floriancrouzat.net Report : Visit Site

Technical data of the floriancrouzat.net

Geo IP provides you such as latitude, longitude and ISP (Internet Service Provider) etc. informations. Our GeoIP service found where is host floriancrouzat.net. Currently, hosted in Germany and its service provider is Manitu GmbH .

HTTP Header Analysis

HTTP Header information is a part of HTTP protocol that a user's browser sends to called Apache/2.2.15 (CentOS) containing the details of what the browser wants and will accept back from the web server.

DNS

HtmlToText

home cv / resume the hanso foundation arte+7 video downloader +7 surfaces sensibles latests posts... -- florian's weblog everything that rises must converge. rss feed -- categories linux / unix (17) centos / red-hat (10) pacemaker (4) sysadmin (15) tmux (1) lost arg (1) mac os x (2) pci-dss (2) scripts (7) mariadb/mysql slow query log to syslog (and other output modules) june 27, 2018 jump to comments mariadb (fork of mysql), with a few lines of configuration, provide a very interesting log regarding application-level query performances: the slow-logs. sadly, and for a reason i have yet to discover, these logs are not syslog-enabled. thus, you cannot beneficiate of all the advantages of using the syslog protocol, ie: centralization, backup/archive, parsing, alerting… to make things even easier, these very interesting logs are multi-lines… in a company where application developers are interested by the performances of their application and to optimize their code and queries, receiving information about the production application-level slow queries is necessary. here’s a sample mariadb/rsyslog configuration that achieve slow-logs to syslog and also generates a snmptrap per slow query (you could use the smtp output module instead or any other rsyslog output module for what matters). /etc/my.cnf.d/logging.cnf [mariadb] # slow query logging settings slow_query_log=1 slow_query_log_file=/var/log/mariadb/mariadb-slow.log long_query_time=2 /etc/rsyslog.d/zz-mariadb.conf # # mariadb-syslog config file # if $app-name == 'mysqld' then /var/log/mariadb/mariadb.log & stop if $app-name == 'mysqld-scl-helper' then /var/log/mariadb/mariadb.log & stop # slow logs (not syslog-enabled) module(load="imfile" pollinginterval="10") # once input(type="imfile" file="/var/log/mariadb/mariadb-slow.log" tag="mysqld-slowlog" severity="info" facility="local2" # because logs are multi-line # time: 180618 16:23:33 # time: 180618 8:43:16 startmsg.regex="^# time: [[:digit:]]{6} " readtimeout="10" # remove lf escaping so that it's properly formatted within castlerock escapelf="off" ) /etc/rsyslog.d/zz-mariadb-slowq-to-trap.conf # send snmp traps for slow logs module(load="omsnmp") # once $actionsnmptransport udp $actionsnmptarget <snmp_server_ip_addr_or_fqdn> $actionsnmptargetport 162 $actionsnmpversion 1 # means snmpv2c $actionsnmpcommunity <snmp_community> $actionsnmptrapoid <snmp_oid> if $app-name == 'mysqld-slowlog' then :omsnmp: & stop proper end-to-end syslog logging with apache httpd january 21, 2016 jump to comments table of content context objectives folder structures and relevant files configurations /etc/httpd/conf.d/httpd_base_module.conf /etc/httpd/conf.d/zz-03-example.com.conf /opt/fcrouzat/syslog/httpd-log.sh /etc/rsyslog.d/zz-10-httpd.conf remote logging: /etc/rsyslog.d/zz-09-remote-httpd.conf caveats conclusions context for an unknown reason, apache httpd only supports syslog since 2.4 and only for error logs. on top of that, default log format is very poor and (to me) doesn’t mean anything. add these two informations and you’ll give any sysadmin a headache. fortunately there is a way around these issues by clever usage of the named pipes. this w/a is not so complicated but requires to be careful and a properly configured stack. objectives using this workaround i will demonstrate how to perform proper end-to-end syslog logging with both httpd 2.2 and 2.4. this is very helpful in pci-dss compliant environment because it allow you to easily centralize apache httpd logs. as a reminder: unlike many other regulations and standards, pci dss explicitly requires organization to implement log management. requirement 10 explicitly requires organizations stating: