Logging Lab

Logging pack on $LAB_HOST — categories, retention, one alert rule.

Logging Lab• Audio Walkthrough

00:00/02:37

Visual · logging_lab

Lab: logging policy pack. $LAB_HOST only. Original Cyberlium.

Policy on paper, logs on YOUR host, chmod 600 on the proof.

Module 5 lessons covered what to log, retention/privacy, and alert hygiene. This lab ships a combined logging policy pack for $LAB_HOST: categories, retention days, privacy lines, one alert rule with runbook stub. Optional: verify one log source is enabled on lab. Next: Quiz — Logging Fundamentals.

1. Lab contract: assemble the pack

Merge lessons 5-1 through 5-3 into one file under $HOME/cyberlium-lab. Verify hostname $LAB_HOST on every section.

Optional: enable or verify Windows Security log / Linux auth log capture on lab.

Command guide

Try these commands — Lab contract: assemble the pack

═══ LINUX / KALI (Penetration Testing & Service Audit) ═══

Port scan and service banner grabbing against authorized target

Command — copy this

nmap -sV -sC -Pn -T4 -p 21,22,80,443,445,3389 ${LAB_HOST:-127.0.0.1}

Enumerate web directories and hidden endpoints

Command — copy this

gobuster dir -u http://${LAB_HOST:-127.0.0.1} -w /usr/share/wordlists/dirb/common.txt -q -t 20 2>/dev/null || head -5 /etc/hosts

Metasploit framework module inspection (Safe lab syntax)

Command — copy this

msfconsole -q -x "use auxiliary/scanner/portscan/tcp; set RHOSTS 127.0.0.1; set PORTS 80,443; run; exit" 2>/dev/null || echo "Run in Kali msfconsole"

═══ WINDOWS (Audit Target) ═══ Enumerate open listening ports with process mappings

Command — copy this

netstat -ano | findstr /i "LISTENING"

Primary tools to practice this lesson: journalctl, python3. Reference sites: Logging lab (https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html); Elastic observability (https://www.elastic.co/guide/en/welcome-to-elastic/current/getting-started-observability.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Forbidden

Forward logs from classmate machines, PCAP all café traffic, publish raw logs publicly, SIEM on stranger data.

3. Close

chmod 600. Quiz next — then Windows and Linux Logs.

4. What you ship: logging policy pack for $LAB_HOST

Categories, retention, privacy, alert rule. Optional log source verify. chmod 600.

5. What you record before the next lesson

Date. Logging pack complete on $LAB_HOST. File t16-m05-l04-logging-lab.txt chmod 600.

6. Wrong vs right: stranger hosts vs YOUR lab hosts

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Include neighbor DHCP logs. Skip privacy lines.
Right: Logging pack on $LAB_HOST. Next: Quiz — Logging Fundamentals.

Hands-on Exercise

Mission: logging evidence pack

1) Merge category, retention, alert sections. 2) Verify $LAB_HOST on each line. 3) Optional log source check. 4) chmod 600. Never log stranger systems.

Pro Tip

Stuck? Ask Cyberlium AI Mentor

A one-page policy beats a SIEM you aim at strangers.

Practice QuizQuestion 1

Multiple choice

APPLY: Logging Lab pack includes:

Practice QuizQuestion 2

True or False

APPLY: True or False: chmod 600 applies to logging policy notes.

Practice QuizQuestion 3

Multiple choice

APPLY: Forwarding logs from PC you do not own: