https://www.linuxlogparser.com/en/blog Latest from Blog en Wed, 30 Sep 2026 00:50:49 GMT https://www.linuxlogparser.com/en/blog/auditd-execve-forensics https://www.linuxlogparser.com/en/blog/auditd-execve-forensics Reconstruct command lines from Linux audit.log: grouping records by event, EXECVE argument reassembly, hex-encoded arguments, auid and ses across sudo. Florian Amette Wed, 30 Sep 2026 00:00:00 GMT https://www.linuxlogparser.com/en/blog/auth-log-forensics-ssh-sudo https://www.linuxlogparser.com/en/blog/auth-log-forensics-ssh-sudo Read /var/log/auth.log and /var/log/secure in an investigation: SSH brute force and logins, sudo and su root shells, password and account changes, time formats. Florian Amette Wed, 30 Sep 2026 00:00:00 GMT https://www.linuxlogparser.com/en/blog/collect-linux-logs-for-forensics https://www.linuxlogparser.com/en/blog/collect-linux-logs-for-forensics What to collect for a Linux log investigation and how: one tar command on a live host, journalctl export, ausearch, UAC, Velociraptor, or a mounted disk image. Florian Amette Wed, 30 Sep 2026 00:00:00 GMT https://www.linuxlogparser.com/en/blog/detect-linux-log-tampering https://www.linuxlogparser.com/en/blog/detect-linux-log-tampering How to prove Linux logs were edited or deleted: journal seqnum gaps, lines missing from auth.log, blanked wtmp records, stopped daemons and clearing commands. Florian Amette Wed, 30 Sep 2026 00:00:00 GMT https://www.linuxlogparser.com/en/blog/linux-intrusion-investigation-walkthrough https://www.linuxlogparser.com/en/blog/linux-intrusion-investigation-walkthrough A worked Linux log investigation on a synthetic jump host: SSH password guessing, a login from a new IP, sudo -i, cron and systemd persistence, log tampering. Florian Amette Wed, 30 Sep 2026 00:00:00 GMT https://www.linuxlogparser.com/en/blog/linux-log-forensics-timeline https://www.linuxlogparser.com/en/blog/linux-log-forensics-timeline How the four Linux log families fit together in an investigation, what each one proves, where they disagree, and how to merge them into one timeline. Florian Amette Wed, 30 Sep 2026 00:00:00 GMT https://www.linuxlogparser.com/en/blog/systemd-journal-forensics https://www.linuxlogparser.com/en/blog/systemd-journal-forensics systemd journal forensics without journalctl: the file format, trusted fields, compression, sequence-number gaps, dirty .journal~ files and time fields. Florian Amette Wed, 30 Sep 2026 00:00:00 GMT https://www.linuxlogparser.com/en/blog/wtmp-btmp-lastlog-forensics https://www.linuxlogparser.com/en/blog/wtmp-btmp-lastlog-forensics Linux login records in an investigation: struct utmp on x86_64 and aarch64, btmp failed logins, lastlog slots, wtmpdb and lastlog2 SQLite files, tampering. Florian Amette Wed, 30 Sep 2026 00:00:00 GMT