Enable Logging and Monitoring

System logs are essential for tracking activities, detecting security incidents, and troubleshooting issues. Without proper logging, it’s difficult to identify unauthorized access, configuration changes, or potential attacks.

By enabling logging and monitoring, you gain visibility into system activity and can respond quickly to threats.

How to Set Up Logging and Monitoring

1. Implement Auditing with auditd

The auditd daemon monitors system events and tracks changes to critical files, helping you detect unauthorized access or modifications.

How to Install and Configure auditd:

1. Install auditd:

   sudo apt install auditd -y   # For Debian/Ubuntu
   sudo yum install audit -y    # For CentOS/RHEL

2. Set up file monitoring rules:
   Open the audit rules configuration file:

   sudo nano /etc/audit/audit.rules

   Add rules to monitor critical files:

   -w /etc/passwd -p wa -k passwd_changes
   -w /etc/shadow -p wa -k shadow_changes
   -w /var/log/auth.log -p wa -k auth_changes

   • -w /etc/passwd → Monitors changes to the user account file.

   • -p wa → Watches for write (modifications) and attribute changes.

   • -k passwd_changes → Tags the event for easy filtering.

3. Restart auditd to apply changes:

   sudo systemctl restart auditd

4. View audit logs:

   sudo ausearch -k passwd_changes
   sudo aureport -a

   These commands search for and report security events related to monitored files.

2. Enable System Logging with rsyslog

rsyslog collects system logs, making it easier to track user activity, errors, and security events.

How to Enable rsyslog:

1. Ensure rsyslog is installed:

   sudo apt install rsyslog -y   # For Debian/Ubuntu
   sudo yum install rsyslog -y   # For CentOS/RHEL

2. Start and enable the logging service:

   sudo systemctl enable --now rsyslog

3. View system logs:

   sudo cat /var/log/syslog      # General system logs (Ubuntu/Debian)
   sudo cat /var/log/messages    # System logs (CentOS/RHEL)
   sudo cat /var/log/auth.log    # Authentication logs

3. Set Up Real-Time Log Monitoring with Logwatch

Logwatch generates daily reports summarizing log activity, helping you identify suspicious behavior.

How to Install and Use Logwatch:

1. Install Logwatch:

   sudo apt install logwatch -y   # Debian/Ubuntu
   sudo yum install logwatch -y   # CentOS/RHEL

2. Generate a log report manually:

   sudo logwatch --detail High --service sshd --range today

   (This provides a detailed report of SSH activity for today.)

3. Schedule automatic daily reports (optional):

   • Open the cron job configuration:

     sudo nano /etc/cron.daily/00logwatch

   • Add the following line:

     /usr/sbin/logwatch --output mail --mailto admin@example.com --detail High

   (This sends daily log reports to the admin’s email.)

Best Practices for Logging and Monitoring

✅ Enable centralized logging by forwarding logs to a remote syslog server.
✅ Regularly review logs for unusual login attempts or system modifications.
✅ Set up real-time alerts for critical log entries using tools like logwatch or fail2ban.
✅ Use a log management system like ELK Stack (Elasticsearch, Logstash, Kibana) or Splunk for advanced log analysis.

By enabling audit logging and system monitoring, you can track security events, detect intrusions, and investigate incidents effectively, ensuring a secure and well-monitored Linux server.