The Linux logging system
Linux has a robust logging system where most applications are or can be configured to log with different levels such as info, debug, and critical, and even none to turn off logging. Many applications not only allow you to specify the level but also where the log file will be located. If you do not have a dedicated log server, most will write their log entries under the /var/log directory. The better option for defenders is to have a centralized log storage server. This serves two purposes:
- By having a central place for logs, administrators can more proactively scan and review them for anomalies without having to connect to multiple servers to check
- Having the logs centralized makes it more difficult for attackers to cover their tracks since they will most likely not be able to access the log repository
From the attacker’s point of view, you will want to remove any logs that might have recorded your activity. To do this, you can approach...
