-: Host and Server Log Files.
So, we've talked about firewalls,
we talked about routers,
we talked about the DHCP servers.
Now we're gonna talk about the specific host
that was infected, or the server that was infected.
And system logs are collected by the system right?
That's why they're called system logs.
They're useful for troubleshooting things,
and reconstructing a cyber attack after one's occurred.
These log files are gonna provide information
on the system configuration, the applications installed,
and the user accounts on a given system.
And you have to use the system,
you have to have access to it to get these logs,
so you have to physically be there,
or have remote access to these servers
to be able to collect this data.
That's the challenge.
But again, if you're there on site doing an instant response
that's not a real big challenge.
So, when you're looking at a Windows system,
what type of logs can you find?
Well, there's five main types.
The first one is Application logs.
These are logged by programs and applications.
So when Microsoft Word opens up and crashes,
it writes to an application log.
Security logs.
These are gonna record log-in events, resource usage,
files that are created, opened or deleted,
and other system,
excuse me, other security-type events.
Setup logs.
These are gonna record application setup applications,
so whenever you install a new program,
like, I don't know, maybe a virus
that makes registry changes.
It can actually log to the Setup log.
System logs.
System logs are gonna be events from Windows components
like the DirectX subsystem,
hardware and software drivers
that are built into the OS,
and other system-level events.
And the last one is ForwardedEvent logs.
These are event subscriptions from remote computers.
And they're gonna, anything that's remote
that's coming through, is a forwarded event.
So those are your five types.
Application, System, Setup, Security,
and ForwardedEvents, so keep those in your head,
and you'll be alright with Windows system logs,
and be able to find them.
Now, the next one we're gonna talk about is Linux.
Linux is a little bit easier,
because pretty much everything's logged
in the /var/log directory.
So /var/log directory on the Linux system
is where most of the logs are gonna be kept.
Now, some applications may log in,
in their own file systems as well,
under their own paths, but in general,
all of your Linux System Logs
are gonna go to the var/log,
so go there and copy that directory first
when you're doing an assessment or an incident response,
because that's where you're gonna find the bulk
of your information to reconstruct the event.