Lesson 1.10: Where the logs live
Every alert is built from logs, and every investigation ends up reading them. Linux keeps text logs under /var/log and in the systemd journal; web servers write one line per request; firewalls log what they block; Windows writes structured events identified by numbers. Each has its own format, and the skill is knowing which source answers which question. In the lab you read four sources from one night: SSH failures, web requests, firewall blocks and Windows logon failures, and find the same pattern in each.
17 min
You will learn to
- Name the main log sources and where they live
- Read syslog-style lines
- Read the web server's combined log format
- Read firewall block logs
- Query Windows events exported as JSON
Key terms
- Syslog
- The classic Unix logging format and protocol: timestamp, host, program[pid]: message.
- systemd journal
- Linux's structured log store, read with journalctl.
- Access log
- One line per web request: client IP, time, request, status code, size, referrer, user agent.
- Windows Event Log
- Structured events in channels (Security, System, Application, Sysmon…), each with a numeric Event ID.
- Log retention
- How long logs are kept.
← Anatomy of a web application · All lessons · IAM and least privilege →