Log Files

Overview

Evidence: Log Files Description: Collect Log Files Category: System Platform: Linux Short Name: logfiles Is Parsed: Yes Sent to Investigation Hub: Yes Collect File(s): No

Background

Linux log files provide comprehensive records of system events, application activities, and security events. This data is essential for understanding system behavior, detecting security incidents, and reconstructing timelines of events.

Data Collected

This collector gathers structured data about log files.

Log Files Data

Field	Description	Example
ID	Primary key (auto-increment)	1
Path	Log file path	/var/log/syslog
Size	File size in bytes	1024000
Modified	Last modified time	2023-10-15 14:30:25
Permissions	File permissions	644
Owner	File owner	syslog
Group	File group	adm

Collection Method

This collector parses the necessary data from the log_files table.

This collector collects files from the following locations:

• /var/log/

Usage

This evidence is crucial for forensic investigations as it provides comprehensive system activity records. It helps investigators detect system-level attacks, analyze security events, and reconstruct system incidents. The data can reveal system errors, security events, and unauthorized system modifications. Analysts can use this information to identify system compromises, trace malicious activities, and assess Linux security posture.

Notes

This data may contain sensitive information that should be handled according to data protection requirements. Ensure proper chain of custody is maintained during collection and analysis.