[ELK] Reading, Indexing and Visualizing Windows logs with ELK Stack

Hello Friends,

A system administrator knows how much system logs can help to troubleshoot critical problems. And what if those logs are indexed at one place and can be visualized in charts etc. Fun, isn't it?

Let's see what can help us to set it up..

1. Nothing special to be done at Elasticsearch just run it by executing elasticsearch.bat from bin directory.

2. Prepare a config so that Logstash can read windows logs. We need to add config in input plugin.

This eventlog plugin helps logstash to read windows logs. Windows logs are stored in binary format and can be accessed using only Win32 API. This plugin takes several configuration options but all of those are optional. These config options are codec, add_field, logfile, interval, tags, type out of which we are using logfile and type.

a) type has no default value and used for filter activation. The given type is stored as part of event and we can search events in Kibana using this.
b) logfile is an array of String and contains Application, Security, System as default values in array. In the config we have used only System.

3. Store this config to a custom file in conf in Logstash with name logstash-windowslogs.conf
and run logstash using

where complete config file will be as -

4. We're done with configuration of Logstash. Next is to read this in kibana. Here is our config to connect Kibana to Elasticsearch to read indices.


5. As soon as we start Logstash, it will start collecting all the events and index them to elasticsearch. Now lets run Kibana by executing kibana.bat in bin directory.

6. Once Kibana is started, we can open its interface in browser using http://localhost:5601/. We need to configure index pattern. By default, it shows logstash-* in index name or pattern field and @timestamp in Time-Field name. Hit create by keeping defaults.

7. Now click Discover on the top menu to see the results. It will show histogram of counts of event.

All the results are also listed below histogram but for security reasons, I have not shown them here..

That's it. Pretty clean, what you say?

[Forms] Detect enter key pressed using javascript/JQuery

Hi,

Sometimes, we need to detect when Enter key was pressed or some other key as per the requirement. I had a use case where I had a search box and it was not a form. User could put some content in search input text box and when user hits Enter, it should fetch data using ajax call. The code below detects when Enter key was pressed.

We will add a keypress handler to the document which will capture all events whenever a key is pressed. We need to check which one is Enter. The code for Enter is 13.


We also need to check if the focus was actually the search input text.

That's all what we need.

Until next time :)

[Apache] Creating virtual hosts with Apache Httpd web server.

Its common to see multiple project running on one machine. Sometimes, it looks great if every web application runs with its own domain name. I usually keep my hostname as rkg.test, and for projects xxxx.proj. If I have multiple projects lets say blog, forum etc. so I can keep them as blog.proj, forum.proj etc. Neat, isn't it.

Here are simple steps to make it work.
1. Open your hosts file - in C:\Windows\System32\drivers\etc\hosts and add your domain to it. Add the lines at the end of file like this.
127.0.0.1 blog.proj
127.0.0.1 forum.proj

2. Make sure httpd.conf file has virtual hosting enabled. Either add virtual hosts in the same httpd.conf file or put them in a different file and use that. Lets keep them separate in another file and keep this line in httpd.conf
Include conf/extra/httpd-vhosts.conf

3. If already not present, create a folder in conf/ named extra and create a httpd-vhosts.conf file.

4. Add a line for enabling NameVirtualHost
NameVirtualHost *:80

5.  Add a virtual host by adding these lines in httpd-vhosts.conf file
<VirtualHost *:80>
    ServerAdmin webmaster@blog.proj
    DocumentRoot "D:/pFiles/xampp/htdocs/blog.proj"
    ServerName blog.proj
    ErrorLog "logs/blog.proj-error.log"
    CustomLog "logs/blog.proj.log" common
</VirtualHost>

6. Similarly add one more for forum.proj
<VirtualHost *:80>
    ServerAdmin webmaster@forum.proj
    DocumentRoot "D:/pFiles/xampp/htdocs/forum.proj"
    ServerName forum.proj
    ErrorLog "logs/forum.proj-error.log"
    CustomLog "logs/forum.proj.log" common
</VirtualHost>

7. Restart your apache. And open blog.proj and forum.proj in your browser.

Simple enough. Isn't it?

Until next time, C ya. Enjoy.

[Tomcat][Debug] Start tomcat in debug mode and remote debug java code in eclipse

More often, we need to debug our applications irrespective of the programming language. I need to debug liferay portlets, hooks etc for troubleshooting issues.

Lets see how we can start our tomcat in debug mode and debug with eclipse. Follow the simple steps.

1. Open catalina.bat in tomcat/bin folder.

2. Search for the line starting with set DEBUG_OPTS=

3. Replace the line with
set DEBUG_OPTS=-Xdebug -Xrunjdwp:transport=dt_socket,server=y,suspend=n,address=1044

4. Port number given here is 1044, you can choose any port as per the availability.

5. Now start your tomcat by running catalina.bat. Tomcat logs should print this line at the start
Listening for transport dt_socket at address: 1044

6. In the eclipse, you can do remote debugging, Go to Run > Debug Configurations, under Remote Java Application, create a new node and make sure to change port number for debugging.

All done. Your application is ready for debugging.

Until next time, C ya.

[Liferay][JSTL] Adding JSTL support for liferay portlet.

Hi,

It a good practice to use JSTL for your portlets jsp rather than using scriptlets. This blog will show how to add support of jstl for your portlets. Follow these simple steps -

1. Add portal-dependency jars to lifeary-plugin-package.properties file

portal-dependency-jars=\
    jstl-api.jar,\
    jstl-impl.jar,\

2. Add portal-dependency tlds to liferay-plugin-package.properties file.

portal-dependency-tlds=\
    liferay-portlet_2_0.tld,\
    liferay-ui.tld,\
    fn.tld,\
    c.tld,\
    fmt.tld

3. In the JSP add taglibs.

<%@ taglib uri="http://java.sun.com/jstl/core_rt" prefix="c"%>
<%@ taglib uri="http://java.sun.com/jsp/jstl/functions" prefix="fn" %>
<%@ taglib uri="http://java.sun.com/jsp/jstl/fmt" prefix="fmt" %>

4. And now you can use <c:xx />, <fn:xx/> and <fmt:xx> and similarly other taglibs.

Hope this helps.

Until next time. C Ya

[PHP] PHP not working | Code not being executed by apache.

Hi,

I had this problem yet to be resolved. I tried easyphp, zpanel but php did not work for me. I could see my php code in page source in browser. My apache was actually not executing php code as php, rather it was taking as simple html.

To solve this problem, follow the steps below.
1. Check if php is really installed and available. Open command prompt anywhere and execute php -version

This should return something like this.

If you're unable to see, add php to path.

2. Check if php module is added in httpd.conf of your apache. Something like this should be present
LoadModule php5_module "C:/zpanel/bin/php/php5apache2_4.dll"
PHPIniDir "c:/zpanel/bin/php" 

3. Check if AddType is added and uncommented in httpd.conf. If this is not present, add it.
AddType application/x-httpd-php .php

Apart from these, just check the file extension, it should not .php and not accidently saved as .php.txt. And if you're using short tags <? then short tags should be allowed. To allow php short tags follow this post

Hope this helps.

Until next time. C ya.