AFP log question

Perhaps due to being both paranoid and ignorant about OS X Server, I'm worried that I might have be "hacked".
I was looking at the Log section in AFP of "Server Admin" and I saw lines like:
IP 192.168.0.2 - - [04/Jul/2006:20:48:17 0000] "OpenFork print costs billed" 0 0 0
IP 192.168.0.2 - - [04/Jul/2006:20:48:17 0000] "OpenFork print costs billed" 0 0 0
IP 192.168.0.2 - - [04/Jul/2006:20:48:17 0000] "OpenFork print costs billed" 0 0 0
IP 192.168.0.2 - - [04/Jul/2006:20:48:17 0000] "OpenFork print costs billed" 0 0 0
IP 192.168.0.2 - - [04/Jul/2006:20:48:18 0000] "OpenFork print costs billed" 0 0 0
IP 192.168.0.2 - - [04/Jul/2006:20:48:18 0000] "OpenFork print costs billed" 0 0 0
IP 192.168.0.2 - - [04/Jul/2006:20:48:18 0000] "OpenFork print costs billed" 0 0 0
IP 192.168.0.2 - - [04/Jul/2006:20:48:18 0000] "OpenFork print costs billed" 0 0 0
IP 192.168.0.2 - - [04/Jul/2006:22:40:29 0000] "OpenFork Important passwords" 0 0 0
IP 192.168.0.2 - - [04/Jul/2006:22:40:29 0000] "OpenFork Accounts info" 0 0 0
Now, I hadn't opened those files. However, I had opened the folder that those files resided. Why would the AFP log show that I've done something to those files? Does the mere act of opening their folder show them in the log? Or, have I been hacked?

The information on this page suggests that log entries like those appear every time someone opens a folder.
(13891)

Similar Messages

OES2 SP3 AFP How to empty AFP log file

Hello All,
i find no information how i can empty the AFP log file in /var/log/afptcpd/afptcp.log. It has grown to 1,2 Gigabyte and is very uncomfortable to look for information in this big file.
Any ideas ?
Thank you
Andreas

If you get a lot of afp activity, your probably best off if you just set the log to rotate.
create a file under /etc/logrotate.d/ and name it whatever you want.
then just enter in something like this:
/var/log/afptcpd/afptcp.log {
compress
dateext
maxage 365
rotate 99
size=+4096k
notifempty
missingok
create 644 root root
postrotate
/etc/init.d/novell-afptcpd reload
endscript
Originally Posted by Skylon5000
Hello All,
i find no information how i can empty the AFP log file in /var/log/afptcpd/afptcp.log. It has grown to 1,2 Gigabyte and is very uncomfortable to look for information in this big file.
Any ideas ?
Thank you
Andreas

Constant mds activity in AFP log

Every user pops out the following errors every two minutes in the AFP log:
IP 192.168.1.xxx - - [18/Apr/2008:15:26:21 -0800] "Delete mds-lock-dir" -5007 0 0
IP 192.168.1.xxx - - [18/Apr/2008:15:26:21 -0800] "Delete master-status" 0 0 0
IP 192.168.1.xxx - - [18/Apr/2008:15:26:21 -0800] "Delete mds-lock-dir-<computername>.local-2c6da58" 0 0 0
AppleFileServer is running a constant 20-35%, which I assume is related to this problem since a similar server in another location is not exhibiting this mds issue in the log, and is running at a nice 0-2% of cpu (both of these are dual-G5s).
Setup is 10.5.2 server, OD replica. I thought this had something to do with Spotlight (mds?), so disabled Spotlight on the share but no difference. I thought it might have to do with the OD replica (master-status?), so rebuilt it by changing it to connected to ds, then back to replica; no change.
Many thanks for any thoughts you might have...
z

Standard indexing behavior I guess

AFP Logs don't include file path

Is there a way to get AFP logging to include the path to the files being referenced? Possibly a hidden property in com.apple.AppleFileServer.plist or a 3rd party logging solution?
Currently, and as it appears even in Snow Leopard Server, AFP only logs the names of the files being accessed, created, and deleted. Since there are numerous files with the same name on most servers, like .DS_Store, the path is required to make the logs really useful.

