Incident Detection · Topic 3 of 4
Logging Concepts and Windows, Linux and Mac Logs
Learn logging concepts, syslog severity levels, key Windows event IDs, Linux log files and macOS unified logging for incident detection on CND 312-38.
- 5 min
- 4624 is a logon, 4625 a failed logon, 4720 a new account, 4740 a lockout and 1102 a cleared audit log.
- Syslog uses UDP/TCP 514 and severity runs from 0 (Emergency) to 7 (Debug).
/var/log/auth.logor/var/log/securehold Linux authentication events.
What it is
A log is a time stamped record of an event on a system, device or application. Logs answer who did what, when, from where and with what result.
Log monitoring turns these records into detection. A defender must know what to log, where each operating system keeps its logs, and which entries signal trouble.
How it works
Logging concepts
| Concept | Meaning |
|---|---|
| Log source | System, device or application that creates logs |
| Log entry fields | Timestamp, source, user, event type, result, and detail |
| Syslog | Standard for sending log messages to a server. UDP 514, TCP 514, and TLS 6514 |
| Facility | Which part of the system produced the message (for example kernel or auth) |
| Severity | Level 0 to 7 (below) |
| Retention | How long logs are kept, set by policy and regulation |
| Integrity | Logs must be protected from change or deletion |
Syslog severity levels, from most to least severe:
| Level | Name |
|---|---|
| 0 | Emergency |
| 1 | Alert |
| 2 | Critical |
| 3 | Error |
| 4 | Warning |
| 5 | Notice |
| 6 | Informational |
| 7 | Debug |
Good logging practice: synchronize time with NTP, log security relevant events (logons, privilege changes, policy changes, log clearing), send logs to a separate protected server so an intruder cannot erase them, restrict access, and keep them as long as policy requires.
Log monitoring on Windows
Windows records events in Event Viewer under these main logs: Application, Security, System, Setup and Forwarded Events. The Security log is the most important for detection.
| Event ID | Meaning |
|---|---|
| 4624 | Successful logon |
| 4625 | Failed logon |
| 4634 | Logoff |
| 4648 | Logon using explicit credentials |
| 4672 | Special privileges assigned to a new logon (admin logon) |
| 4688 | A new process was created |
| 4720 | A user account was created |
| 4722 | A user account was enabled |
| 4724 | An attempt was made to reset a password |
| 4726 | A user account was deleted |
| 4728 and 4732 | A member was added to a security enabled group (global or local) |
| 4740 | A user account was locked out |
| 4768 and 4769 | Kerberos ticket granting ticket and service ticket requests |
| 4776 | The domain controller attempted to validate credentials (NTLM) |
| 1102 | The Security audit log was cleared |
| 7045 | A new service was installed (System log) |
Patterns to watch: many 4625 events then a 4624 suggests a brute force that succeeded, 4720 followed by 4732 suggests a new account added to a privileged group, and 1102 suggests an intruder covering tracks. Windows Event Forwarding can send events to a central collector.
Log monitoring on Linux
| File | Content |
|---|---|
/var/log/auth.log (Debian, Ubuntu) or /var/log/secure (Red Hat family) | Authentication, sudo and SSH events |
/var/log/syslog or /var/log/messages | General system messages |
/var/log/kern.log | Kernel messages |
/var/log/wtmp and /var/log/btmp | Successful and failed logins, read with last and lastb |
/var/log/lastlog | Last login of each user |
/var/log/audit/audit.log | Linux Audit (auditd) records |
/var/log/cron | Scheduled job activity (location varies) |
On systems with systemd, the journal is read with journalctl. Signs of trouble include repeated failed SSH logins, a successful login from an unexpected address, sudo use by an unusual account, new cron jobs, and modified or truncated log files.
Log monitoring on macOS
macOS uses unified logging, which stores logs from the system and apps in a compact, structured store. Read it with the Console application or the log command-line tool. Older plain text logs such as /var/log/system.log and /var/log/install.log may still exist on some versions. macOS also has an audit facility (BSM) that writes audit records, normally under /var/audit.
Items to review: authentication and sudo events, Gatekeeper and XProtect messages, software installation, and launch daemon or launch agent changes used for persistence.
A worked example
On a Windows server the Security log shows 4625 events for the Administrator account, 200 of them in two minutes from one address, followed by one 4624 from the same address. Soon after, a 4720 event creates a new account and a 4732 event adds it to the local Administrators group.
The sequence shows a successful brute force and creation of a backdoor account. The defender isolates the server, disables the new account, resets passwords and starts incident response.
How the exam asks about this
- "Which Windows event ID records a failed logon?" → 4625.
- "Which Linux file records authentication events on Debian based systems?" →
/var/log/auth.log. - "Which syslog severity level is 'Emergency'?" → 0.
What to remember for the exam
- 4624 is a logon, 4625 a failed logon, 4720 a new account, 4740 a lockout and 1102 a cleared audit log.
- Syslog uses UDP/TCP 514 and severity runs from 0 (Emergency) to 7 (Debug).
/var/log/auth.logor/var/log/securehold Linux authentication events.- macOS uses unified logging, read with Console or the
logtool. - Send logs to a separate protected server and synchronize time.
Clearing the log is a classic attacker step. Treat event 1102 or a log file that suddenly shrinks as an alert on its own.
Common mistakes
Keeping logs only on the local machine. An intruder with admin rights can delete them.
Memorizing event IDs without the pattern. One 4625 is noise, while hundreds followed by a 4624 is an incident.
Ignoring time differences. Without NTP, events from different systems cannot be lined up.
Check yourself
Which event ID shows the Security log was cleared?
1102.
Where does Linux store failed login records read by
lastb?/var/log/btmp.Why forward logs to a central server?
So an intruder cannot erase evidence on the compromised host and analysts can correlate events.
Topic 3 of 4 in Incident Detection
Test yourself on Incident Detection
The full EC-Council 312-38 question bank has 800 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.