Global log file (Apache)

[Brammeke]

Hi,

Can I create a "master log file" for Apache? I want all requests from all virtual hosts in there, as well as in their own (personal) logs. I think it's easy, but I can't seem to be able to manage it...

Thank you,
Bram

 

[hardweb]

You have such files in /var/log/httpd/*which gather all the log messages you do not have a log context setup in per site vhost directives. If you want just a file for ALL domains, you have to alter all httpd config files. Technically possible, but practically not a good solution.

 

[Brammeke]

Hmm, I think a good, thought-thru grep command will help me I think.

The problem is that one of our virtual host users has a leak, causing mass mails to be sent from our server. I want to track down which user is responsible, but I can't seem to find him. A Perl script is being smuggled in into /tmp, which starts downloading and sending the spam. How can I figure out which virtual host is leaking?

Thank you,
Bram

 

[matt.simpson]

Hey Bram,
Ever find out an easy way to track this "leak" down, we have a similar issue.

Best Regards,
Matt Simpson

 

[Santi]

Hello Brammeke,

Try whit somthing like this:

grep -r "script" /var/www/vhosts/*/statistics/logs/access_log

Regards,

--
Santi Saez

 

[servertune]

Originally posted by Brammeke
Hmm, I think a good, thought-thru grep command will help me I think.

The problem is that one of our virtual host users has a leak, causing mass mails to be sent from our server. I want to track down which user is responsible, but I can't seem to find him. A Perl script is being smuggled in into /tmp, which starts downloading and sending the spam. How can I figure out which virtual host is leaking?

First, you need to clean up your server from all the culprit script amatuer hackers or spammers managed to download and install on your server. Install mod_security and other security patches to prevent future attacks/hacks.

 

[Sins]

The first thing you need to do is find wget on your server and change the permissions to 700, where only root can execute it. That is how they are putting files in your tmp folder.