Uly.me

cloud engineer

logs

Unbound Logs

How to enable unbound logs.

Add these line in /etc/unbound/unbound.conf.

chroot: ""
logfile: /var/log/unbound.log
verbosity: 4
log-queries: yes

Create the log file and set permissions.

touch /var/log/unbound.log
chown unbound:unbound /var/log/unbound.log

Restart the unbound service.

systemctl restart unbound

Check status.

systemctl status unbound

Finally, check the logs.

tail -f /var/log/unbound.log

Docker container logs

How to check Docker container logs. Look for the container ID.

$ docker ps -a
3e2c1193915f

To view the logs for the container.

docker logs 3e2c1193915f
# or
docker container logs 3e2c1193915f

Checking Yum Transaction Logs

Check if package is on the system.

rpm -q httpd
httpd-2.4.6-97.el7.centos.x86_64

Check the history logs.

yum history list
Loaded plugins: fastestmirror
ID     | Login user               | Date and time    | Action(s)      | Altered
-------------------------------------------------------------------------------
   115 | System <unset>           | 2021-02-01 03:40 | Update         |    1
   114 | System <unset>           | 2021-02-01 02:03 | I, U           |   10
   113 | System <unset>           | 2021-01-29 19:54 | Update         |    1
   112 | System <unset>           | 2021-01-21 14:41 | Update         |    1

Check detail transaction id.

yum history info 114 | grep python 
    Updated python-perf-3.10.0-1160.6.1.el7.x86_64          @updates
    Updated python-sss-1.16.5-10.el7_9.5.x86_64             @your-repo
    Updated python-sssdconfig-1.16.5-10.el7_9.5.noarch      @your-repo

It looks like python was updated in transaction id #114.

Parsing Wowza Logs

I’ve been wanting to look at Wowza logs for a very long time. I just spent a couple of hours writing a Bash script that generates a stats report. It parses the Wowza log file for the IP addresses, and runs them and against a site called ipinfo.io to get the viewer’s geo location. The output is filtered, sorted, takes a count, and finally generates a webpage. Here’s the Bash script.

# Can be placed in cron to run.
create-wowza-report.sh wowzastreamingengine_access.log
#!/bin/bash
 
# check for missing argument
if [ -z "$1" ]
  then
    echo "No arguments supplied. Format: create-wowza-report.sh wowzastreamingengine_access.log"
    exit 1
fi
 
# get the ips from the wowza log file
awk '{print $17}' $1 > output1.txt
 
# exclude invalid ips 
grep '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' output1.txt > output2.txt
 
# sort unique ips
cat output2.txt | sort -u | uniq > ips.txt
 
# pause for 1s
sleep 1s
 
# empty file just in case
> output3.txt
 
# set filename
filename="ips.txt"
 
# read filename and get geo info
while read -r ipaddress; do
  curl ipinfo.io/"$ipaddress" 2>/dev/null | awk -F'"' '$2=="city"{printf("%s, ", $4)}$2=="region"{print $4}' >> output3.txt
done < "$filename"
 
# cleanup empty geo locations
grep -v '^,' output3.txt > output4.txt
 
# sort output alphabetically
cat output4.txt | sort > output5.txt
 
# get a count of connections
count=$(wc -l < output5.txt)
 
# get today's date
filename=$(date +%Y%m%d)
date=`date +'%A %B %d, %Y'`
 
# rename file
mv output5.txt $filename.txt
 
# generate web page
cat <<EOF > $filename.php
<html>
<head>
<title>Wowza Streaming Stats on $date</title>
</head>
<body>
<h1>Live Streaming Stats</h1>
<p>Number of connections on $date: $count</p>
<?php include('$filename.txt');?>
</body>
</html>
EOF
 
# move files to web directory
cp $filename.* /var/www/html
 
# cleanup files
rm output*.txt
rm ips.txt

How to Rotate Apache Logs

Apache comes with a logrotate utility. You can customize the way logrotate behaves by editing the /etc/logrotate.d/apache file. The logrotate utility has many options. In this example, we are rotating the log files that are located at the /var/www/domain.com/log/ directory. We are instructing the log files to rotate monthly for a total of 24 times. We are compressing the files by zipping them. We are using the date extension as part of the filename. We are also delaying the compression until the log has been rotated at least twice. Finally, Apache is restarted.

$ sudo nano /etc/logrotate.d/apache
/var/www/domain.com/*.log {
  monthly
  missingok
  rotate 24
  dateext
  compress
  delaycompress
  notifempty
  create 640 root adm
  sharedscripts
  postrotate
    if /etc/init.d/apache2 status > /dev/null ; then \
      /etc/init.d/apache2 reload > /dev/null; \
    fi;
  endscript
  prerotate
    if [ -d /etc/logrotate.d/httpd-prerotate ]; then \
      run-parts /etc/logrotate.d/httpd-prerotate; \
    fi; \
  endscript
}

To learn more about the logrotate utility, please visit the documentation.