Defensive › Module 5 › Lesson 1
What to Log
Authentication, changes, and failures — plan logging on $LAB_HOST only.
Visual · what_to_log
Logging targets literacy. $LAB_HOST only. Original Cyberlium.
Opening
Log what answers who, what, when, where — on systems you operate, not strangers you spy on.
Defenders log authentication success and failure, privilege changes, service start/stop, firewall changes, and application errors on owned systems. Enough context to investigate; not every keystroke on unrelated users. Cyberlium teaches logging categories on $LAB_HOST — not deploying agents on classmate laptops or scraping café DHCP logs. Next: Retention and Privacy.
1. High-value event categories
AuthN/AuthZ: logins, lockouts, sudo, group changes. System: service changes, patch install, driver load. Network: firewall rule changes, DNS anomalies on owned resolver.
On $LAB_HOST, read what is already logged before enabling new channels.
Command guide
Try these commands — High-value event categories
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST log guide — https://csrc.nist.gov/publications/detail/sp/800-92/final Elastic logging — https://www.elastic.co/guide/en/welcome-to-elastic/current/getting-started-observability.html
═══ INSTALL ═══
Linux (Debian/Ubuntu):
macOS:
Windows:
═══ LINUX / macOS ═══
Command — copy this
journalctl -n 30 --no-pager 2>/dev/null | head -20 || tail -20 /var/log/syslog 2>/dev/null || echo 'Review what YOUR host logs' journalctl -n 50 --no-pager 2>/dev/null | grep -iE 'auth|sudo|fail' | head -10 || grep -i auth /var/log/auth.log 2>/dev/null | tail -5
Primary tools to practice this lesson: journalctl, grep. Reference sites: NIST log guide (https://csrc.nist.gov/publications/detail/sp/800-92/final); Elastic logging (https://www.elastic.co/guide/en/welcome-to-elastic/current/getting-started-observability.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Signal vs noise
Logging everything to disk fills storage and hides incidents. Defenders prioritize actionable events with correlation IDs and timestamps.
Verbose debug on production stranger systems without ticket is out of scope — and may capture others' data illegally.
3. Lab logging boundary
Enable or verify one additional category on $LAB_HOST if brief allows — e.g., audit auth failures. Never log neighbor network traffic 'for practice.'
Ship: logging category plan for $LAB_HOST. Next: Retention and Privacy.
4. What you ship: logging category plan for $LAB_HOST
List auth, change, and failure events to log on YOUR host. No stranger surveillance. chmod 600.
5. What you record before the next lesson
Date. Logging categories for $LAB_HOST. File t16-m05-l01-what-to-log.txt chmod 600.
6. Wrong vs right: stranger hosts vs YOUR lab hosts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Deploy syslog forwarder on classmate PC. Capture all café Wi-Fi traffic to PCAP 'for SIEM practice.'
Right
Plan log categories on $LAB_HOST. Next: Retention and Privacy.
Mission: logging category plan
1) List three high-value event types for $LAB_HOST. 2) Read current logging config (read-only). 3) No logging on stranger systems. Never surveil people outside your RoE.
Stuck? Ask Cyberlium AI Mentor
Auth failures plus source IP on owned lab teach detection without touching strangers.
Knowledge Check
APPLY: High-value logs on owned hosts often include:
Multiple choice
Knowledge Check
APPLY: True or False: Logging neighbor traffic is Cyberlium homework.
True or False
Knowledge Check
APPLY: Log everything always:
Multiple choice