5.3 Monitoring Log Files

Question 1

What are the three aspects to proper log management?

Answer 1

1. Ensuring logs are protected through detailed recordings of changes.
2. Storing logs for a sufficient amount of time.
3. Omitting unnecessary data to avoid excessive and gratuitous logs.

Question 2

When we properly manage our logs, we are able to better analyze and review them regularly, letting us rapidly pinpoint _________, _________, and __________.

Answer 2

When we properly manage our logs, we are able to better analyze and review them regularly, letting us rapidly pinpoint threats, regulatory violations, and fraudulent activity.

Question 3

Linux stores all log files in a centralized repository located in _______.

Answer 3

Linux stores all log files in a centralized repository located in /var/log.

Question 4

Name the log:

Store alerts generated by software being used
by the user, including when it’s launched, how long it’s in use, when it’s closed, etc.

Answer 4

Application logs

Question 5

Name the log:

Contain information regarding security
related events. E.g., a user succeeds or fails to log onto a host, or tries to install unauthorized software.

Answer 5

Event logs

Question 6

Name the log:

Contain information related to system
services such as corn jobs and print jobs.

Answer 6

Service logs

Question 7

Name the log:

Contain information regarding system events such as boot messages, kernel errors, or anything related to the
system hardware.

Answer 7

System log

Question 8

What are the four categories of logs

Answer 8

1. Application
2. Event
3. Service
4. System

Question 9

_____________ is designed to filter through enormous system logs and return specific results.

Answer 9

journalctl is designed to filter through enormous system logs and return specific results.

Question 10

_________ is a daemon that can be used for logging
system-wide events and providing information to other tools, and does not provide reader-friendly display of log information.

Answer 10

systemd is a daemon that can be used for logging

system-wide events and providing information to other tools.

Question 11

_________ collects and stores log information in a structured, indexed format.

Answer 11

journald collects and stores log information in a structured, indexed format.

○ journald is often referred to as systemd-journald

Question 12

_________ allows us to access the __________ journal and filter out desired information.

Answer 12

journalctl allows us to access the systemd-journald journal and filter out desired information.

Question 13

What is journalctl syntax?

Answer 13

journalctl [options] [information being filtered]

Question 14

_________ is designed to filter through enormous system logs and return specific results.

Answer 14

journalctl is designed to filter through enormous system logs and return specific results.

Question 15

________records log messages from different areas of a Linux system and routes them to the appropriate log in the /var/log directory

Answer 15

rsyslog records log messages from different areas of a Linux system and routes them to the appropriate log in the /var/log directory

Question 16

Unlike journalctl, rsyslog can ___________________ for individual servers.

Answer 16

Unlike journalctl, rsyslog can filter logs based on different priority levels for individual servers.

Question 17

__________ is the process of archiving a log once it reaches a specific size or a point in a set schedule, and rotating it out with a new, empty log.

Answer 17

Log rotation is the process of archiving a log once it reaches a specific size or a point in a set schedule, and rotating it out with a new, empty log.

Question 18

________ is a kernel level subsystem that can watch every system call an application makes.

Answer 18

auditd is a kernel level subsystem that can watch every system call an application makes.

Question 19

What is ausearch?

Answer 19

Tool designed to query auditd daemon logs based on different search criteria for event-driven log records.

Question 20

What is aureport

Answer 20

A program that summarizes various types of events.

Question 21

What is auditctl?

Answer 21

Responsible for configuring the auditd

system. Has the capability to enable or disable auditd systems, load and list rules, and generate status reports.

Question 22

auditd does not provide any additional security actions, rather it allows us to _______________.

Answer 22

auditd does not provide any additional security actions, rather it allows us to monitor existing violations.

Question 23

auditd integration with the system kernel allows it to
monitor all system operations, such as _________
and _________.

Answer 23

auditd integration with the system kernel allows it to monitor all system operations, such as network traffic and file system access.