0Pricing
Cyber Security Academy · Lesson

Log Sources: OS, Network, and Application Logs

Understand what Windows Event Logs, syslog, Apache/Nginx logs, and firewall logs contain.

Log Sources: OS, Network, and Application Logs is a free Cyber Security Academy lesson on CoddyKit — lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Why Logs Matter

Logs are the primary evidence source for security investigations. Every login, network connection, and application action leaves a trace. Without logs, attacks are invisible and forensic reconstruction is impossible.

Windows Event Logs

Windows organizes logs into channels: Security, System, Application, and custom application channels. The Security log contains authentication, access control, and audit events — most important for security analysis.

# View Windows Event Logs
# Event Viewer (GUI): eventvwr.msc

# PowerShell
Get-EventLog -LogName Security -Newest 50
Get-WinEvent -LogName Security | Where-Object {$_.Id -eq 4625}

# Key Security Event IDs:
# 4624: Logon success
# 4625: Logon failure
# 4648: Explicit credentials
# 4672: Admin logon

Linux Syslog and Systemd Journal

Linux logs to /var/log/ via syslog (rsyslog/syslog-ng) and systemd's journald. Key files: auth.log (authentication), syslog (general), kern.log (kernel), and application-specific logs.

# View auth log
tail -f /var/log/auth.log

# Search for failed SSH logins
grep "Failed password" /var/log/auth.log

# Systemd journal
journalctl -u sshd -f
journalctl --since "1 hour ago"
journalctl -p err -b

Web Server Access Logs

Apache/Nginx access logs record every HTTP request: client IP, timestamp, method, URL, status code, and user agent. Invaluable for detecting scanning, exploitation attempts, and data exfiltration.

# Apache format:
# IP - - [timestamp] "METHOD /path HTTP/1.1" status bytes "referer" "UA"
192.168.1.50 - - [01/Jan/2025:10:23:45 +0000] "GET /admin HTTP/1.1" 403 287

# Find 4xx errors (potential scanning)
grep " 40[0-9] " /var/log/apache2/access.log | awk '{print $1}' | sort | uniq -c | sort -rn

Firewall and Network Device Logs

Firewall logs record allow/deny decisions for network traffic: source/destination IP, port, protocol, and action. Essential for tracking lateral movement and data exfiltration attempts.

# iptables logging rule
iptables -A INPUT -j LOG --log-prefix "IPTABLES-DENY: "

# View firewall logs
grep "IPTABLES-DENY" /var/log/syslog

# Palo Alto/Cisco ASA logs go to syslog
# Format: date, action, src, dst, port, bytes

DNS Logs

DNS queries reveal what hosts are communicating with. Malware uses DNS for C2 (beaconing, DNS tunneling) and data exfiltration. Log all DNS queries — not just failures.

# Enable query logging in BIND
# named.conf:
logging {
    channel query_log {
        file "/var/log/named/queries.log";
        severity info;
        print-time yes;
    };
    category queries { query_log; };
};

# Detect tunneling: long subdomains
awk '{print length($0), $0}' queries.log | sort -rn | head -20

DHCP Logs

DHCP logs map IP addresses to MAC addresses and hostnames at a point in time — essential for identifying which physical device held an IP address during an incident.

# DHCP log location (Linux):
/var/log/dhcpd.log
/var/lib/dhcpd/dhcpd.leases

# Windows DHCP Server:
# C:\Windows\System32\dhcp\DhcpSrvLog-*.log

# Correlate: IP address → MAC → hostname → user

Application and Database Logs

Application logs reveal business-logic attacks: SQL injection attempts in DB query logs, authentication bypass in app logs, privilege escalation in audit tables. Always enable DB query logging in test environments.

# MySQL query log
# my.cnf:
general_log = 1
general_log_file = /var/log/mysql/query.log

# PostgreSQL
# postgresql.conf:
log_statement = 'all'
log_min_duration_statement = 0

# View slow queries
grep "Query" /var/log/mysql/query.log | grep -v "SELECT 1"

VPN and Authentication Logs

VPN logs show which users connected from where and when. Anomalies: impossible travel (login from NY and London within 1 hour), off-hours access, and new countries indicate compromised credentials.

Log Retention and Integrity

Logs must be retained long enough for investigations (90 days minimum; 1 year for compliance). Ship logs to a centralized, tamper-resistant system immediately — local logs can be cleared by attackers.

Normalization and Parsing

Logs come in dozens of formats. Normalization converts them to a common schema (IP, timestamp, event type, user) enabling cross-source correlation in a SIEM.

Quick Check

Which Windows Event ID indicates a failed logon attempt?

Summary: Log Sources

Effective security monitoring requires logs from every layer: OS authentication events, network firewall and DNS, web server access, application/database, and VPN. Ship logs centrally and immediately — attackers clear local logs. Normalize formats for cross-source correlation and retain for at minimum 90 days to support investigations.

Frequently asked questions

Is the “Log Sources: OS, Network, and Application Logs” lesson free?

Yes — the full text of “Log Sources: OS, Network, and Application Logs” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.

What will I learn in “Log Sources: OS, Network, and Application Logs”?

Understand what Windows Event Logs, syslog, Apache/Nginx logs, and firewall logs contain. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cyber Security Academy?

No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 1 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Log Sources: OS, Network, and Application Logs” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cyber Security Academy lesson?

Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Log Sources: OS, Network, and Application Logs
  2. SIEM Architecture and Log Ingestion
  3. Writing Detection Rules and Correlation
  4. Alert Triage and SOC Workflow
← Back to Cyber Security Academy