be done through iptables. It can be done in the configuration of the program that dispatches logs: rsyslog. In the iptables rule, add a prefix that isn't used by any other kernel log: ...


6

First here is a list of some of the common log files and what they contain: /var/log/messages : General message and system related stuff /var/log/auth.log : Authenication logs. /var/log/kern.log : Kernel logs. /var/log/cron.log : Cron daemon logs. /var/log/Xorg.0.log : Log for the X server. ~/.xsession-errors : Logs related to the last X session ...


5

You chopped up part of the log line, which would provide more context about what this means. It would be something like: syslog:Mar 12 10:17:01 hostname CRON[4154]: (root) CMD ( [ -x /usr/lib/php5/maxlifetime ] && [ -d /var/lib/php5 ] && find /var/lib/php5/ -depth -mindepth 1 -maxdepth 1 -type f -cmin +$(/usr/lib/php5/maxlifetime) ! ...


5

Apt keeps track of what is marked as auto-installed and what is marked as manually-installed. You can get the list of manually-installed packages with apt-mark showmanual. Keep in mind that in addition to the things you manually-installed, this list will include things that the system marked as manually-installed in order to protect them from autoremove. ...


5

Those are probably from a cron job. From Securing Debian Manual. Chapter 11 - Frequently asked Questions (FAQ) 11.2.3 I found users doing 'su' in my logs: Am I compromised? You might find lines in your logs like: Apr 1 09:25:01 server su[30315]: + ??? root-nobody Apr 1 09:25:01 server PAM_unix[30315]: (su) session opened for user nobody by ...


5

Yes there is a Tool . GNOME Activity Journal (formerly known as GNOME Zeitgeist) is a tool for easily browsing and finding files on your computer. It keeps a chronological journal of all file activity and supports tagging and establishing relationships between groups of files. Open your terminal and type as sudo apt-get install gnome-activity-journal to ...



Only top voted, non community-wiki answers of a minimum length are eligible