02 · Logs & Journal
Linux Log Forensics: syslog, journald, wtmp and auditd
How to analyse Linux logs in an investigation: rsyslog files, sshd and sudo lines, the journald binary journal, wtmp/btmp, auditd and tampering signs.
logsjournaldsyslog
Area 02
Logs & Journal
Logs are the backbone of most Linux investigations. This area explains where each distribution writes authentication and system events, how to query the binary systemd journal offline, how to read wtmp, btmp and lastlog, and how to spot gaps and tampering.
Key artifacts
- /var/log/auth.log
- /var/log/journal
- wtmp / btmp
Guides in this area
Artifact cheat sheets
Where each artifact lives, what it proves, its timestamps and the tools to parse it.
- auth.log, secure and syslog: Linux Text Logsrsyslog text logs on Linux: auth.log and syslog on Debian/Ubuntu, secure and messages on RHEL, with rotation and timestamp format pitfalls.
- systemd Journal: Linux Binary System LogThe systemd-journald binary log: structured entries with trusted process fields and microsecond UTC timestamps, often the only system log on modern Linux hosts.
- wtmp, btmp, utmp and lastlog: Linux Login RecordsBinary Linux login records: wtmp session history, btmp failed logins, utmp live sessions, lastlog per-UID last login, and their wtmpdb/lastlog2 successors.
- auditd audit.log: Linux Kernel Audit TrailThe Linux audit log written by auditd: PAM logins, syscalls, execve arguments and watched file access, each tied to the original login user (auid).
- sudo Logs: Linux Privilege Use RecordsHow sudo records who ran what as root on Linux: syslog and journal lines, optional log files and I/O session recordings, plus sudoers policy files.
- Linux Firewall Logs: iptables, nftables, ufw, firewalldNetfilter packet log lines from iptables, nftables, ufw and firewalld, plus firewall rule files that reveal tampering, on Debian, Ubuntu and RHEL hosts.
- Apache and Nginx Logs: Linux Web Server ForensicsApache httpd and nginx access and error logs on Linux: log formats, paths per distro, rotation and how to hunt web shells and exploitation.
- dmesg, kern.log and the Kernel Ring Buffer on LinuxThe Linux kernel log: dmesg ring buffer, kern.log, messages, journal and pstore, plus the segfault, OOM kill and promiscuous mode lines that matter.
- AppArmor and SELinux Denials: Linux MAC Audit LogsSELinux AVC and AppArmor DENIED records on Linux: where they are logged, how to read them, and how they expose web shells, exploits and disabled enforcement.
- logrotate State and Log Gaps: Detecting Linux Log Tamperinglogrotate configuration and state files on Linux: how rotation shapes what logs survive, how to tell normal rotation from deletion, and postrotate persistence.
- MySQL, MariaDB and PostgreSQL Logs: Linux Database ForensicsDatabase server evidence on Linux: MySQL/MariaDB error, general and binary logs, PostgreSQL server logs, client history files and the plugins attackers abuse.
- cloud-init Logs and Instance Data: Linux Cloud VM Forensicscloud-init on Linux cloud VMs: cloud-init.log, output log, user-data, per-instance state and boot scripts that record provisioning, SSH keys and persistence.