# Logs

## <mark style="color:red;">Enumerate</mark>

<table data-header-hidden data-full-width="true"><thead><tr><th>Command</th><th>Description</th></tr></thead><tbody><tr><td><mark style="color:yellow;"><code>journalctl</code></mark></td><td>Logs from the systemd journal, includes system service logs and kernel messages.</td></tr><tr><td><mark style="color:yellow;"><code>dmesg</code></mark></td><td>System message buffer, containing kernel-related messages from boot time.</td></tr><tr><td><mark style="color:yellow;"><code>ls -ltr /var/log/</code></mark></td><td>Lists all log files in the /var/log directory in reverse chronological order.</td></tr><tr><td><mark style="color:yellow;"><code>grep 'keyword' /var/log/syslog</code></mark></td><td>Searches for 'keyword' in the syslog file.</td></tr><tr><td><mark style="color:yellow;"><code>grep -R &#x3C;service-name> /var/log</code></mark></td><td>Recursive search of all logs for keyword.</td></tr><tr><td><mark style="color:yellow;"><code>awk '/^Sep 10/,/^Sep 12/' /var/log/syslog</code></mark></td><td>Extracts log entries between September 10 and September 12 from the syslog.</td></tr><tr><td><mark style="color:yellow;"><code>find /var/log -type f -mtime -7</code></mark></td><td>Finds log files modified in the last 7 days.</td></tr><tr><td><mark style="color:yellow;"><code>zgrep 'keyword' /var/log/syslog*.gz</code></mark></td><td>Searches for 'keyword' in compressed log files in /var/log.</td></tr><tr><td><mark style="color:yellow;"><code>cat /var/log/messages</code></mark></td><td>Display system messages.</td></tr><tr><td><mark style="color:yellow;"><code>cat /var/log/auth.log</code></mark></td><td>Display authentication logs.</td></tr><tr><td><mark style="color:yellow;"><code>cat /var/log/syslog</code></mark></td><td>Display system log.</td></tr><tr><td><mark style="color:yellow;"><code>strings /var/log/wtmp</code></mark></td><td>Find strings.</td></tr><tr><td><mark style="color:yellow;"><code>head /var/log/secure</code></mark></td><td>Shows top 10 lines.</td></tr></tbody></table>

Check multiple logs for info:

```bash
file /var/log/secure; file /var/log/wtmp; file /var/log/messages
```

Search for keyword in datetime range:

{% code overflow="wrap" %}

```bash
grep "keyword" /var/log/syslog | awk '$1 " " $2 ]= "start_datetime" && $1 " " $2 [= "end_datetime"
```

{% endcode %}

{% code overflow="wrap" %}

```bash
grep "error" /var/log/syslog | awk '$1 " " $2 ]= "2024-01-01 08:00:00" && $1 " " $2 [= "2024-01-02 12:00:00"
```

{% endcode %}

Systemd search for keyword in datetime range:

```bash
journalctl --since [start_date] --until [end_date] | grep [keyword]
```

{% code overflow="wrap" %}

```bash
journalctl --since "2024-02-07 10:00:00" --until "2024-02-07 12:00:00" | grep [keyword]
```

{% endcode %}

SysV search for keyword in datetime range:

{% code overflow="wrap" %}

```bash
tail -n 1000 /var/log/messages | grep -E "[start_date] [start_time].[end_date] [end_time].[keyword]"
```

{% endcode %}

SysV search for keyword in datetime range (Seperate commands):

{% code overflow="wrap" %}

```bash
cat /var/log/messages | grep -E "[start_date] [start_time]" | grep -E "[end_date] [end_time]" | grep [keyword]
```

{% endcode %}

### <mark style="color:purple;">Typical Logs</mark>

#### <mark style="color:green;">System-wide logs:</mark>

/var/log: This is the most common location for system-wide logs on SysV-based systems. It usually contains files like messages, auth.log, kern.log, etc.

/var/log/journal: This is the central location for system logs under Systemd. It stores logs in a structured format using the journald service.

/var/log/audit: This directory stores audit logs related to user activity and system events.

#### <mark style="color:green;">Application-specific logs:</mark>

Check application documentation or configuration files for their specific log locations. They might be under /var/log or in application-specific directories like /var/log/\<application\_name>.