logging mechanisms and the ability to track user activities are critical in preventing, detecting, or minimizing the impact of a data compromise. the presence of logs in all environments allows thorough tracking, alerting, and analysis when something does go wrong. determining the cause of a compromise is very difficult, if not impossible, without system activity logs. [1] in addition to proper logging through syslog (both local and to remote hosts), and since we are about to modify our apache httpd configuration for the better, we will use this opportunity to improve various things that always bugged me with httpd: having a maintained and useful logformat and having proper filenames for the local log files. testing and validation have been done under the following configurations: rhel 6.x + httpd-2.2 rhel 7.x + httpd-2.4 depending on how you might have already tweaked your logformat, your logs should looks like this: 15.211.201.81 - - [21/jan/2016:16:42:25 +0100] "get /wp-content/ http/1.1" 200 13776 "http://floriancrouzat.net/2011/09/pacemaker-beginner-tips/" "mozilla/5.0 (windows nt 6.1; wow64; rv:43.0) gecko/20100101 firefox/43.0" it is not syslog-compliant, date format is quite unexpected, there is no app-name, and it is probably missing interesting informations. in addition, this is for example the combined logformat, but there are others and they are all different, you cannot find a discriminating way to filter them or manipulate them: remember, no app-name … assuming you’d like to parse or analyze these logs, you’d have to write very specific decoder because you cannot just use a filter on the app-name. the same goes for sending these logs to remote hosts over syslog, you cannot easily filter to only send apache httpd logs without writing complex decoders… we want at least to do the following: remove the poorly written datetime and add a valid syslog header with a deterministic app-name in front of the untouched message. a log line would then look like this: jan 15 03:28:07 http01.example.com httpd: 15.211.201.81 - - "get /wp-content/ http/1.1" 200 13776 "http://floriancrouzat.net/2011/09/pacemaker-beginner-tips/" "mozilla/5.0 (windows nt 6.1; wow64; rv:43.0) gecko/20100101 firefox/43.0" but while doing so, why not also improve everything by replacing the default logformat ( combined ) with one of our own that is a lot more powerful. of course, feel free to adapt my “powerful” logformat to your needs. a log line would then look like this: jan 15 03:28:07 http01.example.com httpd: 192.168.1.1:43573 floriancrouzat.net:443 tlsv1.2(ecdhe-rsa-aes256-gcm-sha384) "get /index.html http/1.1" 200 11301b "- - -" folder structures and relevant files you can obviously organize your folder structure as you wish and name your files as you intend to. but, to be consistent i’ll provide the filenames i have been using. all my configuration is done in /etc/httpd/conf.d/ and all *.conf files are included from httpd’ default configuration /etc/httpd/conf/httpd.conf . i never edit this package-shipped file. same applies for rsyslog with /etc/rsyslog.d/ included from package-shipped /etc/rsyslog.conf here are the relevant files we are going to use: /etc/httpd/conf.d/httpd_base_module.conf : define logformat and stuff module dependent /etc/httpd/conf.d/zz-03-example.com.conf : virtualhost file for example.com /etc/rsyslog.d/zz-10-httpd.conf : define rsyslog httpd-related configurations /opt/fcrouzat/syslog/httpd-log.sh : syslog wrapper for httpd configuration /etc/httpd/conf.d/httpd_base_module.conf first, create a new logformat that match your needs, feel free to define your own but do not includes date, time or app-name. this has to be the raw message. the syslog header will be added later. [...] logformat "%h:%{remote}p %{host}i:%{canonical}p %{ssl_protocol}x(%{ssl_cipher}x) \"%m %u %h\" %>s %bb \"%!200,302,304{referer}i %!200,302,304{user-agent}i %!200,302,304{cookie}i\"" default [...] /etc/httpd/conf.d/zz-03-example.com.conf we have to modify our virtualhost(s) to use the new logformat and also the named pipe. apache httpd must never write directly to disk anymore, everything has to be piped. this named pipe execute a custom-made script that takes 3 arguments: virtualhost fqdn log type: value can