On a Leopard Server, com.apple.AppleShareClient.plist already has AFP debugging enabled with the following properties set; afpdebuglevel 6, afpdebugsyslog YES. All thats left is to create a place for the debug records to be dropped.
Unfortunately this doesn't add any useful information on the server side of things, at least not specific to who opens which Document1.doc.
It is odd that the standard AFP log doesn't include the file's path. Who wouldn't want to know which .DS_Store was opened or where that 'Untitled Folder' was created?

Basic log question

Just trying out backintime. I put it in crontabs and append to a log file. So far so good, but I don't get time or date of the last entry. Here the crontab entry:
*/45 * * * * backintime -b >>/tmp2/backintime/messages.log
Question: Do I have to fiddle around with the code of backintime to get more info or can I do something in the crontab entry?

> Hm, comparing stuff takes a long time
<gasp> With rsync if you don't change the contents much it shouldn't take more than a minute ... If you have a million tiny files it may take more but I guess you would like your backups to run perfectly, so you'd better check what's wrong.
BTW: Although Dillon's cron supports 'every n minutes' you may want to check '45 * * * *'. Are you using the "stock" Arch cron or some other one?
Last edited by karol (2009-12-18 15:37:02)

How to tell if/when AFP logging was disabled?

Is there any record kept anywhere in the logs as to whether AFP logging was disabled or enabled? We're missing some AFP logs so trying to track down the reason.

There is a Script that can determine that (for files that have been saved from Photoshop at least).
Unfortunately the copy I have carries no credits and I can’t locate it on the web, either, so I don’t know who to give credit for it …
That being said I could send it to You if you want to give it a try.

Accessing Server Logs Question

I'm working on converting an old ASP application to a Java one, and have some questions.
The customer wants a semi-sophisticated auditing system built in to the application, but I'm not sure OAS can provide the same level of detailed logs that IIS did (at least, not without a JNI DLL somewhere).
One of the reports requested, "Client Errors", wants to output the following fields:
- Requested File
- Error Code
- Total Requests
- Client Description
- Error Description
- Win32 Description
There are about 2 dozen other reports, as well.
The questions:
1. Can OAS log this sort of information in an extended w3c log format (Win32 Description might not be possible without JNI)?
2. How is the best way for the application to get to these logs? (I currently envision a regular job running to read the log into a database table)
Sorry if these are dumb questions. Any help would be appreciated.

Each Report Server has a log in which it record each time a report is run.

Application Logging questions, SLG0

Hello all,
I have a couple of generic questions I would like to ask the users of this forum.
1. The people that are using application logging, in what types of situations do you use this functionality, interface programming, updating custom tables, etc.?
2. People that are aware of this functionality and are not using it, why are you not using it?
SAP help documentation has pretty good information about the different function modules that are part of this product.
Thanks
Bruce

Hi Bruce;
As part of the SAP's AII (Auto-ID) production, we use SLG1 extensively because that is where all of the application errors are stored by the system when it processes inbound or outbound messages.
The biggest pro is that it consolidates all of the logging information; the biggest con is that it is hard to search through all that information for a particular message, unless the document number is part of the message. It can be a challenge to find a particular log entry when there can be upwards of 2,500 in one day.
Cheers,
John

"rescue and recovery" and "swshare" log question

I am currently analzying logs from "rescue and recovery" and "swshare" program and notice SMA.log and capture.sma in particular. I want to verifiy what do each of those 2 logs mean. does one mean the data that was successfully backed up and the other one means what was restored to the machine? the restore.log contains a specific date, was that the date the data was restored to the machine?
Thanks in advance!!!

