--- title: "P16: Logging, Auditing and Time" canonical: https://openvapt.com/academy/p16.html html: https://openvapt.com/academy/p16.html site: OpenVAPT, https://openvapt.com/ license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html modified: 2026-10-16 version: 0.1.0-alpha.6 --- # P16: Logging, Auditing and Time How logs, the audit daemon, synchronised time and log-driven blocking turn a server from a black box into something you can investigate and defend. - Level: Practitioner - Time: about 20 minutes - Read first: P1, P15 ## You Will Be Able To - Explain why logging is a control in its own right, not an afterthought. - Describe what makes logs useful after an incident: persistence, protection, rotation and correct time. - Explain what the audit daemon records that ordinary logs do not. - Explain how log-driven blocking and sudo and SSH logging settings turn records into defence. ## Why Logs Are a Control Most controls try to stop an attack. Logs are the control that tells you an attack happened, how far it got and what to fix. Without logs there is no evidence. You cannot say which account was used, which files changed or when it started. Every later decision becomes a guess. CIS Controls v8 gives this its own control, number 8, Audit Log Management. NIST CSF 2.0 calls it Continuous Monitoring (DE.CM). NIST SP 800-92 is the public guide to doing it well. ## System Logs That Survive Logs must survive a reboot. rsyslog and syslog-ng write to /var/log. The systemd journal keeps logs only in memory unless /var/log/journal exists. Logs must also survive an attacker. Authentication logs hold user names, source addresses and sometimes passwords typed into the wrong field. Only administrators should read them. Logs must not fill the disk. logrotate, or a SystemMaxUse limit for the journal, keeps them bounded. A full disk stops services and is itself an attack. Where you can, send a copy to another machine. Logs that live only on the compromised server can be edited by whoever compromised it. ## Auditing With auditd Ordinary logs record what programs choose to say. The Linux audit daemon records what the kernel saw: a file opened, a permission changed, a privilege used. Rules decide what auditd watches. Common choices are changes to /etc/passwd and /etc/shadow, use of sudo, and deletions by ordinary users. Audit logs cost disk and attention. Start with a small rule set that answers the questions an investigation would ask, then grow it. ## Time and Correlation An investigation puts events from several sources in order. That only works if every clock agrees. A few minutes of drift can swap cause and effect. chrony, ntpd or systemd-timesyncd keep the clock in step with public time servers. TLS certificates and one-time password codes also fail when the clock drifts. ## From Logs to Action A log-based blocker such as fail2ban, sshguard or CrowdSec reads the authentication log and blocks sources that fail repeatedly. The log becomes an active defence. Sudo should log to its own file and use a pseudo-terminal, so every privileged command is recorded and sessions end cleanly. SSH at LogLevel VERBOSE records the fingerprint of the key used for each login. That is how you learn which key, not just which user, opened the session. ## In Summary Logs are how you find out. Keep them after a reboot, keep them from other users, keep them bounded and keep the clock right. Add auditd for what the kernel sees. Let a blocker act on the log, and make sudo and SSH say who did what. ## Apply It - [HOST-IDS-001 No Brute-Force Protection Service](https://openvapt.com/checks/HOST-IDS-001.md) (low) - [HOST-LOG-001 System Logging Not Persistent](https://openvapt.com/checks/HOST-LOG-001.md) (low) - [HOST-LOG-002 Security Audit Daemon Not Running](https://openvapt.com/checks/HOST-LOG-002.md) (low) - [HOST-LOG-003 Security Logs Readable by All Users](https://openvapt.com/checks/HOST-LOG-003.md) (low) - [HOST-LOG-004 Log Rotation Not Configured](https://openvapt.com/checks/HOST-LOG-004.md) (low) - [HOST-SSH-012 SSH Logging Level Too Low](https://openvapt.com/checks/HOST-SSH-012.md) (low) - [HOST-SUDO-001 Sudo Commands Not Logged to a Dedicated File](https://openvapt.com/checks/HOST-SUDO-001.md) (low) - [HOST-TIME-001 Time Synchronisation Not Active](https://openvapt.com/checks/HOST-TIME-001.md) (low) ## Lab 1. `Run: openvapt demo --only HOST-LOG-,HOST-IDS-,HOST-TIME-,HOST-SSH-012 --out p16` 2. `For each failed check, write what question an investigator could no longer answer.` 3. `Run: openvapt explain HOST-LOG-003 and note that the check reads file metadata only, never log contents.` 4. `On your own machine: ls -l /var/log/auth.log /var/log/secure 2>/dev/null and timedatectl, then compare with the two checks.` ## Check Yourself Answer keys are public for every channel (see Teaching With OpenVAPT). 1. What is lost when the systemd journal is kept only in memory? - A. Nothing, the journal is copied to syslog automatically - B. Every log entry from before the last reboot - C. Only kernel messages - D. Only messages from user services - Answer: B. Without /var/log/journal the journal is volatile and a reboot erases the evidence. 2. Why should /var/log/auth.log not be readable by every user? - A. It slows down logins - B. It contains user names, source addresses and sometimes mistyped passwords - C. It is needed only by auditd - D. Reading it changes its timestamps - Answer: B. Authentication logs are sensitive data; only administrators should read them. 3. What does auditd record that rsyslog does not? - A. Web server access lines - B. Kernel-level events such as a file opened or a permission changed - C. Package update progress - D. Cron job output - Answer: B. auditd records what the kernel saw, independent of what programs choose to log. 4. Why does time synchronisation matter for an investigation? - A. Events from different machines can be put in the right order - B. It encrypts the logs - C. It makes logs smaller - D. It is required by logrotate - Answer: A. Correlation across sources only works when every clock agrees. 5. What does a log-based blocker such as fail2ban do? - A. Deletes old log files - B. Blocks sources that repeatedly fail to log in, based on the log - C. Replaces the firewall - D. Synchronises the clock - Answer: B. It reads failures from the log and adds temporary firewall blocks, turning the log into defence. ## Key Terms - Audit Log: A record written by the kernel's audit system of security-relevant events, such as a file opened or a privilege used. - Log Rotation: Regularly closing, compressing and eventually deleting old log files so logs stay readable and never fill the disk. - Time Synchronisation: Keeping a machine's clock in step with trusted time servers, so events on different systems can be ordered correctly. - Intrusion Prevention: Automatically blocking a source after repeated suspicious behaviour, for example failed logins seen in the log. - Correlation: Putting events from several logs or machines together in time order to see one incident as a whole. - Evidence: The observed data, such as a configuration line, that supports a finding. ## References - [NIST SP 800-92, Guide to Computer Security Log Management](https://csrc.nist.gov/pubs/sp/800/92/final) - [NIST SP 800-53 Rev. 5, Security and Privacy Controls (AU family)](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final) - [auditd(8) manual](https://man7.org/linux/man-pages/man8/auditd.8.html) - [RFC 5905, Network Time Protocol Version 4](https://www.rfc-editor.org/rfc/rfc5905.html) Offline: `openvapt learn P16`. --- OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/academy/p16.html. Part of OpenVAPT Academy. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.