Host Operating System Logs
Summary
PDF p.318Operating systems keep various logs to record events as users and software interact with the system. These logs are crucial for investigating security incidents and can be specific to different aspects of system functionality.
In plain words
Supplementary — not from your PDFOS logs record audit events as success or failure: authentication (sign-ins and privilege use) and file system access (which usually has to be switched on). Windows has Application, Security and System logs. Linux uses syslog or journald, with /var/log/messages or syslog for general events, /var/log/auth.log or secure for logins and sudo, and package manager logs. macOS uses the Unified Logging System (the Console app or the log command).
Detailed explanation
PDF p.318Operating System-Specific Security Logs
-
Audit Events: Classed as success/accept or fail/deny.
- Authentication Events: Record user sign-ins/outs and attempts to obtain special privileges.
- File System Events: Record permissions to read or modify files, usually requiring explicit configuration.
Windows Logs
- Application Log: Events from application processes (e.g., crashes, installations).
- Security Log: Audit events (e.g., failed logins, access denials).
- System Log: Events from OS kernel processes and services (e.g., service failures, shutdowns).
Linux Logs
- Implementation: Varies by distribution (syslog or Journald).
-
Principal Log Files
- /var/log/messages or /var/log/syslog: Stores all system events.
- /var/log/auth.log or /var/log/secure: Records login attempts, sudo use, and authentication data.
- Package Manager Log: Stores software installation and update information.
macOS Logs
- Unified Logging System: Accessed via the Console app or the log command.
- Security-Related Events: Includes login, app installs, and system policy violations.
Important terms
taken from the text above- Audit Events
- Classed as success/accept or fail/deny.
- Authentication Events
- Record user sign-ins/outs and attempts to obtain special privileges.
- File System Events
- Record permissions to read or modify files, usually requiring explicit configuration.
- Application Log
- Events from application processes (e.g., crashes, installations).
- Security Log
- Audit events (e.g., failed logins, access denials).
- System Log
- Events from OS kernel processes and services (e.g., service failures, shutdowns).
- /var/log/messages or /var/log/syslog
- Stores all system events.
- /var/log/auth.log or /var/log/secure
- Records login attempts, sudo use, and authentication data.
- Package Manager Log
- Stores software installation and update information.
- Unified Logging System
- Accessed via the Console app or the log command.
- Security-Related Events
- Includes login, app installs, and system policy violations.
Examples & real-world scenarios
Supplementary — not from your PDF- Windows Security log showing failed logons.
- Linux auth.log recording sudo use.
- Enabling file access auditing on a sensitive folder.
Scenario
An analyst suspects someone tried to guess a Linux admin's password. The authentication log (auth.log or secure) shows many failed login attempts from one IP address.
Common mistakes
Supplementary — not from your PDF- Looking in the Application log for failed logons. They're in the Security log.
- Assuming file access is logged by default.
Practical skills
Supplementary — not from your PDF- Know where to find login events on Windows, Linux and macOS.
What I should remember
Key Points PDF p.318-
OS-Specific Security Logs
- Audit Events: Success/accept or fail/deny.
- Authentication Events: User sign-ins/outs, privilege attempts.
- File System Events: Permissions to read/modify files.
-
Windows Logs
- Application Log: Application events.
- Security Log: Audit events.
- System Log: OS kernel events.
-
Linux Logs
- Implementation: Syslog or Journald.
- Principal Log Files: System events, authentication data, package manager logs.
-
macOS Logs
- Unified Logging: Console app or log command.
- Security Events: Login, app installs, policy violations.