### <mark style="color:purple;">Common Log Locations</mark>

| Log File                              | Description                                                                        |
| ------------------------------------- | ---------------------------------------------------------------------------------- |
| /var/log/auth.log                     | Contains authentication-related logs, including login attempts and failures.       |
| /var/log/syslog                       | General system log file containing messages from various system services.          |
| /var/log/messages                     | Another system log file similar to syslog, often used by older Unix systems.       |
| /var/log/secure                       | Contains security-related logs, including authentication and authorization events. |
| /var/log/audit/audit.log              | Contains audit logs generated by the Linux audit subsystem for security analysis.  |
| /var/log/daemon.log                   | Contains logs specific to daemon processes, such as syslogd or sshd.               |
| /var/log/kern.log                     | Contains kernel-related logs, including hardware errors and kernel messages.       |
| /var/log/cron                         | Contains logs related to cron jobs, including scheduled tasks and job output.      |
| /var/log/maillog or /var/log/mail.log | Contains logs related to email services, such as sendmail or postfix.              |
| /var/log/httpd/access\_log            | Contains access logs for the Apache HTTP server.                                   |
| /var/log/httpd/error\_log             | Contains error logs for the Apache HTTP server.                                    |
| /var/log/nginx/access.log             | Contains access logs for the Nginx web server.                                     |
| /var/log/nginx/error.log              | Contains error logs for the Nginx web server.                                      |
| /var/log/mysql/error.log              | Contains error logs for the MySQL database server.                                 |
| /var/log/mysql/mysql.log              | Contains general logs for the MySQL database server.                               |
| /var/log/sshd.log                     | Contains logs specific to the SSH daemon.                                          |
| /var/log/lastlog                      | Contains information about the last login times of users.                          |
| /var/log/wtmp                         | Contains information about user logins, logouts, and system reboots.               |
| /var/log/apache2/ or /var/log/httpd/  | Web server access and error logs.                                                  |
| /var/log/boot.log                     | System boot messages.                                                              |
| /var/log/dmesg                        | Kernel ring buffer messages, useful for hardware and driver messages.              |

### <mark style="color:purple;">Syslog</mark>

Potential Log Locations: \
/etc/syslog

/etc/syslog.conf

/etc/syslog/syslog/syslog.conf

#### <mark style="color:green;">Faculties: What is being logged</mark>

<mark style="color:orange;">**Auth (or Authpriv)**</mark>: User logins/failed logins. Any security logs will probably be stored here.

<mark style="color:orange;">**Kern**</mark>: Basically system logs. System crashes. System on/off.

<mark style="color:orange;">**Mail**</mark>: Any logs from the mail daemon.

<mark style="color:orange;">**Cron**</mark>: Any logs from the crond. Typically these are debug messages. Job completions.

<mark style="color:orange;">**News**</mark>: Network news subsystem (not usually seen)

<mark style="color:orange;">**LPR**</mark>: Printer logs.

<mark style="color:orange;">**User**</mark>: User applications

<mark style="color:orange;">**Local 0-7**</mark>: Reserved for local system use. They are custom logs so they can be customized to log whatever you want.

#### <mark style="color:green;">Priority: At what level it is being logged</mark>

<mark style="color:orange;">**7**</mark> - <mark style="color:orange;">**Debug**</mark>: Debug info

<mark style="color:orange;">**6**</mark> - <mark style="color:orange;">**Info**</mark>: Just info

<mark style="color:orange;">**5**</mark> - <mark style="color:orange;">**Notice**</mark>: Normal but significant info

<mark style="color:orange;">**4**</mark> - <mark style="color:orange;">**Warning**</mark>: Significant info

<mark style="color:orange;">**3**</mark> - <mark style="color:orange;">**Error**</mark>: Something can't run

<mark style="color:orange;">**2**</mark> - <mark style="color:orange;">**Critical**</mark>: Very significant info

<mark style="color:orange;">**1**</mark> - <mark style="color:orange;">**Alert**</mark>: Something is happening

<mark style="color:orange;">**0**</mark> - <mark style="color:orange;">**Emergency**</mark>: System crash

Examples:

Kern.0 /var/log/kern

This means log kernel emergency messages to /var/log/kern

\*.0 /var/log/emrg

This means log every faculty emergency message to /var/log/emrg

### <mark style="color:purple;">Rsyslog</mark>

Potential Log Locations:\
/etc/rsyslog

/etc/rsyslog.conf

/etc/rsyslog/rsyslog/rsyslog.conf

## <mark style="color:red;">Modify</mark>

<mark style="color:yellow;">`sed -i`</mark> will modify the original file.

Look for lines containing pattern in file.txt and replaces oldKeyword with newKeyword on those lines. Could use this to look for timestamps in logs and modify the user of the actions or change the actions to something less suspect.

```bash
sed -i '/pattern/s/oldKeyword/newKeyword/' file.txt
```

Replace keyword within datetime range:

{% code overflow="wrap" %}

```bash
sed -i '/start_date start_time/,/end_date end_time/s/old_keyword/new_keyword/g' filename
```

{% endcode %}

{% code overflow="wrap" %}

```bash
sed -i '/2024-01-01 08:00:00/,/2024-01-02 12:00:00/s/error/warning/g' example.log
```

{% endcode %}