Skip to content
Linux Log Parser

Posts tagged: #auth-log

← Back to all posts
auth.log and secure Forensics: SSH, sudo and su
Read /var/log/auth.log and /var/log/secure in an investigation: SSH brute force and logins, sudo and su root shells, password and account changes, time formats.
linux-forensicsauth-logsshsudo
Linux Log Forensics: auth.log, Journal, auditd and wtmp
How the four Linux log families fit together in an investigation, what each one proves, where they disagree, and how to merge them into one timeline.
linux-forensicsdfirtimelineauth-log