Skip to main content

How to recover deleted Apache Log

Scenario: The server is running Apache and by mistake one of the log files gets deleted. How, we can recover it?
Currently, Apache server is working perfectly:
Login/Switch to as root user:
Move to the httpd in log directory:
cd /var/log/httpd
Delete the log file:
rm -f access_log
So the log file has been deleted,now find the process number for main apache procees that owned by root:
ps aux | grep httpd
In this case, the pid for the main apache process is1784.
Now lets list the file descriptors:
ls -lsa /proc/1784/fd
Stop the apache service:
service httpd stop
Now copy the access log file that is marked as deleted (In this case it is 7) into the log directory:
cp /proc/1784/fd/7 /var/log/httpd/access_log
Start the apache service again:
service httpd start
Access the webpage again from your server:
Verify the log file:
tail -f /var/log/httpd/access_log
It’s working :-)
Hope this will help you!
Scenario: The server is running Apache and by mistake one of the log files gets deleted. How, we can recover it?
Currently, Apache server is working perfectly:
Login/Switch to as root user:
Move to the httpd in log directory:
cd /var/log/httpd
Delete the log file:
rm -f access_log
So the log file has been deleted,now find the process number for main apache procees that owned by root:
ps aux | grep httpd
In this case, the pid for the main apache process is1784.
Now lets list the file descriptors:
ls -lsa /proc/1784/fd
Stop the apache service:
service httpd stop
Now copy the access log file that is marked as deleted (In this case it is 7) into the log directory:
cp /proc/1784/fd/7 /var/log/httpd/access_log
Start the apache service again:
service httpd start
Access the webpage again from your server:
Verify the log file:
tail -f /var/log/httpd/access_log

Comments

Post a Comment

Popular posts from this blog

WiFI connection

    root@kali:~# iw dev root@kali:~# ip link set wlan0 up root@kali:~# iw wlan0 scan root@kali:~# wpa_passphrase blackMOREOps >> /etc/wpa_supplicant.conf root@kali:~# wpa_supplicant -i wlan0 -c /etc/wpa_supplicant.conf root@kali:~# iw wlan0 link root@kali:~# dhclient wlan0 root@kali:~# ping 8.8.8.8 (Where wlan0 is wifi adapter and blackMOREOps is SSID) (Add Routing manually) root@kali:~# ip route add default via 10.0.0.138 dev wlan0    
Post a Comment
Read more

Modsecurity block rule for XMLRPC and wp-login attack

SecAction phase:1,nolog,pass,initcol:ip=%{REMOTE_ADDR},initcol:user=%{REMOTE_ADDR},id:5000134  <Locationmatch "/wp-login.php">  SecRule user:bf_block "@gt 0" "deny,status:401,log,id:5000135,msg:'ip address blocked for 5 minutes, more than 10 login attempts in 3 minutes.'"  SecRule RESPONSE_STATUS "^302" "phase:5,t:none,nolog,pass,setvar:ip.bf_counter=0,id:5000136"  SecRule RESPONSE_STATUS "^200" "phase:5,chain,t:none,nolog,pass,setvar:ip.bf_counter=+1,deprecatevar:ip.bf_counter=1/180,id:5000137"  SecRule ip:bf_counter "@gt 10" "t:none,setvar:user.bf_block=1,expirevar:user.bf_block=300,setvar:ip.bf_counter=0"  </Locationmatch>  SecAction phase:1,nolog,pass,initcol:ip=%{REMOTE_ADDR},initcol:user=%{REMOTE_ADDR},id:5000234  <Locationmatch "/xmlrpc.php">  SecRule user:bf_block "@gt 0" "deny,status:401,log,id:5000235,msg:'ip address blocked for 5 m...
Post a Comment
Read more

Apache tuning documentation

Apache bench marking ======================= Things or checklist to be considered before the test     CPU: avoid power-saving mode. cpufreq-set -g performance.     File descriptors: raise the limit to (at least) the number of concurrent connections you wish to handle, using ulimit -n in your shell, or setrlimit(RLIMIT_NOFILE) in your server. Beware, some systems forbid you to raise the limit, you might need to investigate a bit to find how to unlock it.     Disable the logs of your server (you do not want to lose time logging thousands of requests instead of answering them).     Raise /proc/sys/net/somaxconn to the number of concurrent connections you want to handle. To understand why this is necessary, read the technical report or the excellent paper Measuring the Capacity of a Web Server (Banga and Druschel, Usenix 97). More on the fascinating topic of the accept() queue can be found in accept()able Strategies for Im...
Post a Comment
Read more