System Forensics, Investigation, and Response, 3rd Edition

Linux Logs

Like Windows, Linux has a number of logs that can be very interesting for a forensic investigation. This section provides a brief description of each of the major Linux logs and the forensic relevance of that log.

The /var/log/faillog Log

This log file contains failed user logins. This can be very important when tracking attempts to crack into the system. Usually, a normal user might occasionally have one or two failed login attempts. Numerous failed login attempts, or even frequent failed login attempts that occur at diverse times, can be an indicator of someone trying to compromise access to the system. It is also worth noting the times of failed login attempts. If an employee normally works from 8:00 a.m. to 5:00 p.m., and there are failed login attempts at 11:00 p.m., that may be a warning sign.

The /var/log/kern.log Log

This log file is used for messages from the operating system’s kernel. This log is less interesting forensically. It is more likely to show systemwide problems. However, it is entirely possible for someone to mistake system issues for some intrusion or malware. If you have odd behavior on a target system and find related messages in the kern.log, it may allow you to rule out malware.

The /var/log/lpr.log Log

This is the printer log. It can give you a record of any items that have been printed from this machine. That can be useful in many cases. To begin with, corporate espionage cases often involve the criminal printing out sensitive documents. Having a record of exactly what was printed when and which user printed it can be very useful.

The /var/log/mail.* Log

This is the mail server log, and it can be very useful in any computer crime investigation. Email can be useful in many different criminal investigations. It is obviously very useful in cyberstalking cases, as well as many civil litigation cases.

The /var/log/mysql.* Log

This log records activities related to the MySQL database server. These are of most interest in crimes involving database attacks. For example, SQL injection attacks might leave a record in the database log.

FYI

Snort is an open source intrusion detection system (IDS). Intrusion detection systems monitor network traffic looking for suspicious activity. There are two types of intrusion detection systems: passive and active.

A passive IDS will simply log suspicious activity and perhaps notify a network administrator. Active IDSs (also called intrusion prevention systems [IPSs]) also log the activity, but then shut down the suspected attack. The problem is that all systems get false positives—traffic that appears to be an attack but is not. For example, suppose Jane usually works from 8:00 a.m. to 5:00 p.m. and uses no more than 50 megabytes of bandwidth per hour. Suddenly, the system shows Jane logged on at 11:00 p.m. and used 300 megabytes of bandwidth per hour. The active IDS assumes this is an attack and blocks the traffic. However, in reality, Jane is working late on an important presentation that is due tomorrow.

The issue of active versus passive is one for the organization’s security administrator to deal with. From a forensic point of view, the IDS log is the important issue. If an organization is using an IDS, any IDS, you should absolutely view those logs.

The /var/log/apache2/* Log

If this machine is running the Apache web server, then this log shows related activity. This can be very useful in tracking attempts to hack into the web server. You can examine the log to see attempts at buffer overflow attacks, denial of service attacks, and a variety of other attacks.

The /var/log/lighttpd/* Log

If this machine is running the Lighttpd web server, then this log shows related activity. This can be very useful in tracking attempts to hack into the web server.

The /var/log/apport.log Log

This log records application crashes. Sometimes these can reveal attempts to compromise the system or the presence of malware. Of course, it can also simply reveal a buggy application. That is the real challenge with computer forensics: determining what is evidence of an actual crime.

Other Logs

Any other applications running on the Linux computer that store logs can be useful in your forensic examination. For example, if you are using an intrusion detection system (IDS) such as Snort, it keeps logs of all suspicious traffic. That can be very useful in your investigation.

Viewing Logs

With Linux, you can use a variety of shell commands to view a log. You can also simply use your favorite text editor within your preferred graphical user interface. Using the Linux dmesg command is the preferred way to view logs from the shell. It works like this:

dmesg | lpr

Or, you can use any of these methods as well:

# tail -f /var/log/lpr.log
# less /var/log/ lpr.log
# more -f /var/log/ lpr.log

As you can see, there are a number of methods for viewing logs in Linux.

Table of Contents for System Forensics, Investigation, and Response, 3rd Edition

Table of Contents for
System Forensics, Investigation, and Response, 3rd Edition