For Teachers · Back to the Module · Print with your browser's Print command.

P16 Worksheet: Logging, Auditing and Time

Student Worksheet (about 20 minutes, Practitioner level)

Name: ______________________ Class: __________ Date: __________

Read first: P1, P15

Learning Objectives

• [ ] Explain why logging is a control in its own right, not an afterthought.
• [ ] Describe what makes logs useful after an incident: persistence, protection, rotation and correct time.
• [ ] Explain what the audit daemon records that ordinary logs do not.
• [ ] Explain how log-driven blocking and sudo and SSH logging settings turn records into defence.

Key Terms

Write each definition in your own words.

• Audit Log: ______________________________________________
• Log Rotation: ______________________________________________
• Time Synchronisation: ______________________________________________
• Intrusion Prevention: ______________________________________________
• Correlation: ______________________________________________
• Evidence: ______________________________________________

Lab Tasks

Use only the simulated lab or a machine your teacher has authorised.

1. Run: openvapt demo --only HOST-LOG-,HOST-IDS-,HOST-TIME-,HOST-SSH-012 --out p16
2. For each failed check, write what question an investigator could no longer answer.
3. Run: openvapt explain HOST-LOG-003 and note that the check reads file metadata only, never log contents.
4. On your own machine: ls -l /var/log/auth.log /var/log/secure 2>/dev/null and timedatectl, then compare with the two checks.

Self-Check Questions

1. What is lost when the systemd journal is kept only in memory?

• [ ] a) Nothing, the journal is copied to syslog automatically
• [ ] b) Every log entry from before the last reboot
• [ ] c) Only kernel messages
• [ ] d) Only messages from user services

1. Why should /var/log/auth.log not be readable by every user?

• [ ] a) It slows down logins
• [ ] b) It contains user names, source addresses and sometimes mistyped passwords
• [ ] c) It is needed only by auditd
• [ ] d) Reading it changes its timestamps

1. What does auditd record that rsyslog does not?

• [ ] a) Web server access lines
• [ ] b) Kernel-level events such as a file opened or a permission changed
• [ ] c) Package update progress
• [ ] d) Cron job output

1. Why does time synchronisation matter for an investigation?

• [ ] a) Events from different machines can be put in the right order
• [ ] b) It encrypts the logs
• [ ] c) It makes logs smaller
• [ ] d) It is required by logrotate

1. What does a log-based blocker such as fail2ban do?

• [ ] a) Deletes old log files
• [ ] b) Blocks sources that repeatedly fail to log in, based on the log
• [ ] c) Replaces the firewall
• [ ] d) Synchronises the clock

Reflection

Which finding from this module would matter most on a server you are responsible for, and why?

________________________________________________________________

Sources

• NIST SP 800-92, Guide to Computer Security Log Management: https://csrc.nist.gov/pubs/sp/800/92/final
• NIST SP 800-53 Rev. 5, Security and Privacy Controls (AU family): https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final
• auditd(8) manual: https://man7.org/linux/man-pages/man8/auditd.8.html
• RFC 5905, Network Time Protocol Version 4: https://www.rfc-editor.org/rfc/rfc5905.html

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under TEACHING.md. Please cite OpenVAPT: see CITING.md or openvapt.com/cite.html. OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk. If you adapt this material, say where you changed it.