Hey everybody.
Welcome to next video.
We're gonna be talking about clearing Linux logs.
But before we talk about how to clear them I want to talk about what some logs are that you might want
to have some specific in.
Now this system we have something called the off lock.
And keep in mind that most logs are in var log up here at the top left.
So again often not log is an interesting log to go for.
So if we go take a look at that just cut it all out will go all the way to the bottom.
So what you can see here is something interesting when a user elevates as another user or logs in you're
going to get an entry here.
So we see pseudo root user use sudo in the current path of var log with the command unless that's so.
Keep in mind that when you look at your command history and future videos when we go over that that
you keep note that your log this particular log will also have your sudo access.
And this is where a lot of times monitoring software such as Splunk when it when it grabs the logs and
actually goes and alerts things you're going to find that this is what it's looking at.
It's looking for this instance where it says This user has a t t y.
This shell and it ran this command as root.
There's a similar log to this on other types of Linux distro as this is called the Secure log.
Now on our Kelly machine we don't have a secure log but keep that in mind that you'll also see security
and replace of this on different systems.
Next thing is is there's this log right at this log so if we look here we can see quite a bit of things
we can see that it's taking care of cron and it's issuing the cron logs here for certain applications.
And this is important because this log is what some administrators will use to push logs to a different
machine and you'll see that you can look at the logs here to see what rotation that occurs on.
So if you know it happens every every day at 9 a.m. then you know that you have until 9:00 a.m. to clear
out whatever whatever you need to do with clearing the logs whether it's the whole thing or specific
bits Tali up to you.
So we have another one called the kernel log.
So.
Curt now Colonel log is going to have kernel information errors audit files drives etc. and so also
in a kernel goes and kills a process for whatever reason using oh and killer you'll see that in here
as well.
So you see your audit undefined dump was ran with 13 forty four four as a PD so there's a lot of things
you can take a look at here and the audit part is an important piece because there's quite a bit of
information.
It's always good to take a look through this files to make sure you see what you got.
Next is we're gonna look at access logs.
Now this is only in the case that there's some web service involved.
So if we do Cat Apache to access log we can see we have every web request that was placed to go to this
web service which is good.
As we spoke about in our post exploitation that when you know if somebody is actually exploiting or
using a web service and we own a machine that the Web services on we're able to make adjustments to
common pages that are hit at a more frequent rate than others.
So the next thing we want to do is look at our messages log so messages has quite a bit of information.
Now in mine in my particular case there's not much here.
But this this log can contain system errors networking config such as when the lease for the IP address
needs to be renewed.
Any issues and text that appears during startup and shutdowns.
There's a lot of stuff in here and there's a lot of times that custom applications that need to get
logs into CIS loggers or Splunk will either log directly to the source log log file or the messages
log that's also important to know.
There's one last thing I want to talk to you guys about before we go through how to clear the logs is
that sometimes custom applications will dump their logs in here it's possible they dump it in here other
times they'll dump it on different spots.
So I want to task you guys with grabbing a find command that is able to grab anything with a dot log
extension anywhere on the system and then show that to the to the user or print it out to the screen.
This will help you find custom scripts that might have log files stored in their own directories.
It's always going to just double check that stuff to see what user information we might be able to find
whether it's passwords or not.
And you do the same thing with dot com files as well for configure or dot I and I now to clear a log
it is just as simple as editing a file.
So we'll take the off log as an example.
So if we do V.I. off
and we go all the way to the bottom here
we can see here this is just a simple log.
So if we come up here we'll look at this guy right here.
This pseudo go ahead and get rid of it and save.
So now when you cut off we can see we no longer have that instance of us using sudo.
So you can edit it just like you would any other file with Linux so and remember it's also it's only
it's really only a good idea to start clearing specific things unless you have a valid use case for
clearing the whole log because that is much more obvious to the user.