Endpoint Security Concepts · Topic 5 of 6
Interpreting System Logs and Spotting Anomalies
Learn to read Windows Event Viewer, audit, system and application logs and syslog, and to spot anomalies such as failed logins and wiped logs.
- 4 min
- System logs record operating system events, and application logs record program events.
- Security or audit logs record logins, failures and permission changes.
- Event Viewer is the Windows log tool.
What it is
A log is a time stamped record of something that happened on a device or application.
Logs tell you who did what, and when. They are the main evidence when you investigate a security problem, and they also help to prove that policies are followed.
This page covers where logs come from, how to read a few common entries, and what an abnormal pattern looks like.
How it works
Reading logs well means knowing the source, the key fields, and what normal looks like.
Types of log
| Log type | What it records |
|---|---|
| System | Events from the operating system, such as startup, shutdown and driver or service problems |
| Application | Events from programs, such as errors and crashes |
| Security or audit | Security related actions, such as logins, failed logins, permission changes and policy changes |
An audit log answers questions about accountability. It records who did an action, what they did, and whether it worked.
Most log entries hold the same core facts: a time stamp, the source device or program, a user or account name, an event type or ID, and a message. When you read an entry, find the who, what, when and where.
Windows Event Viewer
Event Viewer is the Windows tool for reading event logs. Under Windows Logs it includes the Application, Security, Setup and System logs.
Each event has a level, such as Information, Warning, Error or Critical, and an event ID. A few Security log event IDs are worth knowing:
| Event ID | Meaning |
|---|---|
| 4624 | An account logged on successfully |
| 4625 | An account failed to log on |
| 4720 | A user account was created |
| 1102 | The audit log was cleared |
Many 4625 events in a short time suggest a password guessing attack. A 4624 event right after many failures suggests that the guessing may have worked.
Linux logs and syslog
Linux systems keep logs as text files, usually under /var/log. Login and authentication events are often in /var/log/auth.log on Debian based systems and /var/log/secure on Red Hat based systems.
$ sudo tail -n 20 /var/log/auth.log
Mar 3 02:14:07 srv1 sshd[2210]: Failed password for root from 203.0.113.9 port 51022 ssh2This line shows a failed login attempt for the root account from a remote address at 02:14.
Syslog is a standard way to send log messages from devices to a central logging server. Network devices, servers and firewalls can all send syslog messages. Central collection means an attacker who takes over one device cannot easily erase the only copy of its logs.
Syslog messages carry a severity level from 0 to 7. A lower number is more serious.
| Level | Name |
|---|---|
| 0 | Emergency |
| 1 | Alert |
| 2 | Critical |
| 3 | Error |
| 4 | Warning |
| 5 | Notice |
| 6 | Informational |
| 7 | Debug |
On a Cisco IOS device, the show logging command displays the messages in its log buffer.
Identifying anomalies
An anomaly is something that differs from normal behaviour. To spot one, you need to know what normal looks like for that system. Typical warning signs are:
- many failed logins, especially followed by a success
- logins at unusual times or from unusual places
- a new administrator account that nobody requested
- logs that are cleared or stop suddenly
- unusual programs starting, or a service stopped that should be running
- large data transfers at odd hours
One strange event does not always mean an attack. Look for patterns, check the time line, and compare with other logs. If you think there is a real incident, follow the escalation process and keep the logs safe as evidence.
What to remember for the exam
Seven facts cover most questions on this topic.
- System logs record operating system events, and application logs record program events.
- Security or audit logs record logins, failures and permission changes.
- Event Viewer is the Windows log tool.
- Event ID 4625 is a failed logon and 4624 is a successful logon.
- Syslog sends log messages to a central server.
- Syslog severity 0 is the most serious, and 7 is debug.
- Many failed logins, odd hours, new accounts and cleared logs are anomalies.
A burst of failed logins followed by a success from the same source is a classic sign of a guessing attack that worked.
Common mistakes
These four errors are common.
Reading syslog severity backwards. Level 0 is the most serious, not the least.
Ignoring a single cleared log. A cleared audit log is a warning sign that someone may be hiding activity.
Keeping logs only on the device itself. A compromised device can have its logs altered or erased.
Judging without a baseline. You cannot call something abnormal until you know what normal is.
Do not delete or edit logs during an investigation. They may be needed as evidence.
Check yourself
Work through these three questions.
Which Windows event ID shows a failed logon?
Event ID 4625. Many of them in a short time suggest a password guessing attack.
Why send logs to a central syslog server?
A central copy stays safe if one device is compromised, and it lets analysts review events from many devices in one place.
Which syslog severity level is the most serious?
Level 0, which is Emergency.
Topic 5 of 6 in Endpoint Security Concepts
Test yourself on Endpoint Security Concepts
The full Cisco CCST 100-160 Cybersecurity question bank has 864 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.