Network Logs Monitoring and Analysis

Question 1

What is a log?

Answer 1

A collection of information/data on events generated in the form of an audit trail.

Question 2

Describe these logging approaches:
1) Local
2) Centralized

Answer 2

1) Logs user activities on the host machine.
2) Stores the logs generated by network devices on a central server.

Question 3

Describe these log event types:
1) Error
2) Warning
3) Information
4) Success Audit
5) Failure Audit

Answer 3

1) A significant problem such as loss of data or loss of functionality.
2) Not significant but may indicate a future problem.
3) Describes a successful operation of an application, driver, or service.
4) An audited security access attempt that is successful.
5) An audited security access attempt that fails.

Question 4

Where are Linux logs located?

Answer 4

They are located in the /var/log directory and from there are categorized by log type; auth, kern, cron, boot, httpd, mysql.

Question 5

Describe these linux commands:
1) cat
2) tail
3) head
4) less
5) more
6) grep

Answer 5

1) Displays file contents
2) Displays the last 10 lines of a file
3) Shows the first 10 lines of a file
4) Displays the contents of a file one page (screen) per time.
5) Display the number of lines of a text file that can fit on the screen.
6) Searches for a specific string in a file.