Each operating system (OS) or networking device will maintain log files. We must know where to locate these, access them, and understand what they tell us.  There is not one standard format for log files - this makes this task challenging as you may need to be able to learn and research the structure of the log file. 

Remember that Linux OS maintains most of its logs in /var/log. However, some services might be saved to another location, and you might have to read the configuration file to learn about this location. Linux stores its log files in plain text, so use your favorite utility to view them.  If by chance you come across a file that is compressed using gzip you do not need to uncompress the file - use zcat!

Windows will save log files in Windows\System32\winevt\Logs\. Windows log files will have an evtx file extension. To view Windows Events, you can use the eventvwr utility. Most of the time, Windows will record data for the following event types:

• System - contains information about incidents related to the OS.

• Application - contains information about errors from installed software.

• Setup - contains information about installation events.

• Security - contains data about security events.

The Apache Access Log File is well-defined and can be broken into 8 key data points.

1. Client IP Address - who made the request

2. Identity of the client (most of the time, this is a hyphen and should not be relied on)

3. User ID of who made the request

4. Timestamp (Date & Time)

5. The Request Type and Requested Data

6. HTTP Status Code

7. The size of the object Returned

8. User-agent 

Example:

166.122.90.192 - - [12/Apr/2024:20:55:58 +0000] "GET / HTTP/1.1" 200 2288 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:124.0) Gecko/20100101 Firefox/124.0"

1. Client IP - 166.122.90.192

2.  Identity of Client - the hyphen

3. User ID - the second hyphen

4. Timestamp - [12/Apr/2024:20:55:58 +0000]

5. Request Type and Requested Data -  GET / HTTP/1.1

6. HTTP Status Code - 200

7. Size of Object Returned - 2288

8. User Agent - Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:124.0) Gecko/20100101 Firefox/124.0

Performing log file analysis can provide a great deal of information. By looking through a log file, you can determine if someone is scanning or has scanned a system with a vulnerability scanner or a port scanner, attempted an SQL Injection, or made a normal request. It is important to understand log files and analyze them from a security standpoint—you need to know what happened!