Log management basics: syslog and the Windows event log
You learn where logs come from, how they are formatted and why they are kept; you read Linux and Windows records, align time and find events with simple questions.
Level 101 · 14 lessons · 15 practice labs
Lessons
What logs are
- Why logs are kept: detection, investigation, compliance
- Anatomy of a log line: time, source, event, fields
- Formats: plain text, syslog, JSON, CEF
- Time sync and time zones: NTP and UTC
- Short task: match the same event in three different formats
Linux logs
- syslog: facilities and severities
- auth.log and secure: logins and sudo
- Filtering with journalctl: unit, time, priority
- Web server access logs
- Short task: count yesterday’s failed logins by source IP
Windows logs
- The Windows event log: Security, System, Application
- Event IDs you should know
- Retention, rotation and integrity
- Capstone: tell the story of a session from Linux and Windows logs
Practice labs
- Split this log line into its fields: Separate the time, host, program and message in the given syslog line and label each one.
- Match the same event in three different formats: Find the three lines describing the same login among plain text, JSON and CEF records.
- Order events shifted by a time zone difference: Put the records of two servers, one logging in UTC and one in local time, on a single timeline.
- Identify the server with the wrong clock from the logs: Compare three servers’ records of the same connection and find the one with a skewed clock and by how much.
- Count failed logins in auth.log by source address: Count failed SSH logins with grep, awk and sort and list the top three sources.
- Pull a service’s errors from yesterday with journalctl: Combine unit, time range and priority filters to show only the relevant error lines.
- Find the scanning client in a web access log: Count 404 responses per client and identify the address trying the most distinct paths and the tool it used.
- Extract an unauthorised command attempt from sudo records: Filter sudo lines in auth.log and find the user who tried a command that was not allowed.
- Pick the successful attack request out of an access log: Among thousands of failed attempts find the request that returned 200 with an unusual response size.
- Match event IDs with what they mean: Recognise logon, account creation and log clearing events by their IDs in ten given records.
- Find the new account in a Security log exported as JSON: Filter 4720 and 4732 records with jq and note the created account and the group it joined.
- Show the log was cleared and what happened before it: Find the 1102 record and work out from the logon and process events just before it what the clearing account did.
- Build a week’s timeline across rotated and compressed logs: Order one user’s logins and sudo activity for a week from the journal, auth.log and compressed older files, correcting for time zone.
- Convert records in three formats to common fields: Extract time, user, source and outcome from syslog, JSON and key-value login records into one table.
- Write a script that parses malformed and multi-line records: Write a script that turns records with missing fields, mixed date formats and line breaks into a common schema and report the count it cannot parse.
About this course
You learn where logs come from, how they are formatted and why they are kept; you read Linux and Windows records, align time and find events with simple questions.
What you will learn
- What logs are
- Linux logs
- Windows logs
Prerequisites
No prior knowledge is needed; the course starts from zero.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at beginner level; every term is explained where it first appears.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.