System Logging
Explore Linux system logging to understand how audit trails are created and maintained. Learn to use rsyslog and journalctl for managing logs that assist in identifying security incidents and troubleshooting. This lesson provides vital knowledge for pentesters and administrators to track system activity and secure Linux environments.
Introduction to logging systems
Log files help provide an audit trail of the system’s operations. These files exhibit essential information in case of a security breach or when troubleshooting a system problem. When an issue arises in the operating system, analyzing the log files is the first thing a pentester, or a system administrator, needs to do. Therefore, when securing a Linux machine, we need a proper understanding of the management of the logging function to determine if a system has a vulnerability or has been attacked and then determine what happened and who was responsible.
The rsyslog logging daemon
The log files are plain text files in the /var/log ...