Linux log analysis is a key skill for defenders, because Linux powers servers, cloud workloads, and most security tooling. This is Module 5 of The Complete Blue Team Course.
The Linux Security Model in Brief
Linux security rests on users, groups, and file permissions, and increasingly on capabilities and namespaces. Understanding how SUID binaries, sudo rules, and capabilities interact explains both how Linux systems get compromised and how privilege escalation happens after an initial foothold.
Where Linux Logs Live
- auth.log or secure (depending on distribution): authentication and sudo events.
- syslog and journalctl: system-wide activity.
- Application logs: web servers, databases, and services each keep their own.
A defender who knows where to look, and who uses journalctl and grep efficiently under time pressure, investigates far faster than one who guesses.
auditd: Detailed Auditing on Linux
auditd lets you build granular rules around file access, system calls, and command execution, similar in spirit to what Sysmon provides on Windows. A well-tuned configuration turns a Linux server from a black box into something you can actually investigate when things go wrong.
What to Look For
- Repeated failed SSH logins followed by a success.
- New users, new SSH keys, or changes to sudoers.
- Unexpected cron jobs or systemd services.
- Commands run from unusual locations such as /tmp.
Key Takeaways
- Know the main log locations and how to search them quickly.
- Use auditd for visibility beyond default logging.
- Persistence and privilege escalation leave clear traces if you know where to look.
Frequently Asked Questions
Where are SSH login attempts logged on Linux?
In /var/log/auth.log on Debian-based systems or /var/log/secure on Red Hat-based systems, and in the systemd journal.
What is auditd used for?
It records detailed security-relevant events such as file access and command execution according to rules you define.
Get the Full Blue Team Course
This is a free preview of Module 5. The complete 22-module course, from SOC fundamentals and SIEM to threat hunting, incident response, detection engineering, and career paths, is available as a one-time $1 download.