URL analysis for floriancrouzat.net

http://floriancrouzat.net/category/linux-unix/centos-redhat/pacemaker/
http://floriancrouzat.net/category/linux-unix/
http://floriancrouzat.net/category/linux-unix/tmux/
http://files.floriancrouzat.net/tac_plus
http://floriancrouzat.net/2016/01/proper-end-to-end-syslog-logging-with-apache-httpd/
http://floriancrouzat.net/2015/03/cisco-aaa-using-tacacs-with-syslog-and-pam-support-for-centosredhat/
http://floriancrouzat.net/2018/06/mariadbmysql-slow-query-log-to-syslog-and-other-output-modules/#respond
http://floriancrouzat.net/category/pci-dss/
http://floriancrouzat.net/category/scripts/
http://floriancrouzat.net/category/mac-os-x/
http://floriancrouzat.net/thehansofoundation/
http://floriancrouzat.net/#nav
http://floriancrouzat.net/arte/
http://floriancrouzat.net/page/2/
http://floriancrouzat.net/2016/01/proper-end-to-end-syslog-logging-with-apache-httpd/#respond

Whois Information

Whois is a protocol that is access to registering information. You can reach when the website was registered, when it will be expire, what is contact details of the site with the following informations. In a nutshell, it includes these informations;

Domain Name: FLORIANCROUZAT.NET
Registry Domain ID: 1207785259_DOMAIN_NET-VRSN
Registrar WHOIS Server: whois.gandi.net
Registrar URL: http://www.gandi.net
Updated Date: 2017-09-07T15:45:16Z
Creation Date: 2007-09-10T07:58:35Z
Registry Expiry Date: 2018-09-10T07:58:35Z
Registrar: Gandi SAS
Registrar IANA ID: 81
Registrar Abuse Contact Email: [email protected]
Registrar Abuse Contact Phone: +33.170377661
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Name Server: A.DNS.GANDI.NET
Name Server: B.DNS.GANDI.NET
Name Server: C.DNS.GANDI.NET
DNSSEC: unsigned
URL of the ICANN Whois Inaccuracy Complaint Form: https://www.icann.org/wicf/
>>> Last update of whois database: 2017-11-03T23:57:28Z <<<

For more information on Whois status codes, please visit https://icann.org/epp

NOTICE: The expiration date displayed in this record is the date the
registrar's sponsorship of the domain name registration in the registry is
currently set to expire. This date does not necessarily reflect the expiration
date of the domain name registrant's agreement with the sponsoring
registrar. Users may consult the sponsoring registrar's Whois database to
view the registrar's reported date of expiration for this registration.

TERMS OF USE: You are not authorized to access or query our Whois
database through the use of electronic processes that are high-volume and
automated except as reasonably necessary to register domain names or
modify existing registrations; the Data in VeriSign Global Registry
Services' ("VeriSign") Whois database is provided by VeriSign for
information purposes only, and to assist persons in obtaining information
about or related to a domain name registration record. VeriSign does not
guarantee its accuracy. By submitting a Whois query, you agree to abide
by the following terms of use: You agree that you may use this Data only
for lawful purposes and that under no circumstances will you use this Data
to: (1) allow, enable, or otherwise support the transmission of mass
unsolicited, commercial advertising or solicitations via e-mail, telephone,
or facsimile; or (2) enable high volume, automated, electronic processes
that apply to VeriSign (or its computer systems). The compilation,
repackaging, dissemination or other use of this Data is expressly
prohibited without the prior written consent of VeriSign. You agree not to
use electronic processes that are automated and high-volume to access or
query the Whois database except as reasonably necessary to register
domain names or modify existing registrations. VeriSign reserves the right
to restrict your access to the Whois database in its sole discretion to ensure
operational stability. VeriSign may restrict or terminate your access to the
Whois database for failure to abide by these terms of use. VeriSign
reserves the right to modify these terms at any time.

The Registry database contains ONLY .COM, .NET, .EDU domains and
Registrars.

  REGISTRAR Gandi SAS

SERVERS

  SERVER net.whois-servers.net

  ARGS domain =floriancrouzat.net

  PORT 43

  TYPE domain

DOMAIN

  NAME floriancrouzat.net

  CHANGED 2017-09-07

  CREATED 2007-09-10

STATUS
clientTransferProhibited https://icann.org/epp#clientTransferProhibited

NSERVER

  A.DNS.GANDI.NET 173.246.98.1

  B.DNS.GANDI.NET 213.167.229.1

  C.DNS.GANDI.NET 217.70.179.1

  REGISTERED yes

Mistakes

The following list shows you to spelling mistakes possible of the internet users for the website searched .