Log Management · Topic 2 of 5
Windows, Linux and Mac Logs
Learn Windows event logs, key event IDs and logon types, Sysmon, Linux log files under /var/log and macOS unified logging for SOC analysis on CSA 312-39.
- 5 min
- 4624 success, 4625 failure, 4688 process created, 4720 account created, 4740 lockout, 1102 log cleared.
- Logon type 2 is interactive, 3 network, 10 Remote Desktop.
- Sysmon 1 is process creation, 3 network connection, 10 process access, 22 DNS query.
What it is
Each operating system records security events in its own place and format. Windows uses binary event logs, Linux writes text files under /var/log and the systemd journal, and macOS uses unified logging.
A SOC analyst must know where each log lives, which entries matter and which patterns signal an attack.
How it works
Windows event logs
Windows stores logs as .evtx files in C:\Windows\System32\winevt\Logs and shows them in Event Viewer. The main logs are Application, Security, Setup, System and Forwarded Events. Other logs, such as PowerShell and Sysmon, sit under Applications and Services Logs.
| Event ID | Log | Meaning |
|---|---|---|
| 4624 | Security | An account successfully logged on |
| 4625 | Security | An account failed to log on |
| 4634 | Security | An account was logged off |
| 4648 | Security | Logon attempted using explicit credentials |
| 4672 | Security | Special privileges assigned to new logon |
| 4688 | Security | A new process has been created |
| 4697 | Security | A service was installed in the system |
| 4698 | Security | A scheduled task was created |
| 4720 | Security | A user account was created |
| 4732 | Security | A member was added to a security enabled local group |
| 4740 | Security | A user account was locked out |
| 4768 and 4769 | Security | Kerberos TGT and service ticket requested |
| 4776 | Security | Credentials validated with NTLM |
| 1102 | Security | The audit log was cleared |
| 7045 | System | A new service was installed |
| 4104 | PowerShell Operational | Script block logging recorded script content |
Logon types
Events 4624 and 4625 include a logon type that says how the logon happened.
| Type | Name | Example |
|---|---|---|
| 2 | Interactive | Keyboard logon at the console |
| 3 | Network | Access to a shared folder over SMB |
| 4 | Batch | Scheduled task |
| 5 | Service | A service starting under an account |
| 7 | Unlock | Unlocking the workstation |
| 8 | NetworkCleartext | Credentials sent in clear text, such as IIS basic authentication |
| 9 | NewCredentials | RunAs with the /netonly option |
| 10 | RemoteInteractive | Remote Desktop (RDP) |
| 11 | CachedInteractive | Logon with cached domain credentials |
For a 4625 failure, the status code helps triage. 0xC000006A means a wrong password for a valid user, and 0xC0000064 means the user name does not exist. Many 0xC0000064 codes suggest an attacker guessing account names.
Sysmon
System Monitor (Sysmon), a free Microsoft Sysinternals tool, adds detailed events to the Microsoft-Windows-Sysmon/Operational log:
| Sysmon ID | Event |
|---|---|
| 1 | Process creation, with full command line and hashes |
| 3 | Network connection |
| 7 | Image loaded |
| 8 | CreateRemoteThread (a sign of code injection) |
| 10 | ProcessAccess (for example, access to lsass.exe) |
| 11 | File created |
| 13 | Registry value set |
| 22 | DNS query |
Linux logs
| Location | Content |
|---|---|
/var/log/auth.log (Debian, Ubuntu) | Authentication, sudo and SSH events |
/var/log/secure (Red Hat family) | The same, on Red Hat based systems |
/var/log/syslog (Debian) or /var/log/messages (Red Hat) | General system messages |
/var/log/kern.log | Kernel messages |
/var/log/wtmp and /var/log/btmp | Successful and failed logins, read with last and lastb |
/var/log/lastlog | Most recent login of each user, read with lastlog |
/var/log/audit/audit.log | Linux Audit daemon (auditd) records |
/var/log/cron or the syslog file | Scheduled job activity |
Systems running systemd also keep a binary journal read with journalctl. A typical SSH brute force shows many lines of "Failed password for" one user from one address, then "Accepted password for" from the same address.
macOS logs
macOS uses unified logging, a compressed, structured store for system and app messages. Analysts read it with the Console app or the log command, for example log show --last 1h.
Some text logs still exist, such as /var/log/install.log for software installs, along with app logs under /Library/Logs and ~/Library/Logs. Items to watch: authentication and sudo use, new launch agents and launch daemons (a common persistence method), and Gatekeeper or XProtect messages.
A worked example
A domain controller shows 4625 events with logon type 3 and status 0xC000006A for 40 different accounts, each tried once or twice from the same workstation in ten minutes. Then a 4624 type 3 succeeds for one account, followed by 4672 for that account.
One password tried across many accounts is password spraying. The 4672 means the compromised account has administrative privileges, so the analyst escalates at high priority and asks for the account to be disabled.
How the exam asks about this
- "Which logon type appears in event 4624 when a user connects with Remote Desktop?" → Type 10.
- "Which file holds SSH authentication events on a Red Hat based system?" →
/var/log/secure. - "Which Windows event ID records process creation in the Security log?" → 4688.
What to remember for the exam
- 4624 success, 4625 failure, 4688 process created, 4720 account created, 4740 lockout, 1102 log cleared.
- Logon type 2 is interactive, 3 network, 10 Remote Desktop.
- Sysmon 1 is process creation, 3 network connection, 10 process access, 22 DNS query.
- Linux authentication goes to
/var/log/auth.log(Debian) or/var/log/secure(Red Hat). - macOS uses unified logging, read with Console or
log show.
Event 4688 records the command line only when the "Include command line in process creation events" policy is enabled. Sysmon event 1 records it by default, which is one reason SOCs deploy Sysmon.
Common mistakes
Mixing up 4624 and 4625. The lower number is the success. A run of 4625s followed by one 4624 is the classic brute force pattern.
Ignoring logon type. A type 10 logon to a database server at 3 a.m. is far more suspicious than a type 3 file share access.
Looking for auth.log on every Linux system. Red Hat based systems use /var/log/secure.
Check yourself
What does status code
0xC0000064in event 4625 mean?The user name does not exist, which suggests account name guessing.
Which commands read the Linux login records in wtmp and btmp?
lastreads successful logins in wtmp, andlastbreads failed logins in btmp.Which Sysmon event can reveal credential dumping from memory?
Event 10, ProcessAccess, when a process opens lsass.exe.
Topic 2 of 5 in Log Management
Test yourself on Log Management
The full EC-Council 312-39 question bank has 700 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.