Logging is one of the most important functions of security we should have detailed logs of everything
on the network for security auditing and troubleshooting.
If your network is attacked you would want to be able to point to logs to identify the Who What Where
When and why something happened.
Each operating system has their own logging system Windows logging information can be displayed from
the Event Viewer these logs consist of data like user log in log offs in System Events.
Let's hop back into the lab and I'll show you a live event viewer log from a Microsoft server.
Here I have a remote desktop solution to a Windows server and to get to the Event Viewer logs I'm just
going to go to the Start Menu and I can either click right on the viewer here since it's in my past
applications or like anything else I could just search for it in my search bar and click on it to launch.
So here's the Event Viewer dashboard if you do the dropdown for custom views since this is an active
directory server with multiple roles.
I could actually look at specific logs for each service running on the server.
So if I want to look at DHP server logs I can click on the DHP server option and filter the logs for
that role in relation to security.
If you go to Windows logs and security it's going to filter to security events.
These are very useful logs for investigating a security incident to see exactly when someone logged
on and off the network.
In addition to system logs operating systems have specific logging information for different applications
like Web services.
I asked.
Is the windows based web server application and like apache web servers.
It has access logs to record server activity
Linux also has its own version or system logs.
If you use the command CD for change directory and then for Flash VAR for its last log that takes you
to the Linux log directory.
So that's the main path to get to all of the different system logs you'll find in Linux.
And if you use the last command like you see here you can see all of the different logs that are store
to see log output.
You can use the command more and then the name of the log file.
And as you can see here you could scroll through logs or if you were troubleshooting something or doing
an investigation one really good log to know about when it comes to security and Linux is the authentication
log which is located in the off that log file.
As you can see here this log can be used to audit user log ins to the system.
So if I was investigating a security breach and I wanted to see what user accounts logged into a compromised
system I could look at the opt out log file.
Apache Web servers are open source Linux based systems.
Apache access logs are used to monitor events on apache web servers these logs record and store information
like saurus user IP addresses and the pages that they access.