The logs gets created automatically and have the information of the particular task which is completed or processed.
Best Regards,
Tanuj
Did someone help you today? Press the star on the left to thank them with a Kudo!
If you find a post helpful and it answers your question, please mark it as an "Accepted Solution".! This will help the rest of the Community with similar issues identify the verified solution and benefit from it.
Follow @LenovoForums on Twitter!

Java.util.logging question

'Lo all -
I'm new to Java, so bear with me on this question - I'm sure it has a simple answer.
I am using the following code to create a new Logger object:
public class TAGLogging {
    private Logger oLog;
    private FileHandler oLogFile;
    private String sLoggingFolder = "AppLogs";
    private String sFormattedDateTime = String.format("%1$tY%1$tm%1$td_%1$tH%1$tM%1$tS",Calendar.getInstance());
    private String sCallingClass = new Throwable().fillInStackTrace().getStackTrace()[1].getClassName();
    private String sCallingMethod = new Throwable().fillInStackTrace().getStackTrace()[1].getMethodName();
    /** Constructors */
    public TAGLogging(String sLogFileName) throws IOException {
        this.initialSetup(sLogFileName);
    public TAGLogging() throws IOException {
        String sLogFileName = sLoggingFolder + File.separator + sFormattedDateTime + ".xml";
        this.initialSetup(sLogFileName);
    /** Methods */
    private void initialSetup(String logFileName) throws IOException {
        oLogFile = new FileHandler(logFileName);
        oLog = Logger.getLogger(sCallingClass);
        oLog.addHandler(oLogFile);
        oLog.setLevel(Level.ALL);
    }Everything is being logged correctly to the /AppLogs/yyyymmdd_HHMMSS.xml file. The problem is that there is another file that is being created in my home directory, which incidentally, is not where the program is located. The name, java01.log, matches the default logging.properties file set up, but I have removed all that and changed the file to the following (minus all the comments):
handlers= java.util.logging.FileHandler
.level= INFO
java.util.logging.FileHandler.level = ALL
java.util.logging.FileHandler.limit = 50000
java.util.logging.FileHandler.count = 1
java.util.logging.FileHandler.formatter = java.util.logging.XMLFormatter
java.util.logging.ConsoleHandler.level = INFO
java.util.logging.ConsoleHandler.formatter = java.util.logging.SimpleFormatter
The java01.log file contains the exact same contents as the file I am purposely logging to, the AppLogs/yyyymmd_HHMMSS.xml one.
Does anyone have any clue what is causing this file to get created, and if so, how do I stop it?
Message was edited by:
malakh

Man, I REALLY hate to do this, but it looks like I may be forced to work around it instead of fixing the issue. I'll have to add some code to manually remove the java01.log file when it's done writing to it.
Navy - Turns out that Log4j is pretty much the same thing as java.util.logging, except on steroids. It is almost identical syntactically, just has more options and more flexibility than JUL.

AFP log files not rotating

Wen I enable logging on my AFP server the log files aren't being rotated correctly. Does anyone know the location of the script Apple uses to rotate the log files in /Library/Logs/AppleFileService. There must be a bug.
The AFP service seems to ignore the interval you set for rotating the AppleFileServiceAccess.log. I had it set to 1 day but its only rotating the log files every 7 days. What's worse. when it does try to rotate the log it doesn't work completely. It doesn't remove the old uncompressed log and stops writing new new entries tot he log file. The only way to get the AFP service to log entries again is to stop the AFP service, rename the log file, then start the service again.

I'm observing this same bug on a 10.5.6 server. Is this a known issue?

