Observe and back up
Read authentication and service logs
Use the system journal and authentication records to investigate access, failures, restarts, privilege use, and application behavior.
8 minute lesson
Logs show what the server observed. Learn the normal records before you need them during an incident.
Use journalctl by unit, time, priority, and boot. Review SSH and sudo events, service restarts, kernel messages, and application failures. Send important logs off the server so a compromise cannot erase the only copy.
sudo journalctl -u ssh --since todayA successful SSH login after many failures matters more than either event alone. Local logs help investigation, but an attacker with root may edit or erase them.
Synchronize clocks and preserve stable host identifiers. Without consistent time and source information, responders cannot reliably connect provider, firewall, SSH, and application events.
Generate a success, failure, sudo command, and service restart with known timestamps. Find each event locally and remotely, then stop log forwarding and prove the missing stream creates an alert.
Lesson completed