linuxexpert-practice-labs/labs/linux-plus/3-1-2-logging-and-auditing/README.md

Linux+ 3.1.2: Logging and auditing

A persistent journal, a tagged log message, a logrotate rule, and an audit watch on a file.

Before you start

The journal on this VM is kept in memory only, so it's lost at every reboot (the lab moved any saved journal aside; reset puts it back). The lab creates /var/log/labapp/app.log, a log file of a made-up application. auditd runs on the RHEL family; on Ubuntu it isn't installed yet.

Tasks

1. Make the journal persistent, so that it keeps messages across reboots. Check its size and the list of boots.
2. After task 1, log the message hello journal with the tag labtest, and find it in the journal by its tag.
3. Write a logrotate rule, /etc/logrotate.d/labapp, for /var/log/labapp/*.log: rotate daily, keep 3 old logs, compress them, and don't complain if a log is missing. Test it with a dry run, then force a rotation.
4. Watch /etc/hosts for writes and attribute changes with the audit key hosts-change (install auditd on Ubuntu first; on AlmaLinux 10, auditctl is in the audit-rules package). Touch the file, add a line to it, and find the events by their key. Then take the line out again and remove the watch.

Hints

• /var/log/journal, systemctl restart systemd-journald; until the next boot, journald writes there only after journalctl --flush. journalctl --disk-usage, journalctl --list-boots.
• logger -t, journalctl -t.
• logrotate -d (dry run), logrotate -f (force).
• auditctl -w FILE -p wa -k KEY, ausearch -k KEY -i, auditctl -W.