Aironet 1140 connection and log questions

Hi Cisco gurus,
Recently we decided to change the name of one of our Aironet 1140 AP's. Everything was great for a few days then, for some reason, nobody was able to connect to it. They would all recieve timeout messages when they would connect. A quick reset solved the problem, but I'm curious if there was an actual reason to why it didn't allow users to connect in case it happens again.
Which brings me to my next question, how do you set the AP clock so that the event logs display the proper date and time? I'm sure I overlooked something, but I can't find out how to set the proper date and time.
Thank you in advance.

conf t
serv time d d s l
serv time l d s l
sntp service
! Set the timezone
clock timezone WORD
clock summer-time WORD recurring

Basic Capturing/logging question

For capturing footage, I usually hit the Capture "Now" option, and then label the clip after it's captured.
However when I do this, the actual file just gets labeled as "Untitled" in the folders on the computer.
How do I label a clip while it's actually being captured in FCP? Do I capture with the Capture "Clip" option?
Like I said, very basic question, but would help me out immensely. Thanks.

shocker11 wrote:
The Capture Now thing I'm getting now. However, I'm still getting confused for this logging and then batch capturing deal. I hit "set marker" for each of my in and out points on where I want to capture, however, it doesn't seem to log it into the "log window" correctly.
You log clips not by placing markers in an extended clip, but by setting In and Out points for smaller clips. Once you've determined where you'd like your clip to begin, press I. When you know where you'd like the clip to end, press O. Then press F2 to Log Clip.
Not to be snarky - because I really hate it when folks get told to read the manual - but this really is one of those times where skimming through the relevant sections of the manual will answer all of your questions. So you might want to give that a shot, since that's the best step-by-step that I've seen.

Tacacs+ accounting log question

I have a tacacs server running for accounting purpose only (so I use local authentiation). So I can collect all accounting logs only.
This is a snapshot for accounting part.
Tacacs accounting logs
<102> 2014-02-23 10:20:22 [10.254.1.2:22823] 02/23/2014 10:20:22 NAS_IP=10.254.1.x Port=443 rem_addr=10.254.50.129 User= brian Flags=Stop task_id=57 cmd=perfmon interval 10 service=shell elapsed_time=0
<102> 2014-02-23 10:23:51 [10.254.1.2:58167] 02/23/2014 10:23:51 NAS_IP=10.254.1.x Port=0 rem_addr=10.254.50.129 User=brian Flags=Stop task_id=58 cmd=configure term service=shell elapsed_time=0
<102> 2014-02-24 07:06:31 [10.254.1.2:19784] 02/24/2014 07:06:31 NAS_IP=10.254.1.x Port=443 rem_addr=10.254.51.166 User=mike Flags=Stop task_id=59 cmd=perfmon interval 10 service=shell elapsed_time=0
<102> 2014-02-24 07:07:53 [10.254.1.2:19254] 02/24/2014 07:07:53 NAS_IP=10.254.1.x Port=0 rem_addr=10.254.51.166 User=mike Flags=Stop task_id=5a cmd=configure term service=shell elapsed_time=0
As you can see, I can't see any command lines, such as show int ip b. I can see all routers and switches logs, but ASA logs shows only like above. No mather what commands I used, it only shows above logs. Do i miss something? I like to capture all commands lines when users use ASDM because we use always ASDM.
I used Free tacacs+ server, not ACS.
Thanks for your time.

Hi Patrick,
In the ACS View Reports (Monitoring & Reports > Reports > Catalog > AAA Protocol) you can select the
radio button and by selecting 'Run' on the bottom run a specific query. Without that by default you will see only a report from one day.
For the 2nd question, yes the ACS View is designed to store that information, however if needed you can send the logs to an external syslog server or perfrom regular backups of the ACS View database.
Kind regards,
Pawel

Firewall activity on event log question

Hi, i have recently noticed that my event log lists a lot of IN: ACCEPT [57] Connection opened and closed events at strnage hours of the day when nobody is even awake using the home internet such as 5am.
When i checked the location of some of the ip address's some of them are in locations in the world such as Guatemala and Mexico
Would anybody be able to tell me why these events are taking place?
Many Thanks.

just the firewall do its job nothing to worry about
If you want to say thanks for a helpful answer,please click on the Ratings star on the left-hand side If the reply answers your question then please mark as ’Mark as Accepted Solution’

AFP log question

Similar Messages

Maybe you are looking for