Skip to content
Linux Log Parser

Series

Linux log investigations

2 posts in this series. Read them in order or jump to any one.

  1. Detecting Linux Log Tampering: Gaps, Blanks and Stops

    How to prove Linux logs were edited or deleted: journal seqnum gaps, lines missing from auth.log, blanked wtmp records, stopped daemons and clearing commands.

  2. Linux Intrusion Investigation: A Log Walkthrough

    A worked Linux log investigation on a synthetic jump host: SSH password guessing, a login from a new IP, sudo -i, cron and systemd persistence, log tampering.

All posts in this series

Detecting Linux Log Tampering: Gaps, Blanks and Stops
How to prove Linux logs were edited or deleted: journal seqnum gaps, lines missing from auth.log, blanked wtmp records, stopped daemons and clearing commands.
linux-forensicslog-tamperinganti-forensicssystemd-journal
Linux Intrusion Investigation: A Log Walkthrough
A worked Linux log investigation on a synthetic jump host: SSH password guessing, a login from a new IP, sudo -i, cron and systemd persistence, log tampering.
linux-forensicscase-studysshauditd