SYO-601 Log files

Routers, switches and similar devices can log messages and forward them to a syslog server.

hardware changes

driver updates

system startup and shutdown events

errors.

[eventvwr.msc] "Windows Logs" -> "Application"

Identifying software crashes.

Monitoring application performance.

Tracking application installation and startup issues.

[eventvwr.msc] "Windows Logs" -> "Security"

Records security-related events such as login attempts, resource access, and changes to security settings.

Essential for auditing and monitoring system security.

Audit Success: Indicates successful completion of a security event (e.g., successful login).

Audit Failure: Indicates failed attempts to complete a security event (e.g., failed login attempts).

Linux -- /var/log/
Windows -- C:\inetpub\logs\LogFiles\

Record HTTP requests and responses between clients (browsers) and the web server.

Useful for monitoring web traffic, diagnosing issues, and security analysis.

Access Logs: Track all requests to the web server, including details such as timestamp, client IP address, requested URL, HTTP method, response status code, and user agent.

Error Logs: Record errors encountered by the web server, such as failed requests, server errors, and issues with server configuration.

Monitoring, Forensics, Compliance.
Performance, Security, User Behavior.

Linux -- /var/log
Windows -- %SystemRoot%\System32\DNS\

Record DNS queries and responses between clients and the DNS server.

Useful for monitoring DNS activity, diagnosing issues, and security analysis.

Query Logs: Track all DNS queries made to the DNS server, including details such as timestamp, client IP address, requested domain, and query type.

Response Logs: Record the responses sent by the DNS server, including response codes and the IP addresses returned.

Error Logs: Record errors encountered by the DNS server, such as failed queries, server errors, and issues with DNS resolution.

Monitoring: Detect unauthorized or suspicious DNS queries that may indicate malware, data exfiltration, or domain generation algorithm (DGA) activity.

Forensics: Analyze logs to trace the actions of an attacker during a security incident.

Compliance: Ensure logging practices meet regulatory requirements for data retention and monitoring.

Windows -- see 'security logs'

Linux -- /var/log/auth.log, or var/log/secure

Logins, Logouts, lockouts, privilege escalation (use of sudo).

Created when an application crashes, recording information that can be used to fix the issue.

VoIP and Call Manager logs record information about VoIP calls performed on the sytem.

Session Initiation Protocol (SIP) logs record information about VoIP calls and videoconferencing performed on the network.