Logging, Auditing and Time

Why Logs Are a Control

Most controls try to stop an attack. Logs are the control that tells you an attack happened, how far it got and what to fix.

Without logs there is no evidence. You cannot say which account was used, which files changed or when it started. Every later decision becomes a guess.

CIS Controls v8 gives this its own control, number 8, Audit Log Management. NIST CSF 2.0 calls it Continuous Monitoring (DE.CM). NIST SP 800-92 is the public guide to doing it well.

System Logs That Survive

Logs must survive a reboot. rsyslog and syslog-ng write to /var/log. The systemd journal keeps logs only in memory unless /var/log/journal exists.

Logs must also survive an attacker. Authentication logs hold user names, source addresses and sometimes passwords typed into the wrong field. Only administrators should read them.

Logs must not fill the disk. logrotate, or a SystemMaxUse limit for the journal, keeps them bounded. A full disk stops services and is itself an attack.

Where you can, send a copy to another machine. Logs that live only on the compromised server can be edited by whoever compromised it.

Auditing With auditd

Ordinary logs record what programs choose to say. The Linux audit daemon records what the kernel saw: a file opened, a permission changed, a privilege used.

Rules decide what auditd watches. Common choices are changes to /etc/passwd and /etc/shadow, use of sudo, and deletions by ordinary users.

Audit logs cost disk and attention. Start with a small rule set that answers the questions an investigation would ask, then grow it.

Time and Correlation

An investigation puts events from several sources in order. That only works if every clock agrees. A few minutes of drift can swap cause and effect.

chrony, ntpd or systemd-timesyncd keep the clock in step with public time servers. TLS certificates and one-time password codes also fail when the clock drifts.

From Logs to Action

A log-based blocker such as fail2ban, sshguard or CrowdSec reads the authentication log and blocks sources that fail repeatedly. The log becomes an active defence.

Sudo should log to its own file and use a pseudo-terminal, so every privileged command is recorded and sessions end cleanly.

SSH at LogLevel VERBOSE records the fingerprint of the key used for each login. That is how you learn which key, not just which user, opened the session.

In Summary

Logs are how you find out. Keep them after a reboot, keep them from other users, keep them bounded and keep the clock right. Add auditd for what the kernel sees. Let a blocker act on the log, and make sudo and SSH say who did what.

Apply It

These OpenVAPT checks put this module into practice. Open one to see its detection logic and source code.

Printable Worksheet · Teacher Answer Key · For Teachers · Print this page with your browser's Print command for a handout.

Also available as plain Markdown for notes, scripts and AI tools. Same facts, same source, no styling.

Lab

1. Run: openvapt demo --only HOST-LOG-,HOST-IDS-,HOST-TIME-,HOST-SSH-012 --out p16
2. For each failed check, write what question an investigator could no longer answer.
3. Run: openvapt explain HOST-LOG-003 and note that the check reads file metadata only, never log contents.
4. On your own machine: ls -l /var/log/auth.log /var/log/secure 2>/dev/null and timedatectl, then compare with the two checks.

Check Yourself

Answers are checked in your browser and never stored or sent.

References

• NIST SP 800-92, Guide to Computer Security Log Management
• NIST SP 800-53 Rev. 5, Security and Privacy Controls (AU family)
• auditd(8) manual
• RFC 5905, Network Time Protocol Version 4

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under Teaching With OpenVAPT. Pre-release material may be wrong or unstable; use at your own risk.

OpenVAPT. (2026). P16: Logging, Auditing and Time (Version 0.1.0-alpha.6). OpenVAPT Academy. Retrieved October 16, 2026, from https://openvapt.com/academy/p16.html

@misc{openvapt_p16,
  author       = {{OpenVAPT}},
  title        = {{P16: Logging, Auditing and Time}},
  year         = {2026},
  howpublished = {\url{https://openvapt.com/academy/p16.html}},
  note         = {OpenVAPT Academy, version 0.1.0-alpha.6. Accessed 16 October 2026}
}